[RELEASE+DISCUSSION] Unpacked CABALMAIN.EXE

[iNFIDEL_]

Well, good luck finding ways to unpack Themida/WinLicense.

[brian86]

@dlnqt i reach the MoleBox 2.6x but i dont know how to remove this in such a way that the unpacked cabal can be attach to olly.. any tips?? tnx for the guide.

[angstfeardoubt]

to dlqnt and atomica:

of cabalmain is unpacked up to this point, will i already be able to locate the dc flag?

is the dc flag on the cabalmain thread?



thanks to the previous tips, i was able to change the bad and good combo thing to excellent. I'm learning!!!!

[dlnqt]

I dont know if the dc flag is located in main.. but i think it is.. not sure though.. haven't found it yet

what you did there was live debug your original cabalmain.exe right? I guess only a handful of people know how to use the very basic of ollydbg

[NoobWant2Learn]

try using the dmg_explo search.. i found 4-5 lines containing a comment dmg_explo
dont know if its for dmg_exploits, or dmg_explode , or dmg_explosion.. haha... but still try it

[trevsky]

im starting from the very beginning on how to go live debug on Olly....

[NoobWant2Learn]

open cabal via cr, start cabal, attach olly = live dbg

[lamenin]

@noob
can u share with me how do u manage to keep ur cabal running when the olly is attached, coz when i attached it it shows that it's paused and when i play it it does continues to pause, even shift+f9 doesnt work for me. can u share me some insight with this

[spankwirenation]

ANyone has a comshop here in manila? pm me i have an interesting offer!!!

[NoobWant2Learn]

when attach its paused.. hit f9 to continue.. and if it doesnt, maybe ur options in olly blocks it... play with ur options.. and u will see what i mean

[lamenin]

tnx, im onto tracing now, ist ollysocketrace that u used or ollycalltrace

[howcow95]

@ anyone who can answer this question

instead of using cr to open cabal can you use hideolly? or phantom or some other plugin?

[NoobWant2Learn]

hideOD hides the debugger from being detected, still u cant bypass the gameguard

[howcow95]

still has a chance with x trap (CabalNA).... guess I'll try it after nw

[NoobWant2Learn]

i think twinR would bypass xtrap as my friends from SEA uses that...