ACProtect 1.21 expert moderator program shelling

Operating System: WIN2K
Tools: OLLYDBG1.1, ImportREC, LordPE
: Http://www.ultraprotect.com/acpr_pro.exe
Target Program: ACProtect 1.21 professional moderator program.

Shelling Process:
1. Find the Stolen code deformation and its pseudo OEP.
After loading with OLLYDBG1.1, stay at the entry of the program:
006D4000 pushad
006D4001 dec ecx
006D4002 sbb esi, B59B7C21
006D4008 clc
006D4009 mov ecx, ebx
006D400B dec ecx
Use the IsDebug 1.4 plug-in to remove the Ollydbg debugger flag. Ignore all other exception options except int3 exception.
View the stack esp = 12ffc4, set the hardware access breakpoint based on this value: de-transfer window, Ctrl + G: 0012FFC0 (Entry esp-4), 4 bytes at 0012FFC0, hardware access-> DWord breakpoint.
F9 starts to run, and then cancels the hardware breakpoint.
006E56FF popad
006E5700 mov dword ptr ds: [6D4E73], ebx
006E5706 push dword ptr ds: [6D4E73]
006E570C push eax
006E570D mov eax, ACProtec.006D4ECF
006E5712 mov ebx, eax
006E5714 pop eax; KERNEL32.77E887E7
006E5715 mov dword ptr ds: [ebx], ecx
006E5717 pop ebx; KERNEL32.77E887E7
006E5718 push dword ptr ds: [6D4ECF]
006E571E mov dword ptr ss: [esp], esi
006E5721 mov dword ptr ss: [esp], ebx
006E5724 mov dword ptr ss: [esp], eax
006E5727 push edx
006E5728 pop dword ptr ds: [6D4ECB]; KERNEL32.77E887E7
006E572E push dword ptr ds: [6D4ECB]
006E5734 mov dword ptr ss: [esp], ecx
006E5737 mov dword ptr ss: [esp], ACProtec.006D4F0F
006E573E pop dword ptr ds: [6D4EEF]; KERNEL32.77E887E7
006E5744 mov dword ptr ds: [6D4E9F], ebx
006E574A push dword ptr ds: [6D4E9F]
006E5750 pushad
006E5751 call ACProtec.006E1460
006E5756 call ACProtec.006E575B
006E575B pop ebx; KERNEL32.77E887E7
006E575C sub ebx, dword ptr ss: [ebp + 4023EC]
006E5762 sub ebx, 1175B
006E5768 mov dword ptr ss: [ebp + 40D2AA], ebx
006E576E popad
006E576F mov dword ptr ss: [esp], edi; ACProtec.005D16A8
006E5772 mov dword ptr ds: [6D4E9B], ACProtec.006D4EEF
006E577C push dword ptr ds: [6D4E9B]
006E5782 pop dword ptr ds: [6D4E97]; KERNEL32.77E887E7
006E5788 mov edi, dword ptr ds: [6D4E97]
006E578E mov eax, dword ptr ds: [edi]
006E5790 mov edi, dword ptr ss: [esp]; KERNEL32.77E887E7
006E5793 pop dword ptr ds: [6D4EC7]; KERNEL32.77E887E7
006E5799 mov dword ptr ds: [eax], ebp // stolen code row 1st, push ebp Deformation
006E579B mov eax, dword ptr ss: [esp]; KERNEL32.77E887E7
006E579E pop dword ptr ds: [6D4EFB]; KERNEL32.77E887E7
006E57A4 push dword ptr ds: [6D4F0F]
006E57AA mov dword ptr ds: [6D4F0B], esp
006E57B0 push dword ptr ds: [6D4F0B]
006E57B6 pop dword ptr ds: [6D4EF7]; KERNEL32.77E887E7
006E57BC push eax
006E57BD nop
006E57BE nop
006E57BF pushad
006E57C0 call ACProtec.006E1460
006E57C5 call ACProtec.006E11FE
006E57CA mov dword ptr ss: [ebp + 40E205], eax
006E57D0 popad
006E57D1 mov dword ptr ss: [esp], edx
006E57D4 mov dword ptr ds: [6D4E93], ACProtec.006D4EDB
006E57DE mov edx, dword ptr ds: [6D4E93]
006E57E4 mov dword ptr ds: [edx], ecx
006E57E6 mov edx, dword ptr ss: [esp]; KERNEL32.77E887E7
006E57E9 pop dword ptr ds: [6D4E8F]; KERNEL32.77E887E7
006E57EF push dword ptr ds: [6D4EDB]
006E57F5 push ACProtec.006D4EF7
006E57FA pop dword ptr ds: [6D4EC3]; KERNEL32.77E887E7
006E5800 push dword ptr ds: [6D4EC3]
006E5806 pop dword ptr ds: [6D4EBF]; KERNEL32.77E887E7
006E580C push dword ptr ds: [6D4EBF]
006E5812 pop ecx; KERNEL32.77E887E7
006E5813 mov ebp, dword ptr ds: [ecx] // deformation of 2nd rows of stolen code, mov ebp, and esp
006E5815 mov ecx, dword ptr ss: [esp]; KERNEL32.77E887E7
006E5818 pop dword ptr ds: [6D4ED7]; KERNEL32.77E887E7
006E581E push edx
006E581F nop
006E5820 nop
006E5821 pushad
006E5822 call ACProtec.006E1460 <