S5 to s7 conversion, but the code is locked!!!

[mo_mesbah]

I have attached the file here

 

[mo_mesbah]

oh! sorry! here it is

 

[KalleOlsen]

NB! Remove the zip extension only! It's a S5D file.

Looks as it is a clever guy that made this one. It was some tricks at the end as well - lacking BE. You will have to doble check the 6 last lines. It could be more hidden tricks.

 

[L D[AR2P#0.0]]

Kalle - can you rename your file to Fred.zip and re-post please.

 

[mo_mesbah]

sure, is it ok?

 

[KalleOlsen]

Sorry, I was offline. I am doing some carpenting for my wife, so she hit me with a stick if I sit here to long.
@LD: you got the file?
@mo_mesbah: Could you convert the file?

Kalle

 

[mo_mesbah]

Kalle seems that I can not upload the file if it is not zipped, what do you suggest?

 

[KalleOlsen]

My winzip has rottened, but I'll change PC. Wait a minute...
Kalle

 

[mo_mesbah]

Oh Yesss!!! it worked!!! I feel very stupid at this moment that I did not see your attachment so what is the procedure to open these locked files :?

 

[KalleOlsen]

There some tricks that I know and certainly some I don't.
You have seen the first one, a false BE. Here it also was a couple of jumps with no label and a 'hidden' BE at the end. It is also a trick to remove the segment indicators - then you will get a message that the segment is to long. If the segment indicator also is replaced by a 'fake' load command, then the hexcode will look ordinary, and be hard to trace (easier to trace NOP0 or NOP1). So the procedure will be; Search carefully through the code:book:.
Kalle

 

[mo_mesbah]

Kalle Thank you so much!!!
seems that I have a lot to do now I am going through the code!
Cheers Mate!

 

[L D[AR2P#0.0]]

Which S5 CPU is this from ?

 

[L D[AR2P#0.0]]

Here's what the end of the block should look like:

 

[mo_mesbah]

thanks L D
to be honest I do not know the CPU but I can let you know next week
you mean I should add another BE (65 00) at the end of the file, am I true?

 

[KalleOlsen]

No, that is not neccessary - and S5 won't let you either. The last jump is a part of the locking trick.

Kalle