Hello, here i share with you a packed file.

PECompact v3.00.1

1-Unpack it

2-(Optional) Enable button to show the hidden mesage.

Greetz.

PEC300.rar

PEcompact 3.00.1 OEP Finder

        var temp
        var rsrc
        var imgb
        var oep        
GMI eip, MODULEBASE 
mov imgb, $RESULT
find imgb, ".rsrc"
mov temp, $RESULT
add temp, C
mov rsrc, [temp]                                 
add rsrc, imgb
        find rsrc, #5A5E5F595B5DFFE0#  
        mov oep, $RESULT
        add oep,6
        bp oep
 run        
        sti           
cmt eip, "OEP"
        ret

PEcompact 3.00.1 OEP Finder

        var temp
        var rsrc
        var imgb
        var oep        
GMI eip, MODULEBASE 
mov imgb, $RESULT
find imgb, ".rsrc"
mov temp, $RESULT
add temp, C
mov rsrc, [temp]                                 
add rsrc, imgb
        find rsrc, #5A5E5F595B5DFFE0#  
        mov oep, $RESULT
        add oep,6
        bp oep
 run        
        sti           
cmt eip, "OEP"
        ret

Too easy?

Edited September 14, 200915 yr by lolz2much

PECompact isnt meant to be hard to unpack..... its a packer, not a protector.

Basic ESP trick + import rebuild should usually sort it.

And could you say me what is the packer of "123.flt" (Is a dll) But PeID can't recognise it.

Thanks.

123.rar

Have you tried the other detectors?

Protection ID is your best bet.

I have tried with RDG Packer Detector v0.6.6 2k8.exe and it detects PECompact 2.x or 2.7. Anyway unpack dlls is very difficult for me, all dumped dlls then won't work. may be OEP: 10012A36

I know this is an ooooold topic, sorry for this, anyway, just playing with PECompact files I came across this post, so here is the 123 file rebuilt as a dll...

...and here is the revirgin module. All of this stuff will help for a new tut about completely reversing this packer.

Best regards

Nacho_dj

123Revirgin.rar

123.rar

Borland Delphi 4.0OEP=667DC

Edited February 9, 201213 yr by Zhaobo

hi bro

 

Unpacked File

dump_.zip

Edited February 23, 201411 yr by Pr0c3ss

hi bro

 

Unpacked File

Glad you solved.