Welcome To The Home Of The Visual FoxPro Experts  
home. signup. forum. archives. search. google. articles. downloads. faq. members. weblogs. sponsors. rss.
 From: who_is_here_
  Where is who_is_here_?
 asdasdasdasd
 Kyrgyzstan
 who_is_here_
 To: Badita Alexandru
  Where is Badita Alexandru?
 Bucharest
 Romania
 Badita Alexandru
 Tags
Subject: RE: SOLLOK.EXE the on in sollock.rar
Thread ID: 37061 Message ID: 70825 # Views: 38 # Ratings: 1
Version: Visual FoxPro 6 Category: Security and Application Protection
Date: Friday, June 24, 2005 1:40:46 PM         
   


Sollock only adds at the end of exe, another litle foxpro (encrypted) ".fxp". This make the unfoxallpro or refox scanner fails. The idea is good, but the result is too poor. NOTHING OF EXE CHANGES!!! only grows 277 bytes at the end. How remove protection? very easy, read and rewrite exe with size 277 bytes less.. :) None protection developed in visualfoxpro is secure, only changing the executable loader (like konxises) and reencrptyng, offers any result, but nothing is secure.

the code to remove sollock protection:

SET TALK OFF
SET safe off
LOCAL FILE_C,vmfalseloader,FO,char_1
vmfalseloader=CHR(254)+CHR(242)+CHR(238)+CHR(200)+CHR(57)+CHR(157)+CHR(106)+CHR(19)+CHR(230)+CHR(68)+CHR(169)+;
CHR(206)+CHR(115)+CHR(129)+CHR(20)+;
CHR(74)+CHR(191)+CHR(215)+CHR(138)+CHR(134)+CHR(203)+CHR(68)+CHR(243)+CHR(238)+CHR(233)+CHR(152)+CHR(25)+;
CHR(206)+CHR(155)+CHR(226)+CHR(92)+;
CHR(138)+CHR(93)+CHR(194)+CHR(254)+CHR(238)+CHR(34)+CHR(144)+CHR(32)+CHR(145)+CHR(105)+CHR(228)+CHR(166)+CHR(180)+CHR(40)+;
CHR(95)+CHR(244)+CHR(194)+CHR(64)+CHR(245)+CHR(49)+CHR(116)+CHR(89)+CHR(35)+CHR(192)+CHR(90)+CHR(50)+;
CHR(3)+CHR(229)+CHR(238)+CHR(162)+CHR(39)+CHR(212)+CHR(139)+CHR(136)+CHR(15)+CHR(176)+CHR(171)+CHR(219)+CHR(96)+CHR(74)+;
CHR(127)+CHR(231)+CHR(228)+CHR(166)+CHR(180)+CHR(40)+CHR(95)+CHR(244)+CHR(194)+CHR(64)+CHR(245)+CHR(49)+CHR(116)+CHR(89)+;
CHR(35)+CHR(192)+CHR(76)+CHR(226)+CHR(19)+CHR(120)+CHR(23)+CHR(139)+CHR(55)+CHR(46)+CHR(231)+CHR(8)+CHR(123)+CHR(165)+CHR(113)+CHR(191)+CHR(215)+CHR(138)+CHR(134)+CHR(203)+CHR(68)+;
CHR(243)+CHR(238)+CHR(233)+CHR(152)+CHR(25)+CHR(206)+CHR(155)+CHR(226)+CHR(92)+CHR(138)+CHR(191)+CHR(215)+CHR(138)+CHR(134)+CHR(203)+CHR(68)+;
CHR(243)+CHR(238)+CHR(233)+CHR(152)+CHR(25)+CHR(206)+CHR(155)+CHR(226)+CHR(92)+CHR(138)+CHR(93)+CHR(194)+CHR(254)+CHR(238)+CHR(34)+;
CHR(144)+CHR(32)+CHR(145)+CHR(105)+CHR(228)+CHR(166)+CHR(180)+CHR(40)+CHR(95)+CHR(244)+CHR(194)+CHR(136)+CHR(15)+;
CHR(176)+CHR(171)+CHR(219)+CHR(96)+CHR(74)+CHR(127)+CHR(231)+CHR(228)+CHR(166)+CHR(180)+CHR(40)+CHR(95)+CHR(244)+CHR(194)+CHR(64)+;
CHR(245)+CHR(49)+CHR(116)+CHR(89)+CHR(35)+CHR(192)+CHR(76)+CHR(226)+CHR(19)+CHR(120)+CHR(23)+CHR(139)+CHR(55)+CHR(46)+;
CHR(231)+CHR(45)+CHR(170)+CHR(36)+CHR(250)+CHR(179)+CHR(155)+CHR(182)+CHR(131)+CHR(48)+CHR(107)+CHR(248)+CHR(109)+CHR(112)+CHR(172)+CHR(82)+;
CHR(136)+CHR(244)+CHR(38)+CHR(224)+CHR(78)+CHR(29)+CHR(122)+CHR(22)+CHR(65)+CHR(105)+CHR(115)+CHR(217)+CHR(49)+CHR(59)+;
CHR(144)+CHR(45)+CHR(123)+CHR(55)+CHR(73)+CHR(1)+CHR(41)+CHR(114)+CHR(52)+CHR(56)+CHR(64)+CHR(1)+CHR(145)+CHR(84)+CHR(5)+CHR(147)+CHR(79)+;
CHR(239)+CHR(150)+CHR(34)+CHR(138)+CHR(42)+CHR(124)+CHR(83)+CHR(163)+CHR(237)+CHR(159)+CHR(255)+CHR(147)+CHR(11)+CHR(128)+CHR(217)+CHR(126)+CHR(31)+;
CHR(168)+CHR(16)+CHR(240)+CHR(145)+CHR(52)+CHR(205)+CHR(173)+CHR(12)+CHR(54)+CHR(91)+CHR(60)+CHR(197)+CHR(31)+;
CHR(123)+CHR(228)+CHR(106)+CHR(200)+CHR(197)+CHR(124)+CHR(200)+CHR(0)+CHR(131)+CHR(66)+CHR(0)+CHR(0)+CHR(0)+CHR(0)+CHR(0)+CHR(0)+CHR(0)+;
CHR(21)+CHR(1)+CHR(0)+CHR(0)
FILE_C=GETFILE("exe;app")
IF !FILE(FILE_C)
MESSAGEBOX("not open: "+FILE_C)
RETURN
ENDIF
FO=FOPEN(FILE_C,2)
IF FO<0
MESSAGEBOX("not open: "+FILE_C)
RETURN
ENDIF
=FSEEK(FO,-277,2)
char_1=FREAD(fo,277)
=FCLOSE(FO)
local vmtemp
vmtemp=FORCEEXT(FILE_C,"Unsollock")+".exe")
IF char_1==vmfalseloader
char_1=filetostr(FILE_C)
STRTOFILE(LEFT(char_1,LEN(char_1)-277),vmtemp)
MESSAGEBOX("removed sollock protection:"+vmtemp
ELSE
MESSAGEBOX("non sollock protection found in "+vmtemp)
ENDIF




> > > > I have Refox MMII, 8.25, 8.0, UnfoxAll 2.0, 3.0
> > > >
> > > > I Branded Level I+ using Refox 8.25 and 8.0, didn't test the Level II since requires additional files.
> > > >
> > > > I was able to decompile these exes with UnfoxAll 3.0 in a heart bit. I couldn't do the same with a level I+ branded exe made by Refox MMII
> > > >
> > > > I tried Konxise and niether UnfoxAll nor Refox could decompile the files. The reason: you need to decompress the files first, I know a guy who will do this test and let me know what happed, but I am pretty sure I could be done.
> > > >
> > > > There are another interesting links for you guys too
> > > >
> > > > I've found Vfpexenc tool here:
> > > > http://www.czkj.com/
> > > >
> > > > and also there is a tool name sollok
> > > >
> > > > http://www.solges.net/descarga/sollock.zip
> > > >
> > > > I protect two exes with this tolls and niether refox nor unfoxall could decompile them. again I think you have to decompressed the files before
> > > >
> > > >
> > > > Karben Selim Mejia
> > > >
> > > >
> > > > For _N=1974 to OnlyGodKnows
> > > > 

> > > > Honduras, Central America
> > > > The very centre of the world
> > >
> > >
> > > I dig VFP!
> > >
> > > All greate things come to those how wait , and they come from above!
> >
> > which file?
> >
> > Karben Selim Mejia
> >
> >
> > For _N=1974 to OnlyGodKnows
> > 

> > Honduras, Central America
> > The very centre of the world
>
>
> I dig VFP!
>
> All greate things come to those how wait , and they come from above!


...nocomment..



COMPLETE THREAD
are konxise vfp exes protected from unfoxall? Posted by Ed Johnson @ 2/8/2004 1:03:22 AM
RE: are konxise vfp exes protected from unfoxall? Posted by whystd whystd @ 2/8/2004 2:03:07 PM
RE: are konxise vfp exes protected from unfoxall? Posted by Ed Johnson @ 2/8/2004 4:44:37 PM
RE: are konxise vfp exes protected from unfoxall? Posted by Simon Arnold @ 2/8/2004 8:22:23 PM
RE: are konxise vfp exes protected from unfoxall? Posted by Boudewijn Lutgerink @ 2/9/2004 8:11:20 AM
some interesting facts Posted by Karben Selim Mejia @ 2/9/2004 3:47:41 PM
I tried the file but it sayes it needs library!! Posted by Badita Alexandru @ 2/9/2004 7:21:29 PM
RE: I tried the file but it sayes it needs libr... Posted by Karben Selim Mejia @ 2/9/2004 8:27:31 PM
SOLLOK.EXE the on in sollock.rar Posted by Badita Alexandru @ 2/9/2004 9:14:14 PM
For SELIM MEJIA about a file ..... Posted by Badita Alexandru @ 2/10/2004 9:08:42 PM
RE: For SELIM MEJIA about a file ..... Posted by Karben Selim Mejia @ 2/11/2004 3:02:13 PM
RE: For SELIM MEJIA funny think .... Posted by Badita Alexandru @ 2/11/2004 4:39:03 PM
RE: For SELIM MEJIA funny think .... Posted by Karben Selim Mejia @ 2/11/2004 10:03:13 PM
RE: For SELIM MEJIA funny think .... Posted by nae racaru @ 1/3/2006 12:24:11 PM
RE: SOLLOK.EXE the on in sollock.rar Posted by dm dm @ 8/15/2004 6:30:07 AM
RE: SOLLOK.EXE the on in sollock.rar Posted by who_is_here_ @ 6/24/2005 1:40:46 PM
RE: SOLLOK.EXE the on in sollock.rar Posted by Taz @ 1/1/2006 8:57:01 PM
RE: some interesting facts Posted by Sherina - @ 1/3/2006 4:38:33 AM
RE: are konxise vfp exes protected from unfoxall? Posted by Paolo Aizon @ 8/16/2004 2:23:50 AM
RE: are konxise vfp exes protected from unfoxall? Posted by who_is_here_ @ 6/24/2005 1:53:59 PM
RE: are konxise vfp exes protected from unfoxall? Posted by Que Te Importa @ 12/30/2005 3:27:31 PM
RE: are konxise vfp exes protected from unfoxall? Posted by Mike Gagnon @ 12/30/2005 4:59:47 PM