Log in

View Full Version : New unknown anti-debug packer out.


billqiu
May 14th, 2003, 12:47
Hey guys,
I spent more hours trying to unpack this exe file,but failed.
this new unknown packer can detect all the known debugger then
exit.could someone help me unpacking the file.
This file can be download from

Best regards,
billqiu

Shoob
May 14th, 2003, 13:58
brings to me

0012FF94 00949721 ASCII " Error (4): File CRC Error, Abort!"

and the program crash.

normal? I have no debugger installed and the program reboots my pc for 2 times. I have no desire that my hd crashes so to every developer out there, dont use this scheme of Protection, if you have any bug in your app, i don't talk from the protector itself (could also have nasty bugs..) your pc will restart and you have an angry customer

Iwarez
May 14th, 2003, 15:04
My Windows XP doesn't even run the file. What I could see is that it starts a service and tries to start it, but with or without debugger the program doesn't run. No message, nothing.

nikolatesla20
May 14th, 2003, 16:08
PE-Scan identifies section 1 as being telock

-nt20

billqiu
May 14th, 2003, 16:43
Hi,
please ATTENTION,this exe file must run on win2k.
because of missing two file in the zip file,i reuploaded the zip file,
please redownload it and unpack it.

nikolatesla20,thank for your help.
I'm sure the packer isn't telock,it's new packer.this packer can detect the softice,trw2000,filemon,after i study the memory dump file made by loadpe,i guess the protected program is delphi progrom,but i can't find oep using dede.


Best regards,
billqiu

JMI
May 14th, 2003, 17:20
billqiu:

It is apparent that you did not read the FAQ or the posting guidelines. The posting of links to commercial software on your own site, is NOT PERMITTED on this Forum. Although most of the program's start-up dialog appears to be in Chinese, it certainly appears to be a commercial product.

Secondly, the posting guidelines require that you post some of your own work, to demonstrate that your request is something more that a crack request. Here, you are asking someone else to unpack this for you, and that also is not permitted.

To sum up, at the least, you post is about to be deleted. Further failures to comply with the posting guidelines will result in your being banned from the Board.

It is time for you to go read the posting guidelines.

Regards.

Shoob
May 15th, 2003, 09:15
modified Upx file - np