Log in

View Full Version : (Win)Upack 0.39final by dwing

linhanshi
December 18th, 2005, 04:07
The anniversary development commemoration Christmas final version (possibly is last edition) contains/the English/Russia three languages graphical interface editions and an English orders the good edition

0.39final -18/12/2005
---------------------
*Slim exe depacker about 23 bytes
+Support preserving original file date and time (-pdt)
*Fix minor bugs

http://dwing.51.net/download/WinUpack39.rar
LLXX
December 19th, 2005, 01:58
It GPF'd the kernel in my win9x system and corrupted the explorer.exe when I tried to pack a simple Hello World program. Does this really work under 9x?

I find a 23-byte depacker quite impossible.
MarcElBichon
December 19th, 2005, 13:33
he decreases depacker of 23 bytes (the whole engine is of course much bigger)
Admiral
December 19th, 2005, 14:16
Looks like someone's grammar is causing confusion. But I like this confusion.

I find a 23-byte depacker quite impossible.
Depends on how far you want to stretch the definition of a 'packer', I guess. Many commercial 'packer's make small PEs bigger. Of course, the ones I'm referring to would be better named 'protector's.

Code:
00480000 B8 00104000     MOV EAX, Target.$Code

00480005 3000            XOR BYTE PTR DS:[EAX], AL

00480007 40              INC EAX

00480008 3D 00604000     CMP EAX, Target.$Data

0048000D 7E F6           JLE SHORT Target.00480005

0048000F E9 C2FCFEFF     JMP Target.$OEP

There's a 20-byte decrypter. If you can call XOR a cryptograph .

Can anybody better this? That is, make it smaller without costing any of what little protection it provides. The last JMP has to stay 'cause we want to be able to stick this block into any 20-byte code cave we can find.

Admiral
Maximus
December 19th, 2005, 20:06
I cannot resist challenges

Code:


00401CBF      B9 00000400    MOV ECX,10000

00401CC4      3089 00004000  XOR [BYTE DS:ECX+400000],CL

00401CCA    ^ E2 F8          LOOPD SHORT CPP_Crac.00401CC4

00401CCC    - E9 2FE30100    JMP 00400000


Hope it works fine...
(forgot the count: 18 bytes)
Admiral
December 19th, 2005, 23:37
LOOPD

The simple answers are the best.

Edit: Apologies for thread-hijacking.
esther
December 20th, 2005, 00:54
***LLXX It GPF'd the kernel in my win9x system and corrupted the explorer.exe when I tried to pack a simple Hello World program. Does this really work under 9x?


It works on win98 notepad.Not sure about your hello.exe program
disavowed
December 20th, 2005, 13:19
Quote:
[Originally Posted by esther]It works on win98 notepad.

It also seems to work on viruses :\
http://blogs.msdn.com/geffner/archive/2005/12/18/505256.aspx
why not bar
December 20th, 2005, 23:14
WUPACK Stripper V.0.3xx
Download here:
http://www.fileh.com/whynotbar/WUPACK.zip
esther
December 21st, 2005, 02:04
disavowed: It also seems to work on viruses :\

Yeah most trojans and virus use upack to packed with.Its not hard to unpack it anyway