Go Back   EXETOOLS FORUM > General > Reversing Software


Thread Tools Display Modes
Old 06-20-2007, 07:49
demon_da's Avatar
demon_da demon_da is offline
Join Date: Aug 2005
Posts: 105
Rept. Given: 51
Rept. Rcvd 6 Times in 6 Posts
Thanks Given: 3
Thanks Rcvd at 0 Times in 0 Posts
demon_da Reputation: 6
Exclamation RL!dePacker v1.4 by ap0x

:: Tehnical info:
   RL!dePacker has a build in option to detect OEP. However this option does not work with VB (always use FindOEP! function with VB applications and Force to manual OEP?) and some other packers. So if RL!dePacker can not unpack the file use FindOEP! function to detect correct OEP, but use it only as a second resort since it can be jammed!
   Option Force OEP to manual address is used to force stopping on manual OEP address, use this option ONLY if packer can not be unpacked (the target runs instead of breaking at OEP or dumps at wrong OEP). 
   Option Correct OEP to manual address is used correct OEP in PE header of the unpacked file.
   Option Hide unpacker from detection is used hide debugger from being detected by antiTricks. Option Use tracer to correct IAT is used to remove all known redirection types.
   Option Fix Import elimination is used on applications that relocate import table in memory outside PE32 file. This option has been tested with AlexProtector 1.0 and RLPack TE 1.18. Please note that even dow this option is in testing it should give good results on all known redirection types (see ap0x unpacker SDK).
   Option Paste PE.Header from disk is used correct paste original PE header to the unpacked file. 

   Generic unpacker can ONLY unpack packers that do not use IAT redirection, that dont steal APIs and which fill out IAT table in correct order. To unpack packers that use redirections or import elimination set the unpacker options to match your case. All ordinals that can be converted to API names are converted, others are inserted into IAT as ordinals! Designed for NT systems, Windows 2000 or later but it should work on Windows 9x if you have psapi.dll file!
   If you get a virus/tojan warning and you have downloaded the program from the official website be assured that there is no virus present in the package and that your anti virus is making a false positive detection!

 :: Can I report a bug or contact the autor?
   Here is the contact information which you can use to contact me:
     Handle:     ap0x
     WebSite:   http://ap0x.jezgra.net
     Email:       ap0x.rce(at)gmail(dot)(com)
Attached Files
File Type: rar RL!dePacker.rar‎ (113.1 KB, 52 views)
Reply With Quote

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
RLPack by ap0x Vrane Reversing Software 24 11-29-2013 09:46
ap0x Unpack Engine SDK 1.3 shatru Reversing Software 2 01-24-2007 11:25
ap0x Unpack Engine SDK 1.1 RiDerClock Reversing Software 4 09-17-2006 17:16
xPELister by ap0x Vrane Reversing Software 0 08-13-2006 02:45

All times are GMT +8. The time now is 22:23.

vBulletin Security provided by vBSecurity v2.2.0 (Lite) - vBulletin Mods & Addons Copyright © 2016 DragonByte Technologies Ltd.
Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX