Manual Unpacking Tutorial... | Manual UnPacking (MUP) of PhrozenCrew PE Shrinker v0.71 Beta (PC Shrink) |
Source Code... | None. |
Some Info about the Packer/Encrypter and Author... | Author: Virogen Homepage: None. Email: vgen@hotmail.com Size of Packer/Encrypter: 9.00 KB The Packer/Encrypter itself is Packed/Encrypted with PhrozenCrew PE Shrinker v0.71 Beta (PC Shrink) . |
Author Words about the Packer/Encrypter... | Phrozen Crew PE Shrinker is an windows 9x/NT executable file compressor, allowing compressed executables to run, functionally, the same as always, but occupy a significantly less amount of disk space. |
Features... | Code, data, resource, and import directory compression. Tight compression and fast decompression using Jibz Aplib v0.22. Restructuring of resource data to improve compression ratios. Preserves shell icon and version information. Merging of compressable sections to reduce file alignment induced padding and to improve compression ratios. Realigns, rebuilds, and trims executable before and after compression. Removes debug information from executable. Win95/98/NT4/w2k compatible. |
Special stuff the Decryption Routine uses... | It "Directs" the API's in the IAT. |
The best API to Break on... | The best API to break on for the beginning: GlobalAlloc The best API to break on for the end: GlobalAlloc A little note here, You can also break on GetProcAddress for the end API, but then it screws up the IAT ;) |
Recognization of this Packer/Encrypter... | Check if all the Section names are "pcs* (* = number)". You can also check for the values 90909090 at location (PE+0C). |
Recognization Bytes... | 9C 60 BD |
OEP Jump... | mov edx, OEP jmp edx |