Manual Unpacking Tutorial... | Manual UnPacking (MUP) of Yoda's Crypter v1.0 |
Source Code... | Yoda's Crypter v1.0 Source Code |
Some Info about the Packer/Encrypter and Author... | Author: Yoda Homepage: y0da.cjb.net Email: yoda_f2f@gmx.net Size of Packer/Encrypter: 7.50 KB The Packer/Encrypter itself isn't Packed/Encrypted in any way. |
Author Words about the Packer/Encrypter... | This is a small PE crypter with some nice protection options. |
Features... | Softice detection. Erase PE Header. CRC checking. Delete API/DLL names and the ImageImportDescriptors at runtime. |
Special stuff the Decryption Routine uses... | It "Directs" the API's in the IAT. |
The best API to Break on... | The best API to break on for the beginning: LoadLibraryA The best API to break on for the end: GetProcAddress |
Recognization of this Packer/Encrypter... | Check if the name of the last Section is "yC". |
Recognization Bytes... | 60 E8 00 00 00 00 5D 81 ED E7 |
OEP Jump... | mov eax, OEP jmp eax |