Manual Unpacking Tutorial... | Manual UnPacking (MUP) of Simple PE Crypter Beta 2 |
Source Code... | Simple PE Crypter Beta 2 Source Code |
Some Info about the Packer/Encrypter and Author... | Author: hayras Homepage: None. Email: hayras@hotmail.com Size of Packer/Encrypter: 8.00 KB The Packer/Encrypter itself isn't Packed/Encrypted in any way. |
Author Words about the Packer/Encrypter... | This is a very simple and limited pe crypter. It doesn't do anything other than crypt the code and data section. No anti stuff or compression. This was the result from my interest with pe files, and by no means complete and will always contain bugs. |
Features... | handles import section. fixed alignment bug. commented a bit. |
Special stuff the Decryption Routine uses... | It "Directs" the API's in the IAT. |
The best API to Break on... | The best API to break on for the beginning: GetModuleHandleA The best API to break on for the end: GetProcAddress |
Recognization of this Packer/Encrypter... | Check if the name of the last Section is ".hayras" . you can also search for the text "simple PE crypter. áeta 2. (c) by h-" . |
Recognization Bytes... | 55 57 51 53 E8 00 00 00 00 5D |
OEP Jump... | mov eax, OEP jmp eax |