![]() |
|
|
|
#1
|
|||
|
|||
|
ASProtect or UPX?
I am trying to decompress a file and I am running into this:
When I check the signature of the file it is this: Code:
signature: 68 01 80 71 01 E8 01 00 00 00 C3 C3 40 C9 F3 50 My signature log shows this: ASProtect 1.33 - 2.1 Registered -> Alexey Solodovnikov signature=68 01 ?? ?? ?? E8 01 00 00 00 C3 C3 Code:
00400000 00001000 aspmon PE header Imag R RWE 00401000 00221000 aspmon code Imag R RWE 00622000 00009000 aspmon data Imag R RWE 0062B000 00011000 aspmon Imag R RWE 0063C000 00005000 aspmon Imag R RWE 00641000 00001000 aspmon exports Imag R RWE 00642000 00001000 aspmon Imag R RWE 00643000 00001000 aspmon Imag R RWE 00644000 00024000 aspmon Imag R RWE 00668000 000B0000 aspmon .rsrc resources Imag R RWE 00718000 0002E000 aspmon .upx imports,relo Imag R RWE 00746000 00001000 aspmon .adata Imag R RWE Has anyone seen this before? My signature is saying it is compressed with ASProtect but when I check the memory it is showing upx. Are both correct? I have tried to decompress this using my methods for ASProtect and UPX but neither seems to work. Any information would be helpful. int21h |
|
#2
|
||||
|
||||
|
Section .adata is common for asprotect and aspack, and because you have push/call/retn/retn at ep, it seems like asprotect. But be carful it might be fake signature
__________________
http://accessroot.com |
|
#3
|
|||
|
|||
|
Check the section characteristics.
For UPX, there are either 2 to 3 sections found. The third section is the resource section. The first section characteristic has a flag 0xE0000080, the second flag 0xE0000040. The resource section characteristic 0xC0000040. For Asprotect/Aspack, all the sections have the characteristic 0xE0000040. There are 3 to 5 sections found. Default compression with Asprotect, the first two sections usually have blank names. In addition to deroko's reply, there are 5 sections where the first two sections have blank names. It is indeed packed by Asprotect. |
![]() |
|
|
Similar Threads
|
||||
| Thread | Thread Starter | Forum | Replies | Last Post |
| Help with ASProtect 1.23 RC4 | Perdition | General Discussion | 7 | 06-09-2004 01:48 |
| New Asprotect?? | loman | General Discussion | 7 | 02-04-2004 20:34 |