2

I have an old piece of software (for cutting and plotting vectors onto physical media) (released about 2000-2001) which I use to this day. The software employs a HASP HL with a parallel port hardware lock. I've managed to debug and dump the executable (without the protection). However, when I try it on another of my machines it does not start. The dumped executable will start on the machine that it was dumped on, but not another machine. This would be no problem, except if the hardware key were to break, I wouldn't be able to dump it on a future machine.

Something I should note is that, the software is no longer supported. Since the developer passed away in early 2008 the software has been totally abandoned. Having paid over $2000 for this, without any alternative that I am familiar with, I fear that if the hardware key does break I will be left without software that I use day-to-day.

Improve this question
2

You need to rebuilt the Import Table for your program to work correctly on other systems.

Basic steps to unpacking:

  1. Trace to the Original Entry Point
  2. Dump the memory
  3. Rebuild the Import Table with a tool such as Import REConstructor and change the PE's Entry Point value to the Original Entry Point's RVA
Improve this answer
4
  • I did rebuild the import table, as far as I know. Used ImpRec to relocate it and changed the RVA to that of which was traced to a breakpoint I placed on the .text section of the PE. I was under the impression that doing so would change it to the OEP. Unless there is a different process to obtain the OEP. I'm a little confused here. – Terry Nov 19 '13 at 23:03
  • Feel free to post a link and I'll take a peek. – Jason Geffner Nov 19 '13 at 23:04
  • I've uploaded a file containing the protected exe, dumped and the one in which I rebuilt the imports here. Thanks a lot! – Terry Nov 20 '13 at 1:40
  • The _imprec.exe file looks fine from a quick glance, though obviously I'm missing many of the DLLs it statically imports so I can't test it. When you say, "it does not start", what error are you getting? – Jason Geffner Nov 20 '13 at 15:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.