Thread: PECompact 2
View Single Post
  #5  
Old 11-14-2004, 02:00
dyn!o's Avatar
dyn!o dyn!o is offline
Friend
 
Join Date: Nov 2003
Location: Own mind
Posts: 214
Rept. Given: 1
Rept. Rcvd 1 Time in 1 Post
Thanks Given: 8
Thanks Rcvd at 0 Times in 0 Posts
dyn!o Reputation: 1
Yes, in v2 checksum went renamed to CRC32 as external dll which is suggested to use instead of "code integrity check" option (available also in v2).

If I understood correctly then Quetzaoalt said about anti-debug and "crippled" code after unpacking. If that's right then we have three choices:

1. The software was protected with anti-debug tricks inside the source code and then, to fool potential cracker, compressed (not protected) with PeCompact2 since it allows dual compression on many packers.

2. The software was protected by an protector without checksum verification and then (to fool again) compressed with PeCompact (I saw such a behaviour few times... useless but people do that ).

3. He could made a wrong dump (wrong context, range, layer or even process - like Armadillo does).


Regards.

Last edited by dyn!o; 11-14-2004 at 02:04.
Reply With Quote