|
"It will not run with the decrypted parts. It seems that it decrpyts the data based on the original executable AND the CD... "
it's a while since I've "tampered" with securom v2, but in the past the subchannel data is used as the key to decrypt the sections (and certainly earlier versions contained the key somewhere else in case the cdrom couldn't read subchannel?...can't remember where exactly though, sorry....)
The original loader is SMC, like safedisc etc, but with less anti-SI baggage. Has this changed? Surely your dumped sections won't run because of misdirected calls and screwed import table (as most api's are re-directed thru securom code)? As I mentioned earlier, some home cooked code redirecting those calls should do it. It's time consuming but possible.
Isn't "change the writeprocessmemory calls (set length to zero) " mentioned in pedro's and/or R!SC's tuts as applied to the original securom, as this too used SMC. i.e. it used writeprocessmemory to alter the code at specific mem locations as it decrypted?
I'm intrigued mate, so post back.
__________________
Munch......munch.....munch
|