Jump to content
View in the app

A better way to browse. Learn more.

Tuts 4 You

A full-screen app on your home screen with push notifications, badges and more.

To install this app on iOS and iPadOS
  1. Tap the Share icon in Safari
  2. Scroll the menu and tap Add to Home Screen.
  3. Tap Add in the top-right corner.
To install this app on Android
  1. Tap the 3-dot menu (⋮) in the top-right corner of the browser.
  2. Tap Add to Home screen or Install app.
  3. Confirm by tapping Install.

Featured Replies

Posted

Hi mates!

I've modified a little bit ExeFog packer (made by Bagie), removed some crap which i consider unuseful by the moment (CreateMutex?, Morphine? (well, i've removed this because it get detected by all AV :P )).. and added "some" protection... just have a look to the unpackme :D

Thanx goes to Bagie for his sources :)

Any ideas for improvement will be good received :rolleyes:

Enjoy it! :D

Hey, thanks for this one. ;) - You could try to improve obfuscation and import redirection. Like that little anti-debug at the beginning... :)

I attached my dump.

dump.7z

  • Author

Thanks mate... i'll be making my own polymorph engine and add some memory crc checks and more antidebug :)

Coding a packer/protector brings a lot fun :P

Import redirection? And what i've maded with imports? :P

It put right value into an memory allocated area, and redirect imports from executable to the allocated area (this avoid IAT repairing :D )... Is this a right way?

Regards..

Edited by HMX0101

Should modify it some more, avg gives a false positive.

script unpacker:

var counter

var ImageBase

var OEP

var iat_start

var imsize

var lbs

GMEMI eip,MEMORYSIZE

mov lbs,$RESULT

mov counter,0

gmi eip,MODULEBASE

mov ImageBase,$RESULT

GMI eip,MODULESIZE

mov imsize,$RESULT

sub imsize,lbs

go eip+30

mov !CF, 1

gpa "LoadLibraryA","kernel32.dll"

find $RESULT,#C20400#

bp $RESULT

erun

erun

bc eip

sti

sti

mov iat_start,ecx

find eip,#68????????012C24C3#

cmp $RESULT,0

je abort

mov OEP,[$RESULT+1]

add OEP,ImageBase

mov eip,OEP

cmt eip, "Oep"

sub OEP,ImageBase

sub iat_start,ImageBase

mov counter,ImageBase

add counter,3C

mov counter,[counter]

add counter,ImageBase

mov [counter+28],OEP

mov [counter+80],iat_start

DPE "dump.exe",eip

msg "The file is unpacked! Remove unnecessary section in Dump"

ret

abort:

ret

thanks for ModdedFog v1.0 script pavka :turned:

regards

zugo

Thanks for the unpackme. I'm still a newbie at unpacking, and this is one of the few I attempted and successfully unpacked :)

Edited by SMK

unpacked

unpacked.7z

Create an account or sign in to comment

Configure browser push notifications

Chrome (Android)
  1. Tap the lock icon next to the address bar.
  2. Tap Permissions → Notifications.
  3. Adjust your preference.
Chrome (Desktop)
  1. Click the padlock icon in the address bar.
  2. Select Site settings.
  3. Find Notifications and adjust your preference.