Manual Unpacking Tutorial... | Manual UnPacking (MUP) of Virogen's PE Shrinker v0.14 (VGShrink) |
Source Code... | Virogen's PE Shrinker v0.14 (VGShrink) Source Code |
Some Info about the Packer/Encrypter and Author... | Author: Virogen Homepage: None. Email: None. Size of Packer/Encrypter: 6.50 KB The Packer/Encrypter itself is Packed/Encrypted with Virogen's PE Shrinker v0.14 (VGShrink) . |
Author Words about the Packer/Encrypter... | This shiznit was written up in one night and largely taken from the base code of VGCRYPT. It uses LZRW1 compression to compress code and data sectons of a PE. Don't expect it to compete with UPX or Petite ;) Maybe someday I will add more features, such as resource compression and section merging.. |
Features... | Compression of Code and Data Sections. |
Special stuff the Decryption Routine uses... | None. |
The best API to Break on... | None. This Encrypter isn't using any API's in the Decryption Routine. |
Recognization of this Packer/Encrypter... | You can't recognize this Packer/Encrypter by simply looking at the Section names, because it doesn't change it ;) But you can recognize this Packer/Encrypter by looking at "Offset PE + 0C" and look if you can find the values "90909090" there. Or just search for the Recognization Bytes ;) |
Recognization Bytes... | 9C 55 E8 82 00 00 00 87 D5 5D |
OEP Jump... | mov ebx, OEP jmp ebx |