Yes this is a good point for newbies, experience is the key.
Overcome the phear and feel the code. Once you are delving in deep you can usually tell the type of code from experience.
Asprotect is one of those that lets you CHOOSE the section name, also you can manually change the section names with PEditor !
So such 'tools' that attempt to recognise the packer for you are useless. The brain beats them all up. Just practise and practise. I could make you an ASpacked file LOOK like UPX !!! After 1 year you get the 'feel'.
I made a tut on unpacking and also inline patching Lockdown 2000
last year, my opening statment was ' I don't know what the f*uck has been used to pack this target..... just for fun lets do some fishing'. In an attempt to show an approach and get the feel of how most packers unpack in memory and hand over to the real exe. Most use the aPlib routines anyway ! This is taken out from unpacked CrunchV2.exe from BiTarts :-
"aPLib v0.22b - the smaller the better
..Copyright (c) 1998-99 by Joergen Ibsen / Jibz, All Rights Reserved....This copy of aPLib is free for non-profitable use.....For more information: http://apack.cjb.net/ "
Well a few who tried the tut did e-mail me and correctly identify ASpack.
Well done.
Keep fishing.
SplAj
