how unpack this -> EXECryptor

Never come across it before, have you tried a generic unpacker?

this thing messes up for me as well i think u need to program an application a certain way to allow it.

[MaRKuS-DJM]

Execryptor doesn't look very easy. i'm working on WikMail, but the important parts are all crypted. and the most sad about it: there's no real OEP. all is handled by execryptor code while the target runs. so there must be a way do decrypt this shit and then save it, no other possibility

most important parts on execryptor are crypted.. it decrypts those parts when neccesary and needs to use it.. so you most decrypt each crypted part by dumping from memory when program needs those parts it will decrypt them without any condition..you set your breakpoint where you want to break and decrypt then dump that part from memory ..it could take long time consuming work or maybe there's a better way to decrypt all stuff in one step..not sure ...but once you got the good you want to crack .... take those RVA/Bytes and make a patch like DZA does and you could easily patch most targets with it.... that could be best solution since there's many encryption involved on this... that's the only reason why it could be hard in some ways....but not unbeatable

i was checking the company that bought VBOX ?? Aladdin?? it has last section called as .protector ... i think both use similar encryption method with many and most interested parts encrypted

To Crk:

Hello man,

...take those RVA/Bytes and make a patch like DZA does...

So,how to patch the execryptor,would you like give us a tut? Maybe that will be more clearly. I'm interested in it.

Regards
nimda2k3

[upb]

>most important parts on execryptor are crypted.. it decrypts those parts
>when neccesary and needs to use it.. so you most decrypt each crypted
>part by dumping from memory

Seems to me the same kind of schema as used by ms to protect the components of os activation.
What i did was to analyze how exactly the info for each encrypted part is stored and how it is decrypted by protector.

Then write your own program to find all those parts in the .exe, decrypt them the same way, save back to .exe.
I think much less work than messing around with ollydbg bpx'ing around and dumping memory 10000 times:P

sorry... guys... but...
I think you are all wrong.

IF they do not lie at strongbit.com, there is no "decryption" at all.

code is morphed one time, then the garbage runs - and it does NOT decrypts anything, but just does the same (among some side effects) that the original code did.

so I am afraid that you can unpack it - but you will only increase the size, you won't make it any more readable. so that - unless you have a lookup table along with some quite complicated maths - you must trace/analyse/patch the garbage; disassembling it just makes no real sense.