Hi Guys
I wonder if there's some dongle free cracked version of
Best Smart Tools?
Did found any and so I since about 1 day about to 'craft' one myself.
The files
are protected by
VMProtect.
To 'get in' with the debugger like Ollydbg or X64DBG use the
plugin and select in its options VMProtect as Profil.
If you use Ollydbg still take care for this TLS callback that are triggered and executed before entry point (->EP).
(VMP uses this to detect the debuggers breakpoint at the EP, Remember that 0xCC Int3 that is written there. ) Well to overcome this set in ollydbg option/Events to stop at System. When it stop there go the breakpoints and remove the one-short breakpoints at the EP
Okay that for the short briefing.
(*) about ActEx0.dll its not exactly the python-3.4.2.dll
it has one more additional export.
"_PyImport_LoadDynamicModule"
because of this renaming python34.dll to ActEx0.dll doesn't work. So I compiled some Trampoline dll that just redirect all it's exports to python34.dll. Linked to stupid "_PyImport_LoadDynamicModule" to whatever and expect so far BST will not really use this. (If it does I'll crash) however like this i'll at least load. Hehe First cheated success 1/4 Files Unpacked.
Well the app tries to minic Themida since the protector sections are .tmd0 and .tmd0 and they even tooked care for the such subtile differences like this:
File corrupted!
. This program has been manipulated and maybe
it's infected by a Virus or cracked. This file won't work anymore.
See the red dot after ' ...corrupted!' Only Themida has it. The default VMProtect Message about this is the same, but without dot...
Obfuscation is really a mess - well the
plugin may help a little.
Looking for a Dumper to save the unpacked app to Disk
try
But yes the real fun will start when rebuilding the mugged up Imports.
Well some hints about Tools: 'Import REConstructor v1.6' or '
'
And yep at the end and since so much distraction I haven't look for the actual dongle check yet.
Incase it is 'visualized' I'll be an other kick'n'butt err 'challenge'
Okay thats it for now - enjoy.:icq22: