Tutorials For GunZ

Utilities Needed

The Complete Package
The Complete Package
(This Contains (Olly Debugger w/ OllyDump, OllyHelper, and HideDebugger), (ImportReconstruction), (Signatures File), and (GunzRunnable [09-03-05]).)

Creating A Runnable

Step 1 - Open Olly and change your setting to the following:
http://img150.imageshack.us/img150/7...unnable9hj.jpg

Step 2 - Select Gunz.exe:
http://img249.imageshack.us/img249/4...unnable2ai.jpg

Step 3 - Let Olly find the Original Entry Point (OEP):
http://img355.imageshack.us/img355/5...unnable7xu.jpg

Step 4 - Under Plugin, choose OllyDump, and then Dump Debugged Process:
http://img137.imageshack.us/img137/5...unnable2wu.jpg

Step 5 - Uncheck Rebuild Import and Copy the Modified OEP:
http://img140.imageshack.us/img140/6...unnable6zq.jpg

Step 6 - Press Dump and Save As Dump:
http://img157.imageshack.us/img157/9...unnable5sj.jpg

Step 7 - Minimize Olly and Open ImpRec:
http://img458.imageshack.us/img458/7...unnable9ov.jpg

Step 8 - Select Gunz.exe in the drop-box:
http://img154.imageshack.us/img154/4...unnable5yj.jpg

Step 9 - In the box next to OEP, Paste the number you Copied:
http://img138.imageshack.us/img138/9...unnable8gk.jpg

Step 10 - Press IAT AutoSearch, if you get this result then move to Step 11:
http://img149.imageshack.us/img149/6...unnable8ed.jpg

Step 11 - Press Get Imports, if you get this result then move to Step 12:
http://img455.imageshack.us/img455/3...unnable3nv.jpg

Step 12 - Press Fix Dump and choose Dump:
http://img475.imageshack.us/img475/4...unnable0ak.jpg

Step 13 - If you see this result then you have made a runnable successfully:
http://img250.imageshack.us/img250/6...unnable2os.jpg

Making Your Runnable Run

Step 1 - Move Dump_ to your Gunz folder and open Olly:
http://img149.imageshack.us/img149/7...ablerun9ne.jpg

Step 2 - Select Dump_ in Olly:
http://img409.imageshack.us/img409/9...ablerun8on.jpg

Step 3 - Right-click and - Search For - All Referenced Text Strings:
http://img133.imageshack.us/img133/7...ablerun6fb.jpg

Step 4 - Right-click and - Search For Text - I_hate_hacker or I_love_MAIET:
http://img266.imageshack.us/img266/8...ablerun1wf.jpg

Step 5 - Right-click and - Follow In Disassembler:
http://img148.imageshack.us/img148/1...ablerun8dn.jpg

Step 6 - Scroll to the top of the function, click it, right-click, and Go To Local Call:
http://img403.imageshack.us/img403/3...ablerun9ey.jpg

Step 7 - NOP the CMP two lines under the CALL you arrived at:
http://img133.imageshack.us/img133/1...ablerun6vt.jpg