Morphine 1.2

FEUERRADER · #1 12-22-2003, 18:59

Anybody knows, why files, crypted by Morphine 1.2 is not run on Win9x?
I tested this cryptor on ASM, C++, Delphi compiled files and any of them was not run

Anybody tried unpack Morphine? It's simple?

#2 12-23-2003, 02:17

Code:

mov eax,fs:[000000018h]               //TEB
mov eax,[eax+030h]                    //PEB
mov [eax+008h],ecx                    //rewrite old imagebase
mov eax,[eax+00Ch]
mov eax,[eax+00Ch]                    // <-- error, that's why :)
mov [eax+018h],ecx                    //rewrite old imagebase

but anyway, its author doesnt want to make version for 9x, as he said to me, he isnt interested into 9x anymore

dj-siba · #3 12-23-2003, 21:11

Anybody tried unpack Morphine? It's simple?
it use Meta engine! unpacking is Verry hard -al least for newbie like me- but possible...

Regards