I've been working on this thing for a few hours and asking here is probably one of the last things I'd do. Anyway...

It somehow detected my SoftICE, even though I'd already hidden it and never had any detections by other programs in the past. The message is similar to Asprotect's, though the file looks nothing like it.

PEiD latest version (0.94) couldn't identify it.

OllyDBG couldn't stop it from running on load when set to break on the module entrypoint; it sort of worked when set to break at system entrypoint. I was able to trace through it a bit (and NOP *many* Int3s scattered throughout the somewhat obfuscated code) but OllyDBG behaved strangely - sometimes F7 would make it jump somewhere into the kernel (once again, it's as hidden as I could make it).

I was able to dump it while it was running with LordPE, but the dump is next-to-useless with a missing import table and unknown OEP. The only thing I could tell from inspection was that it was written in VB and the resources section is placed before all the other sections.

ImpRec says "can't open process" - I'm a bit confused by this, as LordPE apparently had no problem dumping it. This is definitely a packer and not a cryptor, as the dump is ~400Kb whereas the original was 260Kb. Inspecting the original I can see bits of recognisable text, so the compression algorithm is probably LZ-based.

The entrypoint of this packer looks like nothing I've seen before:
...and the bottom of the above listing is the last byte in the file.

Any suggestions as to how to approach this? At the moment it seems all I can do is dump it, everything else fails.

EXECryptor may be.

Execrypt perform decryption in TLS callback - try to bp there and see. It might be the problem you had with not-stopping Olly.

Either Execryptor is bluffing or it isn't Execryptor, since I've been reading through the dump and it all looks intact compiler-generated code minus the import table and correct PE header.

LLXX maybe if you will link the packed exe someone will help you.
However there are some ways to don't stop olly at EP, as bad value in some members of Optional Headers. You can find more infos at Ap0x home page

LLXX,

I think I may have run in to this a week or 2 ago, how many sections does it have? (mine had 7, 3 or 4 unindentified), my dump looked perfectly normal except what you describe, missing oep and IAT, I chalked it up to a new strain of Execryptor and shelved it until I had more time.

SiGiNT

LLXX,

u can see header of the exe file. In my targert, packed by it i have

╔═Number Name VirtSize RVA PhysSize Offset Flag═══╗
...skip
║ 5 ipghe5mc 0002A000 001EA000 0002A000 001EA000 E0000020 ║
║ 6 7u3v44u7 0007E000 00214000 0007E000 00214000 E0000060 ║

╔═Number Name VirtSize RVA PhysSize Offset Flag═══╗
..skip
║ 5 kb0.j7so 00029000 00049000 00029000 00049000 E0000020 ║
║ 6 n1xy7lsn 00042000 00072000 00042000 00072000 E0000060 ║

Section 5 and 6 added by ExeCryptor. It may be have named as random alpha and/or digital.

WBR

It is execryptor for sure:



is common signature for ExeCryptor where 0046758D is TLS callback

Ok, it's definitely EXEcryptor, and they're lying about 'irreversible transformation of code' etc. Now the question is, how to unpack (more specifically, how to restore IAT and find OEP)... finding the OEP should be quite easy for a VB6 program as they all have the same first instructions, but the IAT will be more difficult. Maybe matching already overwritten import slots with known addresses of kernel and other DLLs?

I'd just like to post here to report... success!

Searching this forum wasn't much use, but I found 'Unpacking_And_Dumping_ExeCryptor_and_Coding_Loader_by_deroko' package which had an OEP finder and freezer, just the thing I needed. I was able to dump with LordPE and trim the unneeded sections, then use ImportREC on the frozen process to get 100% imports recovery (it seems the only import needed for a VB6 program is the VB runtime DLL). After fixing the OEP (actually more like 'find an empty area and insert a possible facsimile of the original code, which amounts to nothing more than a push and a jump in a VB prog) and cleaning the file of debris, it worked perfectly. The strange thing was, I didn't even have to use a debugger at all.

Thanks for pointing me in the right direction, now can anyone recommend me some crackmes that are packed with EXEcryptor? I'd like to try another one.

This is an old crackme (submitted on 10 Nov. 2004) packed by ExeCryptor:
http://www.crackmes.de/users/relayer/execryptor_official_crackme/download

Good luck

tuts4you.com has several ExeCryptor unpackmes available for your perusal.

xenakis