How to unpack EXE protected by Cexe v1.0a?

CEXE EXECUTABLE COMPRESSOR 1.0A 25.05.2001 SCOTT LUDWIG / TINYWARE INC.
Compresses a input exe into a smaller output. It also has the option of skipping icons in the output. However it only runs on WinNT, Win2000 and above - won't run on Win95 or Win98.

Thanks in advance.
TheDutchJewel

what did you tried to unpack it ? tools + methods ?

Quote from readme.txt :

"When the compressed .exe is run, you are actually launching a
version of dexe.exe, which decompresses the compressed resource
into a temporary file, then launches this temp file with the
command line parameters given to dexe. Dexe waits for the target
executable to return, then deletes the temp file and returns the
right result code."

So, to unpack, run the packed proggy, look for the .tmp file created in the same directory, copy and rename it to 'unpacked.exe' and there you are !

Wizard

I tried to y'r sollution, but i didn't work. Perhaps because the cryptor isn't Dexe but Cexe. But perhaps also because i tried to unpack an DLL file: MSO.DLL from MS Office XP Pro, cracked by UCF on 15-7-2001! (http://210.74.232.34/Winzheng/$www.winzheng.com$/wON-officexp_only_patch.zip)!
I cracked the file before myself (it works!: i removed the 50 times trial period), but the UCF version is better i think because when you tries to activate it comes with an message that the prog is already activated; with my file nothing happens (als good, but as said, UCF is better). That's why i'm interested in unpacking that DLL-file.

Anyone with some ideas about how to do it?
Thanks, TheDutchJewel

Here are some mirrors to the cracked and encrypted MSO.DLL:

Mirror 1:
h**p://www.multimania.com/ockefeller74/cc/won-officexp_only_patch.zip

Mirror 2:
h**p://www.multimania.com/ailey4dfih/dladen/won-officexp_only_patch.zip

TheDutchJewel

You can be sure this DLL is not packed with CEXE... because CEXE CAN'T compress DLLs !!!

Wizard

Uhmm , i've downloaded the .dll , but why you say it's crypted ? i dont see any crypt on it


Yado of Lockless.

Some reasons why i think the UCF-cracked DLL is protected:

1. check it with FILE INSPECTOR XL (h**p://www.mesa-sys.com/~codomain/)
2. new PE-section in UCF-cracked DLL: .annina
3. different file size: (original [Dutch version]: 9995680, UCF-cracked DLL: 9994240)
4. different Entry point: (original DLL [Dutch version]: 4330h, UCF-cracked DLL: 13EB7h)
5. when opend with W32Dasm there are no References in UCF-cracked DLL

TheDutchJewel

Some reasons why i think the UCF-cracked DLL is protected:

1. check it with FILE INSPECTOR XL (h**p://www.mesa-sys.com/~codomain/). By
Compiler/Packer/Protector:
Cexe 1.0a (Heuristic: 7,5%)

Signature: < 00 00 00 53 56 8B 75 0C 57 8B 7D 08 83 FE 01 74 0A
FF 75 10 56 57 E8 91 02 00 00 33 DB 3B F3 0F 84 9B 42
26 00 83 FE 01 0F 84 CF 00 00 >

2. new PE-section in UCF-cracked DLL: .annina

3. different file size: (original [Dutch version]: 9995680, UCF-cracked DLL: 9994240)

4. different Entry point: (original DLL [Dutch version]: 4330h, UCF-cracked DLL: 13EB7h)

5. when opend with W32Dasm there are no References in UCF-cracked DLL

TheDutchJewel

How to unpack EXE protected by Cexe v1.0a?

I need your help?

1. I check it with FILE INSPECTOR XL

he Show it:

Cexe 1.0a (Heuristic: 11.2%)

Signatura: 05 00 00 53 56 57 6A 01 5E 6A 04 89 75 E8 FF 15 54
40 40 00 FF 15 50 40 40 00 8B F8 89 7D F4 8A 07 3C 22
OF 85 CC 00 00 00 8A 47 01 47

You obviously did not READ THE FRIGGIN FAQ!!!! And you are attempting to reopen a 6 year old Thread.

We don't "tell you" how to unpack files. You "learn" how to unpack and we just try to help along the way. You haven't shown you have done ANY work besides posting you question here.

Regards,