Comments on: A little disassembler for MPress packer… http://reverse.put.as/2009/07/23/a-little-disassembler-for-mpress-packer/ Reverse Engineering for fun and pleasure! Sat, 04 Feb 2012 02:28:35 +0000 hourly 1 http://wordpress.org/?v=3.3.1 By: Hmm http://reverse.put.as/2009/07/23/a-little-disassembler-for-mpress-packer/comment-page-1/#comment-17083 Hmm Fri, 06 May 2011 08:30:06 +0000 http://reverse.put.as/?p=360#comment-17083 Any news? hw break seems not working on 10.6.7, and CC will kill it too. I tested the tut on some other targets and seem the packer got some pattern, should not be hard to write a script to dump the clean code. Any news? hw break seems not working on 10.6.7, and CC will kill it too.

I tested the tut on some other targets and seem the packer got some pattern, should not be hard to write a script to dump the clean code.

]]> By: B:. http://reverse.put.as/2009/07/23/a-little-disassembler-for-mpress-packer/comment-page-1/#comment-9203 B:. Mon, 26 Jul 2010 20:40:17 +0000 http://reverse.put.as/?p=360#comment-9203 Anyone found anything useful about this vmmap exception? Anyone found anything useful about this vmmap exception?

]]> By: fG! http://reverse.put.as/2009/07/23/a-little-disassembler-for-mpress-packer/comment-page-1/#comment-6474 fG! Sat, 22 May 2010 23:19:34 +0000 http://reverse.put.as/?p=360#comment-6474 I just verified everything and you are correct. When you try to vmmap inside the linker code it crashes with the same problem. Seems like a bug or something was changed with Snow Leopard... Have to investigate it further! I just verified everything and you are correct. When you try to vmmap inside the linker code it crashes with the same problem.
Seems like a bug or something was changed with Snow Leopard… Have to investigate it further!

]]> By: fG! http://reverse.put.as/2009/07/23/a-little-disassembler-for-mpress-packer/comment-page-1/#comment-6410 fG! Tue, 18 May 2010 23:05:22 +0000 http://reverse.put.as/?p=360#comment-6410 I gave a quick check yesterday and it seems to work without any problems in my Snow Leopard 10.6.3. I will do a complete test with a new binary this weekend and I will tell you about my results. You got me curious on this one! I gave a quick check yesterday and it seems to work without any problems in my Snow Leopard 10.6.3.
I will do a complete test with a new binary this weekend and I will tell you about my results. You got me curious on this one!

]]> By: fG! http://reverse.put.as/2009/07/23/a-little-disassembler-for-mpress-packer/comment-page-1/#comment-6398 fG! Mon, 17 May 2010 21:49:41 +0000 http://reverse.put.as/?p=360#comment-6398 Yes I went and checked mpress and it's still the same version... I will test it out in my system and see if the same thing is happening. Could be something that changed in Snow Leopard that's killing it. Yes I went and checked mpress and it’s still the same version… I will test it out in my system and see if the same thing is happening.
Could be something that changed in Snow Leopard that’s killing it.

]]> By: navaja http://reverse.put.as/2009/07/23/a-little-disassembler-for-mpress-packer/comment-page-1/#comment-6373 navaja Fri, 14 May 2010 16:42:12 +0000 http://reverse.put.as/?p=360#comment-6373 The mpress version hasn't changed (v1.21). The target was mpress. However I get the same error with other targets. The mpress version hasn’t changed (v1.21). The target was mpress. However I get the same error with other targets.

]]> By: fG! http://reverse.put.as/2009/07/23/a-little-disassembler-for-mpress-packer/comment-page-1/#comment-6361 fG! Thu, 13 May 2010 23:49:08 +0000 http://reverse.put.as/?p=360#comment-6361 Hello, I have never seen that error. Either something was changed with Snow Leopard 10.6.3 or MPress has a new version. Can you tell me what is the target so I can give it a look? Thx! fG! Hello,

I have never seen that error. Either something was changed with Snow Leopard 10.6.3 or MPress has a new version.
Can you tell me what is the target so I can give it a look?

Thx!
fG!

]]> By: navaja http://reverse.put.as/2009/07/23/a-little-disassembler-for-mpress-packer/comment-page-1/#comment-6360 navaja Thu, 13 May 2010 22:09:39 +0000 http://reverse.put.as/?p=360#comment-6360 Hi. I was going through your "Dumping MPress packed binaries" article. Towards the end I get an error when trying to use vmmap... [QUOTE:] That jump at 0xa09a is very suspicious...If you follow it you will land at this address 0x8fe01010 (might be different for you). Using again vmmap to understand to what corresponds this address we get: (...) __TEXT 8fe00000-8fe2e000 [ 184K/ 184K] r-x/rwx SM=COW /usr/lib/dyld (...) [/QUOTE] Instead of finding out the region that address corresponds to, I get the following error: [QUOTE] Terminating app due to uncaught exception 'VMUDyld fatal error', reason: 'Attempt to get _dyld_all_image_infos failed' [/QUOTE] Do you have any idea what going on? Do you see this error msg often when using vmmap? I am using Mac OS X 10.6.3. Hi. I was going through your “Dumping MPress packed binaries” article.

Towards the end I get an error when trying to use vmmap…

[QUOTE:]
That jump at 0xa09a is very suspicious…If you follow it you will land at this address 0x8fe01010 (might be different for you).
Using again vmmap to understand to what corresponds this address we get:
(…)
__TEXT 8fe00000-8fe2e000 [ 184K/ 184K] r-x/rwx SM=COW /usr/lib/dyld
(…)
[/QUOTE]

Instead of finding out the region that address corresponds to, I get the following error:

[QUOTE]
Terminating app due to uncaught exception ‘VMUDyld fatal error’, reason: ‘Attempt to get _dyld_all_image_infos failed’
[/QUOTE]

Do you have any idea what going on? Do you see this error msg often when using vmmap?

I am using Mac OS X 10.6.3.

]]>