Log in

View Full Version : ASPack 2.11 - random decryptor!?


onebitshort
January 12th, 2003, 08:58
ASPack 2.11 (and 2.11c, 2.11d etc) seem to be very different from all other ASPacks (including the latest, 2.12). All of the ASPacks except for 2.11 are very easy to analyse, and often its just a matter of searching for the popad to find the jump to the original entry point, but 2.11 is very strange -- it seems to have just two instructions, with the second instruction jumping to a decryptor that decrypts the unpacking code -- after the decryption, the unpacker goes to work just like all the other ASPacks, but none of the other ASPacks have this decryptor. In addition to this, the decryptor seems to be random - I compressed notepad.exe a dozen times, and all of them had different decryptors (which all worked though!). I hate to use the word 'polymorphic' to describe a packer, but I cant think of a better word to describe it. Only the 2.11 variants seem to do this - all the other variants (before and after 2.11) behave like any other 'normal' packer.

Can anyone elaborate on this strange behaviour?

Many thanks in advance,
OBS

onebitshort
January 14th, 2003, 11:47
So nobody here can comment on ASPack 2.11? Interesting ...
I've searched the forum for "2.11" but found virtually nothing related to this topic. Surely I'm not the only person here to have discovered the difference between ASPack 2.11 and all the other ASPacks ... ?

Dr.Golova
January 14th, 2003, 19:38
Comments? Hmm, yeah, ASPack 2.11 realy use polymorphic encryption stealed from some virii, but all oher versions don't use them

Quote:
Originally posted by onebitshort
So nobody here can comment on ASPack 2.11? Interesting ...
I've searched the forum for "2.11" but found virtually nothing related to this topic. Surely I'm not the only person here to have discovered the difference between ASPack 2.11 and all the other ASPacks ... ?

onebitshort
January 14th, 2003, 21:59
Ok, so i'm not hallucinating then
So ASPack 2.11 uses polymorphic code borrowed from a virus? interesting ...!