Fravia's TOOLS OF OUR TRADE Messageboard ~ Moderated
Procdump & Winamp 2.05
Thursday, 26-Nov-98 23:15:57

hi,
I tried to unpack WinAmp 2.05, just to test the petite unpacking
support of ProcDump 1.16 but seems the the tracer couldn't handle
this particular ?!? target (i.e. i've tried bulletproof and work
perfectly).

I have been looking for the reason and find out that the
Petite version used in WinAmp 2.05 add another layer of
inderection before the final jmp..
so i've tried this script :

L1=LOOK E8,10,F4,F5,FF
L2=BP
L3=ADD FFF5F4EF
L4=BP
L5=STEP

but this approach doesn't work too:
ProcDump reachs the bp correctly.. enter step by step mode but
seems to lose the process control just before program entry-point
closing WinAmp silently.. (no exitprocess, postquit,ecc..)

i have checked if there are some ADT.. but i've not found anything
(if there are.. plz correct me :)

The next step was settings some condictional BPM X breakpoints to see
if the dumper reach the entry point.. nothing.. it stops to the last
jmp!

Is there someone so kind to tell me what i'm missing?

tnx in advance,
kill3xx

p.s.
sorry for my very bad english :)



kill3xx