SVKP, Armadillo or SDProtector

[TmC]

Hi,
just a stupid question, but what packer do you think is the more difficult to unpack between SVKP, Armadillo or SDProtector?

I'm talking only of packing, not about registration algorithms or other.

Consider:

SVKP: Main packing with compression without RSA encrypted features
Armadillo: Copymem+Nanomites+Code splicing without secured sections
SDProtector: Main packing with compression without RSA encrypted features

What you think is the most hard?

[softworm]

To me,it's Armadillo

SDProtector aka SoftDefender very simple and looks like UPX-based

for me....Armadillo + Nanomites protection...

Armadillo with nanomites look's trouble but not unbeatable.

But if you add Serial + CopyMemII, then it's look's like solid stone without holes. I can't do anything with it, but i'm not a guru

[MaRKuS-DJM]

newer armadillos with serial can't be keygenned and so not unpacked. only way are leaked keys.

[Jay]

Originally Posted by nikita@work

SDProtector aka SoftDefender very simple and looks like UPX-based

throw us a quick tut together then will you.

Originally Posted by Jay

throw us a quick tut together then will you.

It will be really short.
Go to the end of packed stream and look for code like this

pop edx
pushad
mov ebx, PackedStreamSize
mov esi, offset PackedStream
lea   edi, RawDataOffset

Just rip decompress function (or use lzo1x from Oberhummer's UCL) and postfilter (only if relocs present). To decrypt imports you will need RC4 key from protector runtime context. And near the key there are original OEP address, ImageBase, IAT address, etc.

P.S. There is an original PE header at the end of unpacked stream . So as I told before it looks like UPX-based product ;)

[Jay]

Could just be me but I fail to see how that description of how to unpack sd can be described as simple or compared to unpacking upx. Still if you don't have time for a more in-depth tutorial then to bad for us.

nothing is impossible,
give to an dumped program what it needs, it is my
philosophy