VBox v4.3
WeiJunLi please don't cry
Written by McCodEMaN

http://www.previewsystems.com/

First of all you've got to get by the anti Softice protection. If you would like info. about how to do this I belive that alpine wrote about this in his vbox 4.2 essay.
I'll use Softice backdoor keeper to save time!



Run the Vbox protected target and bpx getprocaddress before pressing [TRY], then F11 and you'll end up here:


0187:0700BB39   FF15C8210407         CALL        [KERNEL32!GetProcAddress]
0187:0700BB3F   8BF8                 MOV         EDI, EAX <---landing spot!
0187:0700BB41   3BFB                 CMP         EDI, EBX
0187:0700BB43   0F849D010000          JZ         0700BCE6
0187:0700BB49   8B7616               MOV         ESI, [ESI+16]
0187:0700BB4C   037508               ADD         ESI, [EBP+08]
0187:0700BB4F   395DDC               CMP         [EBP-24], EBX <---but WeiJunLi...really?
0187:0700BB52   7435                  JZ         0700BB89 <--should say JMP!
 

Ok, lets change :0700BB52   7435      JZ    0700BB89 to:       JMP    0700BB89

Type in:

                 a 0700bb52 and press [ENTER]

                 jmp 0700bb89 [ENTER] and [Esc]!




This will take you to....


0187:0700BB85   8906                 MOV         [ESI], EAX
0187:0700BB87   EB02                 JMP         0700BB8B
0187:0700BB89   893E                 MOV         [ESI], EDI <---jumps here!



Now F11 twice and clear your breakpoint, then do p ret five times so that you'll end up here....


                                     CALL        EDI <-----bpx here!
                                     MOV         [EBX+ ], EAX <--you'll
                                     POP         EBX             land here!
                                     MOV         EBX, [EBP+ ]
                                     PUSH        EDI
                                     PUSH        EBX
 


Bpx on that CALL EDI and press F11! When softice breaks hit F8 and move yourself through the code until you reach the first CALL and when you do, step into it.

In this call you'll be moving through lots of code, but after a while you should see this......



                                     RET         000C
                                     LEA         EDX, [ESP+48]
                                     PUSH        EDX
                                     PUSH        EBX
                                     CALL        008D0456 <---step in here!


This code is located shortly after a call to eax, so look for that and you won't miss the call above!
Ok, if you've entered the first call after 'call eax' you can start to look for a JMP EBX.

EBX = Program Entry Point



                                     MOV         EDX, [EBP-08]
                                     MOV         EAX, [EDX+14]
                                     MOV         [EBP-10], EAX
                                     MOV         EBX, [EBP-10]
                                     JMP         EBX <---change to JMP EIP!
                                     MOV         ECX, [EBP-08]
                                     MOV         EDX, [ECX+14]
                                     MOV         [EBP-0C], EDX
                                     MOV         EAX, [EBP-0C]


Get the entry point from EBX and don't forget to subtract imagebase, then create a infinite loop like this:


                a eip [ENTER]   and   jmp eip [ENTER]



Start up ProcDump and under options check all structure boxes, we are also going to rebuild a new import table.
Select your program from Task and make a full dump, then open it with the PE Editor and type in the entry point you calculated before....remember?....no imagebase!!!