unpack l2walker

[Benjamin]

1.99 US
2.00 uS
2.01 US
2.02 US

2.03f CH
2.03g CH
2.04 CH
2.05 CH

10.8.8 US
10.8.9 US
10.9.0 US
10.9.1 US

[theroller]

so what are ppl supposed to do with those dlls?

are those the official ones or modified?

[Benjamin]

its official dll, but now is unpack you can modified it.

[ryuteki]

It`s not　working for me. Ｉｔ doesn`s hunt automatically.

[suspectgr]

benjamin how you unpack them?

[Benjamin]

ollydbg + ImpREC 1.7 + Script "Aspr2.XX_unpacker_v1.14E" for ollydbgscript plugin

[suspectgr]

ok but this packs are only the basic ones that views not the whole source

[apostolt]

So these are the unpacked ones not cracked,so someone thats knows what to do must get them and crack the one we want

[Taktloss]

benjamin plz write a tutorial .. "how to unpack walker dll`s" with screen shots

[Benjamin]

tools:

exemple with 2.05 us:

first launch ollydbg.exe and File->Open and select l2walker.dll



Clic Oui (yes)



Clic yes too

after go in plugin->Ollydbgscript and launch script



after a little time you see a popup



clic ok

after clic alt+L and you see the log



RVA of OEP is OEP = 73736 (for 2.05)
RVA of IAT is RVA = F2000
Size of IAT is Size = 750

Now launch ImpREC 1.7 and in Attack to an active process select loaddll.exe

and clic on "Pick DLL" and you see this:



select L2walker.dll and clic OK

at the right enter the value in case OEP, RVA and size and clic on "AutoSearch" and "Get Imports"



after clic on "Fix Dump" and you see popup



select the de_l2walker.dll and clic open, the dump file is fixed

now you have in folder de_l2walker_.dll rename it in l2walker.dll and is good.

[Taktloss]

NICE

[ted007]

can u xplain what you managed to do with that process?

cause at th end i find a L2Walker.dll 1mb more than the original
but still cant read it

[Iconian]

why cant you just post the fixed dll for both ig and oog...be so much simpliar

[Iconian]

Originally Posted by Benjamin

tools:

exemple with 2.05 us:

first launch ollydbg.exe and File->Open and select l2walker.dll



Clic Oui (yes)



Clic yes too

after go in plugin->Ollydbgscript and launch script



after a little time you see a popup



clic ok

after clic alt+L and you see the log



RVA of OEP is OEP = 73736 (for 2.05)
RVA of IAT is RVA = F2000
Size of IAT is Size = 750

Now launch ImpREC 1.7 and in Attack to an active process select loaddll.exe

and clic on "Pick DLL" and you see this:



select L2walker.dll and clic OK

at the right enter the value in case OEP, RVA and size and clic on "AutoSearch" and "Get Imports"



after clic on "Fix Dump" and you see popup



select the de_l2walker.dll and clic open, the dump file is fixed

now you have in folder de_l2walker_.dll rename it in l2walker.dll and is good.

Scan taken on 14 Aug 2008 00:23:44 (GMT)
A-Squared
Found nothing
AntiVir
Found PCK/Repacked, HEUR/Malware
ArcaVir
Found nothing
Avast
Found nothing
AVG Antivirus
Found nothing
BitDefender
Found nothing
ClamAV
Found nothing
CPsecure
Found BackDoor.W32.Nuclear.dg
Dr.Web
Found nothing
F-Prot Antivirus
Found W32/SYStroj.N.gen!********
F-Secure Anti-Virus
Found nothing
Fortinet
Found nothing
Ikarus
Found Exploit.Win32.DebPloit, Backdoor.Win32.Ginwui.a, Trojan-Downloader.Win32.Agent.aww
Kaspersky Anti-Virus
Found nothing
NOD32
Found nothing
Norman Virus Control
Found nothing
Panda Antivirus
Found nothing
Sophos Antivirus
Found nothing
VirusBuster
Found nothing
VBA32
Found nothing



hmmm......

[Benjamin]

its not trojan, you can download ollydbg in official website and plugin if you want...