[unpackme] Keris :d

[B_S]

This is my first unpackme..

The exe protected with KERIS protector....

Maybe is very easy ...

UnPackMe_1.rar

[pavka]

Beautiful skin the Protector weak

Dumped.rar

[Teddy Rogers]

It crashes when I try to execute it However at a quick glance it looks like the main part of the file is a crypted overlay with a loader to decrypt it - am I correct?

Is Keris a new team packer/protector, I have never heard of it before, where to get it?

Ted.

[Ufo-Pu55y]

Hm... just tried it. I had a BSOD... :|

[Loki]

Crashes for me too but not looked into it.

pavka's unpacked one works fine though. The skin is indeed nice - the work of JetCodE! from ICU.

[Ufo-Pu55y]

After another try and a 2nd BSOD -

but, yes, pavka's unpacked one works fine...

[pavka]

Smal script

1 Layer

//////////////////////////////////////////////

var rgn

var sz

GPA "VirtualAlloc","kernel32.dll"

bp $RESULT

run

BC eip

rtu

rtr

sti

FIND eip,#6681384D5A#

bp $RESULT

run

bc eip

mov rgn,eax

find rgn,#5045#

mov sz,$RESULT

add sz,50

mov sz,[sz]

eval " damp partial in LordPe select IntelDump address:{rgn} , size:{sz}"

msg $RESULT

ret

////////////////////////////////////////////////

2 Layer

////////////////////////////////////////////////

var rgn

var sz

GPA "VirtualAlloc","kernel32.dll"

bp $RESULT

run

BC eip

rtu

FIND eip,#F3A4#

bp $RESULT

run

bc eip

mov rgn,esi

find rgn,#5045#

mov sz,$RESULT

add sz,50

mov sz,[sz]

dm rgn, sz, "dump.exe"

Msg "File Unpacked!"

ret

[zako]

Seems the only requirement is run it in a debugger, crashes for me if not. When the parent process terminates dump the second process with lordpe and thats it, no fixing at all needed.

[Guest nick_name]

it used to run on my computer ... bt from last night it's crashing and this error message pops up: Runtime error 216 at FFF000F0

Edited July 11, 2007 by nick_name

[B_S]

@Teddy Rogers

KERIS is handmade by Indonesian Reverser and still evaluation so not for public right now

@pavka

Great job man

[B_S]

@zako

This unpackme just protected with mophine

with just dump the unpackme, without repairing it will be done

try the second unpackme

Edited July 14, 2007 by B_S