onebitshort
January 12th, 2003, 08:58
ASPack 2.11 (and 2.11c, 2.11d etc) seem to be very different from all other ASPacks (including the latest, 2.12). All of the ASPacks except for 2.11 are very easy to analyse, and often its just a matter of searching for the popad to find the jump to the original entry point, but 2.11 is very strange -- it seems to have just two instructions, with the second instruction jumping to a decryptor that decrypts the unpacking code -- after the decryption, the unpacker goes to work just like all the other ASPacks, but none of the other ASPacks have this decryptor. In addition to this, the decryptor seems to be random - I compressed notepad.exe a dozen times, and all of them had different decryptors (which all worked though!). I hate to use the word 'polymorphic' to describe a packer, but I cant think of a better word to describe it. Only the 2.11 variants seem to do this - all the other variants (before and after 2.11) behave like any other 'normal' packer.
Can anyone elaborate on this strange behaviour?
Many thanks in advance,
OBS
Can anyone elaborate on this strange behaviour?
Many thanks in advance,
OBS