Unpacker ExeCryptor 2.x.x. version 1.0 RC2 [Public Build]

Вот собственно "дампер" перерос в анпакер, вся необходимая дополнительная информация по опциям
и их применению находится в readme.txt

С пожеланиями и предложениями писать СЮДА!!!

c0c4_22.12.2008_CRACKLAB.rU.tgz - Unpacker_ExeCryptor_2.x.x._v1.0_RC2.RSI.tPORt.zip

SReg
Ты надеешься что после анпакеров прога будет полностью зарегистрирована?

MasterSoft
If you think I am too lazy to manually unpack or inline these targets, you're wrong I am trying to sort this problem out, to ensure full compatibility.

tihiy_grom
Thanks, but I've done the unpacking in vmWARE

SReg
Some features are not properly solved in some targets. You need to manually fix what the unpacker doesn't do on its own. Plus, you also need to solve the registration scheme - either take kioresk's method for a spin, or just patch the conditionals (if present). If RegConsts are used, we'll be needing a license, I believe..

SReg,

а это не есть проблема? hттp://s48.radikal.ru/i122/0906/71/44e2d397a5b0.jpg
а какже опция
- Patch File CRC Check
или это не криптовая проверка?

Да, эта проверка CRC не EXECryptor'а.

У криптора при не совпадении CRC отображается свое стандартное сообщение (File corrupted!), которое нельзя изменить.

SReg
Check these:



MD5 test fails



File Upload: PBuilder.exe
MD5 value: d74465682266d0bf7996e50f402a9767

File Upload: PBuilder_u.exe
MD5 value: 866a509500a09d7cd2fcf0d3f6a912c4

SunBeam
Thanks! hxxp://s40.radikal.ru/i090/0906/bc/8e0244faf34a.jpg

SReg
Not a good solution. The IF|ELSE function is a global one, meaning 5D758C is used for more than just that check. Here's my variant Follow the images (explanation below them)..

[1] http://i40.tinypic.com/aavg5x.jpg

Initialization of MD5 command-line - translation: make MD5 of %PBFILE%, where %PBFILE% will be shown in a picture below.

[2] http://i41.tinypic.com/15gpksh.jpg

[3] http://i41.tinypic.com/wr1fnm.jpg

Here's where OPMD is set to same file (same as %PBFILE%).

[4] http://i43.tinypic.com/j8l95h.jpg

Pre-MD5 wrapper.

[5] http://i39.tinypic.com/2nc2sl3.jpg

MD5-computing caller. Result of that function will be stored in [EAX]. EAX == 13FBC0 in my case.

[6] http://i43.tinypic.com/2zrgb4y.jpg

Result of MD5 on the unpacked file [13FBC0] = 866A509500A09D7CD2FCF0D3F6A912C4. This double-quad gets transformed into a string later on

My suggestion is to patch this buffer right at MD5_end() Would be more than OK.

у меня такой косяк при роспаковке
лог
File: C:\Program Files\Pocherk\Pocherk.exe
Create Process... PID = 0xF60 ... Done
Finding signature function unpacking... Done
Set breakpoint in function... Done
Unpacking section "CODE" - YES
Unpacking section "0mby0a8q" - YES
Unpacking section "u554zbwq" - YES
при нажатии на кнопку - выходит. в чем проблема??

Back again with some more analysis on Paquet Builder It seems it uses a license



That serial will get past the "Install registered version" window, but online activation is required..

RSI: I debugged the unpacker and landed here with the error T_T.. on XP SP3..



Apparently, an 0xC0000005 exception is generated right after WaitForDebugEvent.. And it's not cuz of Olly.. And from what I read, 7C901228 (which is invalid) is part of this code:

ntdll!RtlInitString:

7c901225 57 push edi
7c901226 8b7c240c mov edi,[esp+0xc]
7c90122a 8b542408 mov edx,[esp+0x8]
7c90122e c70200000000 mov dword ptr [edx],0x0
7c901234 897a04 mov [edx+0x4],edi
7c901237 0bff or edi,edi
7c901239 741e jz ntdll!RtlInitString+0x34 (7c901259)
7c90123b 83c9ff or ecx,0xffffffff
7c90123e 33c0 xor eax,eax
7c901240 f2ae repne scasb
7c901242 f7d1 not ecx
7c901244 81f9ffff0000 cmp ecx,0xffff
7c90124a 7605 jbe ntdll!RtlInitString+0x2c (7c901251)
7c90124c b9ffff0000 mov ecx,0xffff
7c901251 66894a02 mov [edx+0x2],cx
7c901255 49 dec ecx
7c901256 66890a mov [edx],cx
7c901259 5f pop edi
7c90125a c20800 ret 0x8

thnx for ur great unpacker and keep up ;)