Exetools  

Go Back   Exetools > General > General Discussion

Notices

 
 
Thread Tools Display Modes
Prev Previous Post   Next Post Next
  #1  
Old 05-08-2005, 10:55
xixiaolou
 
Posts: n/a
Unpack, Packer or Compiler?

It's long time for me to think about how can we unpack/unprotect apps.
Normally, we unpack it with unpacker, debugger and so on. It means packer dependent. With packer update, we have to update our unpacker.
What I think about is compiler-dependent unpacker. If we can develop a tool to unpacking apps packed by different packer/protector , only if compiled with the same compiler. An app is VC6++ compiled, it maybe packed with aspack, or upx, or protected with aspr and so on, we have a tool to unpack it because of it's vc6++ compiler, avoiding its packer. As a native win32 GUI program, it's compiler is mostly vc6++, delphi, bcb, vb, asm. I found compiler such as MFC, delphi, vb, has their unique structure in compiled EXE/dll file. It is combinded with function modules.

2 years ago, An OEP finding tool in woodmann forum used compiler-dependent technology. Dede, a delphi disassembler is the same tech, MFC structure recognition also OK.

Altough, more and more protector use pre-dips tech, but I didn't found it dealing with the function module pointer ---- the skeleon of function modules. So I think it maybe workable to do compiler-dependent unpacker.
Reply With Quote
 

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



All times are GMT +8. The time now is 10:47.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )