Exetools  

Go Back   Exetools > General > General Discussion

Notices

 
 
Thread Tools Display Modes
Prev Previous Post   Next Post Next
  #1  
Old 12-27-2010, 17:20
Newbie_Cracker's Avatar
Newbie_Cracker Newbie_Cracker is offline
VIP
 
Join Date: Jan 2005
Posts: 227
Rept. Given: 72
Rept. Rcvd 26 Times in 12 Posts
Thanks Given: 50
Thanks Rcvd at 25 Times in 18 Posts
Newbie_Cracker Reputation: 26
Help for unknown protector

Hello everybody.

Few days ago I saw an unknown protector (at last for me).

Here is the link of protected target:
Code:
http://download.akvis.com/akvis-lightshop-setup.exe
The EP of protector is this like.
Code:
010F4000 <> /EB 01                      JMP SHORT Lightsho.010F4003
010F4002    |99                         CDQ
010F4003    \50                         PUSH EAX
010F4004     EB 04                      JMP SHORT Lightsho.010F400A
010F4006     2B67 A9                    SUB ESP,DWORD PTR DS:[EDI-57]
010F4009     15 E8140000                ADC EAX,14E8
010F400E     00EB                       ADD BL,CH
010F4010     0321                       ADD ESP,DWORD PTR DS:[ECX]
010F4012     96                         XCHG EAX,ESI
010F4013     D6                         SALC
010F4014     EB 03                      JMP SHORT Lightsho.010F4019
Section has no name.
It's unpacking routine is starnge!
After 6th exception, it writes the code section.

None of the breakpoints work to trap write sequence.

Does someone know what's its name?
__________________
In memory of UnREal RCE...
Reply With Quote
 


Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Best software protector: Themida or Enigma Protector? smartins General Discussion 13 04-27-2010 17:58
New or Unknown Protector lordnasty General Discussion 0 06-19-2006 16:57
How to defeat Password Reminder 1.6 ? (An unknown protector) Newbie_Cracker General Discussion 17 02-17-2005 04:49


All times are GMT +8. The time now is 08:17.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )