This is my first unpackme..

The exe protected with KERIS protector....

Maybe is very easy ...

UnPackMe_1.rar

Beautiful skin the Protector weak

Dumped.rar

It crashes when I try to execute it However at a quick glance it looks like the main part of the file is a crypted overlay with a loader to decrypt it - am I correct?

Is Keris a new team packer/protector, I have never heard of it before, where to get it?

Ted.

Hm... just tried it. I had a BSOD... :|

Crashes for me too but not looked into it.

pavka's unpacked one works fine though. The skin is indeed nice - the work of JetCodE! from ICU.

After another try and a 2nd BSOD -

but, yes, pavka's unpacked one works fine...

Smal script

1 Layer

//////////////////////////////////////////////

var rgn

var sz

GPA "VirtualAlloc","kernel32.dll"

bp $RESULT

run

BC eip

rtu

rtr

sti

FIND eip,#6681384D5A#

bp $RESULT

run

bc eip

mov rgn,eax

find rgn,#5045#

mov sz,$RESULT

add sz,50

mov sz,[sz]

eval " damp partial in LordPe select IntelDump address:{rgn} , size:{sz}"

msg $RESULT

ret

////////////////////////////////////////////////

2 Layer

////////////////////////////////////////////////

var rgn

var sz

GPA "VirtualAlloc","kernel32.dll"

bp $RESULT

run

BC eip

rtu

FIND eip,#F3A4#

bp $RESULT

run

bc eip

mov rgn,esi

find rgn,#5045#

mov sz,$RESULT

add sz,50

mov sz,[sz]

dm rgn, sz, "dump.exe"

Msg "File Unpacked!"

ret

Seems the only requirement is run it in a debugger, crashes for me if not. When the parent process terminates dump the second process with lordpe and thats it, no fixing at all needed.

it used to run on my computer ... bt from last night it's crashing and this error message pops up: Runtime error 216 at FFF000F0

Edited July 11, 200718 yr by nick_name

@Teddy Rogers

KERIS is handmade by Indonesian Reverser and still evaluation so not for public right now

@pavka

Great job man

@zako

This unpackme just protected with mophine

with just dump the unpackme, without repairing it will be done

try the second unpackme

Edited July 14, 200718 yr by B_S