Posted September 23, 200717 yr Here's a challenge for all unpackers out there: A small sheep-demo in a wolf's clothing Share your approach, if you succeed in unpacking it. SnD_UnpackMaDemo_1.rar Thx to Ted
September 24, 200717 yr This is kinda annoying to trace, garr. Ok this is what I got, the unpackme uses CreateProcessA to loop back to the beginning if it detects any type of debugger use, also forces one I believe to kill loaders and such. So I guess you have to patch to bypass going to CreateProcessA. Here is the annoying part, tracing the freakin code. Im done for now, dont like to do much on Sunday, maybe another look during the week. Quick note, if you just do a basic dump with pe tools, sections show up, so you can get a little more info about unpacking it. Edited September 24, 200717 yr by CHuRcH
September 25, 200717 yr PS: Go get an AV with bigger nuts.. :>Lol (I actually did).Amazingly, McAffee didn't complain about this one! They obviously need to update their patented ****-People-Off-By-Detecting-Everything-As-Dangerous heuristics algorithm.
September 25, 200717 yr McAfee have now created a generic string 'MZ' if this is located in the executable file as the first two bytes.. it's probably malware.. other search strings include 0B0h, 01h.. McAfee's theory ... if it is compressed it is probably infected..
October 7, 200717 yr After a long time i had success!It was really difficult, I have given up three times but now I had success!Here is the unpackt file/>http://www.file-upload.net/download-437450/SnD_UnpackMaDemo_1-unpackt.rar.htmlkNiGhT
October 7, 200717 yr Author After a long time i had success!Um.. very nice !Any chance for some lines, how you went ?Greets
October 9, 200717 yr Here are some hints, I think it 4 open processes tell it runs through. Also during debugging I noticed a string saying Vasm_Protector_**_**_2005. LOL. I think thats a pretty big hint. Has alternating createThreads, one process goes, then waits for the other process. Edited October 9, 200717 yr by What
Create an account or sign in to comment