Manual Unpacking Tutorial... | Manual UnPacking (MUP) of Simple PE Crypter Beta 3 |
Source Code... | Simple PE Crypter Beta 3 Source Code |
Some Info about the Packer/Encrypter and Author... | Author: hayras Homepage: None. Email: hayras@hotmail.com Size of Packer/Encrypter: 8.00 KB The Packer/Encrypter itself isn't Packed/Encrypted in any way. |
Author Words about the Packer/Encrypter... | This is a very simple and limited pe crypter. It doesn't do anything other than crypt the code and data section. No anti stuff or compression. This was the result from my interest with pe files, and by no means complete and will always contain bugs. |
Features... | handles resources. shows some info. |
Special stuff the Decryption Routine uses... | It "Directs" the API's in the IAT. |
The best API to Break on... | The best API to break on for the beginning: GetModuleHandleA The best API to break on for the end: GetProcAddress |
Recognization of this Packer/Encrypter... | Check if the name of the last Section is ".hayras" . But the version "Simple PE Crypter Beta 2" has the same Section name so then search for the text: [SPEC] |
Recognization Bytes... | 5B 53 50 45 43 5D E8 00 00 00 |
OEP Jump... | mov eax, OEP jmp eax |