Log in

View Full Version : Explain this


INGcrack
May 4th, 2007, 07:32
krypto analyzer has detect the following
0045E893
BASE64 table :: 000E1110 :: 004E1110
Referenced at 0045E893
MD2 [char] :: 000E3590 :: 004E3590
Referenced at 0048A9AC
Referenced at 0048A9C9
Referenced at 0048A9E0
Referenced at 0048A9F0
Referenced at 0048AA01
Referenced at 0048AA15
Referenced at 0048AA29
Referenced at 0048AA3D
Referenced at 0048AA4B
Referenced at 0048AA5A


What to do to unpack this

Regards

blabberer
May 4th, 2007, 08:05
find or fetch a marker and write unpack on the screen and voila it will be unpacked straight and simple if it didnt then you have to change your monitor
it doesnt obey you

INGcrack
May 4th, 2007, 08:09
dear blabberer

can you be more clearfull

evlncrn8
May 4th, 2007, 08:33
start tracing the code then, make notes, figure things out
what you pasted was essentially meaningless crap, which is why blabberer replied in the way he did...

Maximus
May 4th, 2007, 14:28
(LOL) I'll try blabberer! Soon I'll have more time for RCE, and have to unpack quite few things...
(by the way, I'll also try to talk to my computer using the mouse, as in an old star-trek movie -who knows maybe... I'd start using Vista Vocal Commands as in the nice beta preview 'die die...' )

------being serious

KA find possible references of crypto algorithms: it means not 'its packed'. PEiD tells you a (possible) packer's name. Then, you'd have to google for it, and learn how to unpack that. A good sign to check if a software is packed is to check imports. Big file, very few imports==packed file.

Have fun

0xf001
May 4th, 2007, 14:40
hi,

base64 is overdocumented in any language on the internet.

md2 is a hash and also won't be used to pack anything. more to checksum probably.

-> http://www.paradoxes.info/code/base64.html

regards, 0xf001

ps: i found that via google