Unpacking Yodas Protector 1.03.3
—
11:00 PM
—
18 Comments
—
Reverse Engineering
Watch Online Tutorial : Click Here
Download Archives : Unpackme, Complete Tutorial Click Here
C:\Yodas Protector Unpacking.swf
Build 2 successfully completed
Created at: Sat Aug 14 08:28:53 2010
Flash player required: v6.0 or above
Size: 1654 KB
Total frames in main movie: 5160
Playback frame rate: 20
Approximate playback time: 258 seconds
Annotated text transcript:
Unpacking Yoda's Protector 1.03.3
Tools :
-OllyDBG
-OllyDump
-IsDebugPresent (If you need)
-LordPE
-TargetFile
This Tutorial is writen by Richard Irfan Yusan
richardyusan@rocketmail.com
The TargetFile ;-)
yoda's Protector 1.03.3 -> Ashkbiz Danehkar
Entryopy : PACKED
EP Check : PACKED
Load the target file to OllyDBG
Set your Exceptions Settings like this
make sure this checkbox is checked
If User32.dll already loaded into memory, set your ollydbg events setting back to normal
Uncheck !
Right Click > Go To > Expression
Or
CTRL + G
Type "BlockInput"
Fill with NOPs
Place Breakpoint here
F2
Now, we must fix IsDebuggerPresent
there are two method :
1.Manual Fix : Continue watching
2. Using IsDebuggerPresent OllyDBG plugin , you can skip this step
MOV EAX,0
GetCurrentProcessId
Case sensitive
Yoda uses CreateToolhelp32Snapshot to retrieve all running processes. Then , yoda search for process that started unpackme and it checks does that proces has same PID as unpackme itself. If not, yoda terminates that process which is OllyDbg.exe in our case. If we patch CreateToolhelp32Snapshot API, we will get Invalid_Handle exception. But there is another very easy way how to trick yoda. Yoda uses GetCurrentProcessId API to retrieve it's own PID. We can make yoda think that it is ollydbg.exe if we set that API to retireve olly's PID. How we can do that? By injecting simple patch.
00000730 is OllyDBG PID
730 mean ollydbg pid
Run Debugged Program
F9
We land at this breakpoint :D
Run Debugged Program Again
F9
Set Memory BP on access
OEP
CTRL+A to analyze this code
UnPackMe file run without error :D
;-)
Entropy : NOT PACKED
EPCheck : NOT PACKED
And UnPackMe Unpacked succesfully !
My Blog :
richardyusan.wordpress.com
- Uncheck 'download with download manager' to download the file - Please report broken link in the comment!
fungsinya buat apa gan? btw quickwall hack nya kapan kabarnya direlease secara resmi gan?
ReplyDeletehadohh quickwallhack kenapa di kasih secur gan cara dptin securnnya gmna sih???syarat2nya?kpn di release public~
ReplyDeleteTHX Behore ~
Gan RCD, yg d proteksi itu pass na apa?
ReplyDeletemas rcd aku pm di forum nyit nyit lom ada replay...thank
ReplyDeletegan pass.a nanti kirim ke email.q ya ?
ReplyDeleteplizzz gan T.T
sabar aj kk,
ReplyDeletemngkin nunggu bis maintenan pbnya x bru di sebar
itu fungsinya buat apa gan yodasprotector
ReplyDeleteyahh aku downlad tapi gunanya ? apa :(
ReplyDeletekk richard bikinin cheat ninja saga dong aku butuh plizz
ReplyDeletekali aja bisa
gan ,.,. gimana tuh tutor nya rumit amat !!
ReplyDeletetrus cheat ammo nya gan kog ngga berfungsi ,.
vidio nya rumit kk kcil !!
tlong tanggapi kk richard ^^
ehh....ehhh...ggaaannnn
ReplyDeletesaya baru tau ternyata dari gemscool juga ada ngeluarin cheat....
mereka nyebar cheat secara cuma2 d forumnya ...
cek aja nih tp hrs daftar dolo....
http://gemcheat.darkbb.com/forum.htm
ahahhahahahhahahahhahahahahhahahahaha
ternyata kadal makan kadal....
mereka basmi cheater tp mereka membiakan cheat jg...hahahhahahahahhahahahahhahahahahahhahahahahhahahah....
like this bgd dah gw....
kacauu....hahahahhahahahha
LEacher detected
ReplyDeletegwa ksih tw cara singkat pke cheat yg work 100 %,,yg mw tw info lanjut nya coment di FB gwa z,, untk mencaga kerahasiaan..
ReplyDeletecaranya dgn PM dan gwa bls ntr dgn info lanjut nya,serta tutorial nya..
FB gwa erryburonan2nd@yahoo.com
ReplyDeletethx..
gwa ksih tw cara singkat pke cheat yg work 100 %,,yg mw tw info lanjut nya coment di FB gwa z,, untk menjaga kerahasiaan..
ReplyDeletecaranya dgn PM dan gwa bls ntr dgn info lanjut nya,serta tutorial nya..
PM di : erryburonan2nd@yahoo.com
thx..
YANG COMENT KEBANYAKAN LEACHER NYOK
ReplyDeleteKluarin Cheat Beret dund Bwat Jimat gua !
ReplyDeleteThx bwat anak anak R_Club ! MERDEKA !
[...] C:Yodas Protector Unpacking.swf Build 2 successfully completed Created at: Sat Aug 14 08:28:53 2010 Flash player required: v6.0 or above Size: 1654 KB Total frames in main movie: 5160 Playback frame rate: 20 Approximate playback time: 258 seconds Annotated text transcript: Unpacking Yoda's Protector 1.03.3 Tools : -OllyDBG -OllyDump -IsDebugPresent (If you need) -LordPE -TargetFile This Tutorial is writen by Richard Irfan Yusan richardyusan@rocketmail.com The TargetFile yoda's Protector 1.03.3 -> Ashkbiz Danehkar Entryopy : PACKED EP Check : PACKED Load the target file to OllyDBG Set your Exceptions Settings like this make sure this checkbox is checked If User32.dll already loaded into memory, set your ollydbg events setting back to normal Uncheck ! Right Click > Go To > Expression Or CTRL + G Type "BlockInput" Fill with NOPs Place Breakpoint here F2 Now, we must fix IsDebuggerPresent there are two method : 1.Manual Fix : Continue watching 2. Using IsDebuggerPresent OllyDBG plugin , you can skip this step MOV EAX,0 GetCurrentProcessId Case sensitive Yoda uses CreateToolhelp32Snapshot to retrieve all running processes. Then , yoda search for process that started unpackme and it checks does that proces has same PID as unpackme itself. If not, yoda terminates that process which is OllyDbg.exe in our case. If we patch CreateToolhelp32Snapshot API, we will get Invalid_Handle exception. But there is another very easy way how to trick yoda. Yoda uses GetCurrentProcessId API to retrieve it's own PID. We can make yoda think that it is ollydbg.exe if we set that API to retireve olly's PID. How we can do that? By injecting simple patch. 00000730 is OllyDBG PID 730 mean ollydbg pid Run Debugged Program F9 We land at this breakpoint Run Debugged Program Again F9 Set Memory BP on access OEP CTRL+A to analyze this code UnPackMe file run without error Entropy : NOT PACKED EPCheck : NOT PACKED And UnPackMe Unpacked succesfully ! sumber [...]
ReplyDelete