Why everyone is unable to FULLY unpack the bot without error.

Fugltlve · 09/27/2007, 19:36

Update:
looks like the EIP might be in the actual exe we run to launch the the bot. after entry it calls to the gamemon.des. this isnt a problem in itself, BUT becomes a huge problem when trying to unpack it.
the launcher program doesnt use Themdia

running SEVERAL unpackers, debuggers, and dissassemblers on this **** bot I have found something.
Themdia is not the problem at all. that actually should be able to be stripped out fairly easy.
anyone thats run UnThemida on the bot has probably found that you get an OEP error and UnThemida terminates.

What I have tried:

i have run a couple OEP finders as well as tried to force OEP in the unpacking.
i have found a varience of OEP depending on which find method I was using. all the OEP end up having various offset errors. (most at FFFF 038FB039)
in the version I did unpack (but did not unhook anything) that address comes up with "FFFF ??? Unknown Command" every time.

What I have Found:
every working solution is found by trying to repro the problem.
I was able to figure out WHY this is a problem, but I do not know how to get around it without manually unpacking with a MUP (i tried but I am unable to locate the ACTUAL entry point for OEP)

problem with this **** bot is that the OEP is outside of the PE headers. that is why any of our unpacking utilities are having problems, or giving errors.

if anyone can find me the EP for OEP, i can manually unpack it and unhook all the needless **** in it.
Im PRETTY sure the entry point is located in the "launcher" program.

lordpipas · 09/27/2007, 20:58

heh .... we unpack it . isn't it ? Yes Ep is in the launch program use Artmoney and u can see it

Fugltlve · 09/27/2007, 21:20

Quote:

Originally Posted by lordpipas

heh .... we unpack it . isn't it ? Yes Ep is in the launch program use Artmoney and u can see it

yep. i got the EIP address for OEP, its just that i havent found a utility that will allow me to unpack gamemon.des correctly with the EIP outside of the PE header.

lordpipas · 09/28/2007, 08:05

so ..what the problem ?

Fugltlve · 09/28/2007, 16:20

Quote:

Originally Posted by lordpipas

so ..what the problem ?

i havent found a utility that will allow me to unpack gamemon.des correctly with the EIP outside of the PE header, and im not sure how to remove themida by using MUP

lordpipas · 09/28/2007, 16:55

wm qUp ? its work ....why not ?

Fugltlve · 09/28/2007, 17:53

Quote:

Originally Posted by lordpipas

wm qUp ? its work ....why not ?

i can unpack it just fine with qunpack. BUT you cant unhook anything and you get an error that the OEP is outside the PE header. so it unpacks incorrectly as the EP isnt in the unpack.
I researched this a little bit and found that if the OEP is ouside of the PE header you need to unpack the program manually via MUP in order to unpack with the entry point.
i can unpack manually (although id rather not cause its a horrid process) but i dont know how to strip out Themida before i unpack it

lordpipas · 09/28/2007, 20:13

em....GameMons insnt .exe file its source file ... and nothing more ... so u dont must have EP ....

Fugltlve · 09/28/2007, 20:27

Quote:

Originally Posted by lordpipas

em....GameMons insnt .exe file its source file ... and nothing more ... so u dont must have EP ....

wont run unpacked without the EP for some reason. if i unpack with qunp, not unhook anything, the unpack file size is massive (56000k) compared to the packed 2000k. if i unhook everything as it should be, unpacked size is 2004k but wont initialize or test. just gives me the OEP error

luckyjol · 09/28/2007, 20:57

its normal that themida packs file to a file size which is hundretfold so largly like the normal file

Fugltlve · 09/28/2007, 22:28

Quote:

Originally Posted by luckyjol

its normal that themida packs file to a file size which is hundretfold so largly like the normal file

ok. so the original file the at 56000k with everything still hooked can be used?

luckyjol · 09/28/2007, 22:33

i am not sure i have no oep to test it but i read it in another forum from a guy called "sd333221" he is also registered to epvp

lordpipas · 09/29/2007, 10:11

yes it can be

Fugltlve · 09/29/2007, 20:37

Quote:

Originally Posted by lordpipas

yes it can be

thanks lord. i can start working on it again.

on that note. found the 3 call stacks that 1) request auth 2) recieve auth 3) deny on failed auth

looking for a way to put a bypass in. gonna try playing around with adding a EIP after the call stacks and see what happens

lordpipas · 09/29/2007, 20:55

Crashing

may be i doing something wrong ....