[unpackme] Snd Unpackmademo #1

[Ufo-Pu55y]

Here's a challenge for all unpackers out there:

A small sheep-demo in a wolf's clothing

Share your approach, if you succeed in unpacking it.

SnD_UnpackMaDemo_1.rar

Thx to Ted

[Busted]

Have to give this one a crack

[Agony]

This is kinda annoying to trace, garr. Ok this is what I got, the unpackme uses CreateProcessA to loop back to the beginning if it detects any type of debugger use, also forces one I believe to kill loaders and such. So I guess you have to patch to bypass going to CreateProcessA. Here is the annoying part, tracing the freakin code. Im done for now, dont like to do much on Sunday, maybe another look during the week. Quick note, if you just do a basic dump with pe tools, sections show up, so you can get a little more info about unpacking it.

Edited September 24, 2007 by CHuRcH

[Killboy]

Win32:Agent-EXT [Trj]

[Ufo-Pu55y]

-=> <=-

PS: Go get an AV with bigger nuts.. :>

[Loki]

PS: Go get an AV with bigger nuts.. :>

Lol (I actually did).

Amazingly, McAffee didn't complain about this one! They obviously need to update their patented ****-People-Off-By-Detecting-Everything-As-Dangerous heuristics algorithm.

[syk071c]

McAfee have now created a generic string 'MZ' if this is located in the executable file as the first two bytes.. it's probably malware..

other search strings include 0B0h, 01h..

McAfee's theory ... if it is compressed it is probably infected..

[-kNiGhT-]

After a long time i had success!

It was really difficult, I have given up three times but now I had success!

Here is the unpackt file
/>http://www.file-upload.net/download-437450/SnD_UnpackMaDemo_1-unpackt.rar.html

kNiGhT

[Ufo-Pu55y]

After a long time i had success!

Um.. very nice !

Any chance for some lines, how you went ?

Greets

[Ox87k]

Yeah, maybe a little tutorial?

Good job -kNiGhT-!

[What]

Here are some hints, I think it 4 open processes tell it runs through. Also during debugging I noticed a string saying Vasm_Protector_**_**_2005. LOL. I think thats a pretty big hint. Has alternating createThreads, one process goes, then waits for the other process.

Edited October 9, 2007 by What