[unpackme] unpackme

[mm10121991]

this is a small easy unpackme

good luck on unpacking it and tell me your opinion on it

unpackme.rar

Edited August 21, 2012 by mm10121991

[Raham]

Hi

Here is unpacked file.

ASPack + Self Modify.

Kind Regards.

Unpacked.rar

[mm10121991]

good work

well done raham.

[DMichael]

just give atry .. its semi unpacked xD

semiunpack.rar

[quosego]

Here ya go:

Clean dump everything returned to the original code and encryption removed as well as the macro.

http://www.2shared.c...TA7j2/dump.html

No keygen I'm not that kind of guy. Though one could easily rip the algo.

Was quite fun, not hard but it has everything for someone that wants to get introduced into unpacking. Simple redirected API's, a macro, obfuscated oep.

Not so much for the hardcore unpacker though.

Found it over @ arteam.. but seems raham beat me to it doing a clean unpack.

regards,

q

dump.rar

Edited August 24, 2012 by Teddy Rogers
Attached file...

[DMichael]

hey Raham\quosego i just unpack but how you fully remove the crypt by hand or there away to auto do it?

[quosego]

Well the oep obfuscation is only like 10 instructions interlaced with jumps. So that shouldn't be hard, simple manual copy paste. The other macro is a question of filtering out the useless functions and only retaining the original code which are only two/three instructions. It's obvious the PE header checking can be removed and then just dump the decrypted code to the exe.

[Dreamer]

thank you for tip Mr.quosego

[mm10121991]

nice work quosego

[tarequl.hassan]

does any one have a tutorial on this unpackme?

[GIV]

1. For me the serial was: 484830

2. About the stolen OEP instructions was about 10 as mr. Q say :

 

 

PUSH EBP

MOV EBP,ESP

PUSH -0x1

PUSH 0x4050C0

PUSH 0x402678

MOV EAX,DWORD PTR FS:[0]

PUSH EAX

MOV DWORD PTR FS:[0],ESP

SUB ESP,0x58

PUSH 0x401242

 

Then i have 2 invalid imports:

GetDlgItemTextA

MessageBoxA

 

Short video attached.

The story.....rar

Edited January 14, 2013 by GIV

[tarequl.hassan]

Thanks GIV but i still could not unpack the exe. How to do that?

[GIV]

What you done so far and what is not working?

[tarequl.hassan]

At last i could unpacked. Tutorial added.

Many thanks to GIV  for his help. 

Tutorial.rar

[GIV]

Yep...

You got-it...

Bravo!

[SmilingWolf]

Dumped, Size Reduced and Keygenned (well, really, I've ripped the algo ). This was funny to solve

 

Solved.7z