Unpacking kkrunchy (Farbrausch) executable

[giv]

Because are pirated (stolen/leaked legitimate copy) or the AV you use is not good as it should.

[mudlord]

Originally Posted by giv

Because are pirated (stolen/leaked legitimate copy) or the AV you use is not good as it should.

The problem with kkrunchy is the second part. Its just a fundamental problem all AVs have. They see kkrunchy as a black box as well as most other packers, and so they flag it as suspicious (UPX gets through since its so easy to generically unpack). The taggant system was meant to help mitigate the problem, but in practise it does almost nothing (unless you are a protector vendor, and want to stop people ripping off your DRM). Code signing stuff with digital signatures also is pretty useless.

I just think the AV system is fundamentally f***ed.

A alternative to kkrunchy though is beroexepacker, but it might suffer the same problems. It has a lot more support for things in EXEs and DLLs and when tuned right, can give the same compression ratios as kkrunchy because it can use the same compression algorithm.