View Single Post
  #7  
Old 10-29-2004, 11:58
upb's Avatar
upb upb is offline
Friend
 
Join Date: Apr 2002
Location: Elbonia
Posts: 63
Rept. Given: 5
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 3
Thanks Rcvd at 0 Times in 0 Posts
upb Reputation: 0
maybe im talking out of my ass here but...

>most important parts on execryptor are crypted.. it decrypts those parts
>when neccesary and needs to use it.. so you most decrypt each crypted
>part by dumping from memory

Seems to me the same kind of schema as used by ms to protect the components of os activation.
What i did was to analyze how exactly the info for each encrypted part is stored and how it is decrypted by protector.

Then write your own program to find all those parts in the .exe, decrypt them the same way, save back to .exe.
I think much less work than messing around with ollydbg bpx'ing around and dumping memory 10000 times:P
Reply With Quote