Accidentally, i found this new doll. Sorry if this is old. But the site told me it's brand new one.
name : AntiCrack Protector (in Short term: ACProtect)

ACProtect is an application that allows you to protect Windows executable files against piracy,using public keys encryption algorithms (RSA) to create and verify the registration keys and unlock some RSA key locked code,it has embedded cryptor against dump and unpacker.it also has many anti debug tricks. And you can use it to create evaluation and trial application versions. with specialized API system, mutual communication between loader and application is also can be achieved.

Key Features

RSA1024 - With RSA keys system,cracker can not write a KeyGen(or KeyMaker) of your production without the RSA private key(the RSA private key only in the author's hand).And your can specify some code to be locked by the RSA keys,so is the cracker have not the proper key.dat on the proper machine,the code protected can not decrypt.
Polymorph - Polymorph decryption routines and several encrypted layers. The code being protected varied every time your protect your application.

Embedded cryptor - You can specify the place in your application to embed the inner cryptor. With the embedded cryptor,your application can not be cracked even though the cracker know the original entry point(OEP) and rebuild your Import table.
Mutual Communication - API system which allows communication between application and loader,loader can call some of the application's export function ,and the application can call the function the protected system provided.

Anti patch/loader - Protects your files against patching/modifications and disassembling
Anti-Soft ice - Numega Softice(tm) detection and Frogsice detection
Anti debug,dump,trace...Anti-debugger&Monitor like W32Dasm, SoftIce, TRW 2000, Turbo Debugger, Sourcer, Filemon, ExeSpy, ResSpy, RegMon, Memory Monitor etc.
Runtime code encryption Important parts of your code can be protected individually, providing extra protection against memory patches.

System-specific licenses License keys may be locked to a specific system by checking the computer's unique fingerprint(such as hard disk id,CPU Id etc.)
Stolen keys keeping of the database and checkup of "stolen" (illegal) registration keys
Trial setting possibility to create evaluation (trial) versions, that limit application functions based on the number of runs left

You curios? siskinsoft.com
I'm currently downloding right now


kyrios

What do you bet that some of these "new" protectors are simply ASProtect, or such programs, that have been simply ASM ripped, and have a new UI attached (Along with a couple more small additions)

Looks to me a strong possibility, given the seemingly quick and large release of so many "new" programs.


In fact, I see very little difference between this and ASProtect. They even look the same.

-Lunar

hm its some asprotect thing.. OEP is 4B6A3C trying the resolve to unretrieved entries manually.. nice protector only for thereself protector. Results for Notepad.exe:

Compression1 -> protect! -> test -> crash! -> running normally ? -no
Compression2 -> protect! -> test -> crash! -> running normally ? -no

"Use no Compression"

mh, let's see... the features description on their homepage is a copy/paste from aspack.com, they're not even listed on those sites they claim to have gotten awards from and they want 149$ for a single license...

Hmmm, "perplex". I'm sure I've heard that name before on Exetools when someone asked to test there protector. I remember they used a dll to do the compression.

Strangely enough, the exact same dll is still being used, and is simply attached to the program being protected :

perplex.dll :
zcf_createPQEM
zcf_decrypt
zcf_encrypt
zcf_getP
zcf_putP

Interesting thing is, my hello world masm test program that I put all packers/protectors through comes out at 49kb. Decompressing the perplex.dll (upx compressed) and reprotecting my file, I find out that the size drops down to 29kb.

From a quick check at the asm, it seems to have the usual debugger checks, but also manages to bomb out Ollydbg, which is a first. Easy enough to get around though.

Unpacking a ACProtected program, I can see the following strings in the loader:

EXESPY
WXR95
REGMON
FILE MONITOR
REGMONEX
WINDOW DETECTIVE
DEBUGVIEW
RESSPY
ADVANCED REGISTRY TRACER
REGSNAP
MEMSPY
MEMORY DOCTOR
PROCDUMP32
MEMORY EDITOR
FROGSICE
SMU
WINSPECTOR
MEMORY DUMPER
MEMORYMONITOR
NUMEGA SOFTICE LOADER
URSOFT W32DASM
GENERIC_WKTTELOCKDUMPER
-=CHINA CRACKING GROUP=-
OllyDbg
TRW2000

However, other than that, it's pretty much bare. No OEP bytes missing, no fancy dipping that I can see. Managed to dump the program and fix import table within 10 minutes (!!!). Definitely no ASProtect - maybe ASProtect Lite

It's just a rename of ultraprotect
You only have to look at the registar info of the domainnames

The loader code is full off smc and some debugger tricks.
IsdebuggerPresent
Detecting debugger by PEB, thanks to ^DAEMON^
Checks for BP on api
Detecting of parent thread and killing (nice one for detecting olly)

As squidge already said unpacking this baby will cost you only 10 minutes.

why not listed LordPe?

seem author very much likes it

GENERIC_WKTTELOCKDUMPER !!!?

You can get virgin ImportTable with "bpx LoadLibrary+1", then dump IT section.....very primitive packer...

Gaia

from the /example/vc/test2Dlg.cpp



it seems this guy is selling the same software with 2 different names

Must work in marketing

Sell same product under two completely different names and hope to get more sales, or perhaps the same person buying both...

That detecting of parent thread is a good one - or are you sure it's just not using GetWindowText(). Parent thread detection would require more low level NT functions..I've thought this is what some protections should do, but maybe the CREATE_NEW_PROCESS_GROUP prevents it parent from being detected? (was my theory)

Besides, you could probably just rename the olly EXE then anyway.

-Lunar

the utralprotect is rename to acprotect after 1.08,see the help file.

some thing interesting,after unpack the exe still have ability to antidebug.maybe use some ticks from pelock?

Looks like the new version on asprotect does do some OEP trix. After I protect an application, the first 6 bytes are garbage (after memory dump)

Also, debugger detection seems to work pretty well, or maybe it's just 'cause my brain is fried from working on Arma for so long - Arma is just too easy methinks..

IAT protection still weak ass tho.

-nt20

Steals the first 6 bytes of original program..

I've found the nice embedded cryptor codes the protection talks about. Even if you have an application in which you don't "activate" these, you still get them.

They're not so hard. Just a lot of them....behavior similar to the protection on Fusion by BiTarts.


-nt20