Jump to content
Tuts 4 You

[unpackme] Snd Unpackmademo #1


Ufo-Pu55y

Recommended Posts

This is kinda annoying to trace, garr. Ok this is what I got, the unpackme uses CreateProcessA to loop back to the beginning if it detects any type of debugger use, also forces one I believe to kill loaders and such. So I guess you have to patch to bypass going to CreateProcessA. Here is the annoying part, tracing the freakin code. Im done for now, dont like to do much on Sunday, maybe another look during the week. Quick note, if you just do a basic dump with pe tools, sections show up, so you can get a little more info about unpacking it.

Edited by CHuRcH
Link to comment
PS: Go get an AV with bigger nuts.. :>

Lol (I actually did).

Amazingly, McAffee didn't complain about this one! They obviously need to update their patented ****-People-Off-By-Detecting-Everything-As-Dangerous heuristics algorithm.

Link to comment

McAfee have now created a generic string 'MZ' if this is located in the executable file as the first two bytes.. it's probably malware.. :P

other search strings include 0B0h, 01h.. ;)

McAfee's theory ... if it is compressed it is probably infected.. :wacko:

Link to comment
  • 2 weeks later...

After a long time i had success!

It was really difficult, I have given up three times but now I had success!

Here is the unpackt file
/>http://www.file-upload.net/download-437450/SnD_UnpackMaDemo_1-unpackt.rar.html

kNiGhT

Link to comment

Here are some hints, I think it 4 open processes tell it runs through. Also during debugging I noticed a string saying Vasm_Protector_**_**_2005. LOL. I think thats a pretty big hint. Has alternating createThreads, one process goes, then waits for the other process.

Edited by What
Link to comment

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...