Help me to unpack NINEDRAGON.EXE

sp_vn · 01/16/2010, 06:56

I need file unpack NINEDRAGON.EXE of 9D US ^^. I dont know unpack it. It's packed by yoda protector. Who can?? Thx first.

djsysulica · 01/16/2010, 09:42

Quote:

Originally Posted by sp_vn

I need file unpack NINEDRAGON.EXE of 9D US ^^. I dont know unpack it. It's packed by yoda protector. Who can?? Thx first.

its packed with two packers....yoda protector and ASPack
i tried once..but no success

CrashnBurn · 02/11/2010, 14:09

anybody had any luck with this?
Being having nothing but fails either.

Which tools did you guys use?

lph2003 · 02/11/2010, 16:02

maybe you can finde your tools here :

CrashnBurn · 02/11/2010, 16:27

i used olly, exe was not valid.
Would not start for whatever reason.

CrashnBurn · 02/11/2010, 16:35

actually that site, had the tools.
But the Yoda unpacker is for 1.0, we need 1.3

CrashnBurn · 02/11/2010, 16:57

Code:

   1. ///////////////////////////////////////////////////////////
   2. //  FileName    :  yoda's Protector V1.03.X.osc
   3. //  Comment     :  yoda's Protector V1.03.1/V1.03.2/V1.03.3 UnPacK
   4. //  Environment :  WinXP SP2,OllyDbg V1.10,OllyScript V0.92
   5. //  Author      :  fly
   6. //  WebSite     :  http://www.unpack.cn
   7. //  Date        :  2005-10-05 23:00
   8. ///////////////////////////////////////////////////////////
   9. #log
  10. dbh
  11.
  12. var T0
  13. var T1
  14. var T2
  15. var T3
  16. var T4
  17.
  18. MSGYN "Plz Clear All BreakPoints  And  Set Debugging Option Ignore All Excepions Options.  "
  19. cmp $RESULT, 0
  20. je TryAgain
  21.
  22.
  23. //GetVersion————————————————————————————————
  24.
  25. /*
  26. 00461EBE    FF541D 00       call dword ptr ss:[ebp+ebx]; kernel32.GetVersion
  27. 00461EC2    A9 00000080     test eax,80000000
  28. 00461EC7    74 20           je short 00461EE9
  29. 00461EC9    3C 04           cmp al,4
  30. 00461ECB    75 0C           jnz short 00461ED9
  31. 00461ECD    C785 48A04200 0>mov dword ptr ss:[ebp+42A048],2
  32. 00461ED7    EB 40           jmp short 00461F19
  33. 00461ED9    3C 03           cmp al,3
  34. 00461EDB    75 3C           jnz short 00461F19
  35. 00461EDD    C785 48A04200 0>mov dword ptr ss:[ebp+42A048],1
  36. 00461EE7    EB 30           jmp short 00461F19
  37. 00461EE9    3C 03           cmp al,3
  38. //Windows3.X ？
  39. 00461EEB    75 0C           jnz short 00461EF9
  40. 00461EED    C785 48A04200 0>mov dword ptr ss:[ebp+42A048],4
  41. 00461EF7    EB 20           jmp short 00461F19
  42. 00461EF9    3C 04           cmp al,4
  43. //Windows9X、NT4.0 ？
  44. 00461EFB    75 0C           jnz short 00461F09
  45. 00461EFD    C785 48A04200 0>mov dword ptr ss:[ebp+42A048],8
  46. */
  47.
  48. gpa "GetVersion", "KERNEL32.dll"
  49. eob GetVersion
  50. bp $RESULT
  51. esto
  52. GoOn0:
  53. esto
  54.
  55. GetVersion:
  56. cmp eip,$RESULT
  57. jne GoOn0
  58. bc $RESULT
  59. rtu
  60. mov eax,4
  61. mov [$RESULT], #B804000000C3#
  62.
  63.
  64. //SetWindowLongA————————————————————————————————
  65.
  66. gpa "GetWindowLongA", "User32.dll"
  67. eob GetWindowLongA
  68. bp $RESULT
  69. esto
  70. GoOn1:
  71. esto
  72.
  73. GetWindowLongA:
  74. cmp eip,$RESULT
  75. jne GoOn1
  76. bc $RESULT
  77. rtu
  78. mov T0,eax
  79.
  80. //Lock Shell_TrayWnd
  81. gpa "SetWindowLongA", "User32.dll"
  82. eob SetWindowLongA
  83. bp $RESULT
  84. esto
  85. GoOn2:
  86. esto
  87.
  88. SetWindowLongA:
  89. cmp eip,$RESULT
  90. jne GoOn2
  91. bc $RESULT
  92. mov T1,esp
  93. add T1,C
  94. mov [T1],T0
  95. rtu
  96.
  97.
  98. //IsDebuggerPresent————————————————————————————————
  99.
 100. gpa "IsDebuggerPresent", "KERNEL32.dll"
 101. eob IsDebuggerPresent
 102. bp $RESULT
 103. esto
 104. GoOn3:
 105. esto
 106.
 107. IsDebuggerPresent:
 108. cmp eip,$RESULT
 109. jne GoOn3
 110. bc $RESULT
 111. rtu
 112.
 113. find eip, #C1CB07#
 114. cmp $RESULT, 0
 115. je NoFind
 116. mov T2,$RESULT
 117. eob Ror7
 118. bp T2
 119. log T2
 120. esto
 121. GoOn4:
 122. esto
 123.
 124. Ror7:
 125. cmp eip,T2
 126. jne GoOn4
 127. bc T2
 128. mov T3,ebx
 129. log ebx
 130.
 131.
 132. //Fixed Importing Function————————————————————————————————
 133.
 134. find eip, #89322BC683E805#
 135. cmp $RESULT, 0
 136. log $RESULT
 137. je NoFind
 138.
 139.
 140. mov T4,$RESULT
 141. mov [T4],C62B9090
 142. //Fixed Importing Function
 143.
 144. find eip, #740261C3#
 145. cmp $RESULT, 0
 146. je NoFind
 147.
 148. eob Popad
 149. bp $RESULT
 150.
 151. esto
 152. GoOn5:
 153. esto
 154.
 155. Popad:
 156. cmp eip,$RESULT
 157. jne GoOn5
 158. bc $RESULT
 159. mov [T4],C62B3289
 160. //Revert Code
 161.
 162.
 163. //MyOEP————————————————————————————————
 164.
 165. eob MyOEP
 166. bp T3
 167.
 168. esto
 169. GoOn6:
 170. esto
 171.
 172. MyOEP:
 173. cmp eip,T3
 174. jne GoOn6
 175. bc T3
 176.
 177.
 178. //GameOver————————————————————————————————
 179.
 180. log eip
 181. cmt eip, "This is the OEP! Found By: fly"
 182. MSG "Just : OEP !  Dump and Fix IAT.  Good Luck   "
 183. ret
 184.
 185. NoFind:
 186. MSG "Error! Maybe It's not yoda's Protector V1.03.1/V1.03.2/V1.03.3 !  "
 187. ret
 188.
 189. TryAgain:
 190. MSG " Plz  Try  Again   !   "
 191. ret

复制代码

I found this through good, its supposed to be code for a yoda 1.3 unpacker.

CrashnBurn · 02/11/2010, 21:16

Hi guys,

I know there already is a topic about this, but i wanted to avoid mixing up helping unpacking and having it unpacked.

I have being trying all day to get it unpacked.
And i might have done it, but i need some help confirming this is done right.

Merge the 2 topics or just delete this one should i be wrong.

Edit: Don't know if its needed but here a MD5 check for both rar and exe
Rar MD5: 5a9a47f24c5f8fe8c2ab02605b4d857a
Exe MD5: 29e3cc6867e89c64182c13b1762ecee8

saweet · 02/11/2010, 22:06

#merged threads

sheik_gray · 02/12/2010, 02:37

why we need unpack client ? srry im just a newbie xD

uumerma · 02/12/2010, 11:42

Yeah im not really understanding the point of unpacking it. can some one that does please explain what the unpacked version is gonna do cause i know wat 2moons unpacked can do u want to do the same thing or what? thanks

CrashnBurn · 02/12/2010, 13:21

IF this one works, it wont anymore.
Gotta do it again i think because of the patch.

mardan · 02/15/2010, 15:39

why not just use GG killer :S ? it cant be blocked.. all u need to do is patch client and add GG killer files on new.. :/ atlest i keep doing that and i can do what the fuu i want in 9D now

with CE/Rev engine`s... but i wonder if someone gonna make a Good hack for 9D soon. since we got GG killer

and i dunno anything about making hacks for 9D.. but i think it is 100% same way on US that it is on VN.. i just love epvp o.o makeing something fun out of my day

i love posting here <3

CrashnBurn · 02/15/2010, 16:53

erm a unpacked client adds more possibility to hack/cheat.
GG killer still has to be running to use it.

A unpacked client isnt used to bypass GG

id trow a lock on this one, there is a release thread which is enough imo.

saweet · 02/16/2010, 03:26

#merged posts
#closed