PECompact 2

[MaRKuS-DJM]

i think the checksum in PE Compact was removed in version 2. i was able to inline-patch such files without any checksum errors from PE Compact. maybe it has such antidebug... but i think these doesn't hit olly.
quetzaoalt said these antidebug happened after unpacking

[dyn!o]

Yes, in v2 checksum went renamed to CRC32 as external dll which is suggested to use instead of "code integrity check" option (available also in v2).

If I understood correctly then Quetzaoalt said about anti-debug and "crippled" code after unpacking. If that's right then we have three choices:

1. The software was protected with anti-debug tricks inside the source code and then, to fool potential cracker, compressed (not protected) with PeCompact2 since it allows dual compression on many packers.

2. The software was protected by an protector without checksum verification and then (to fool again) compressed with PeCompact (I saw such a behaviour few times... useless but people do that ).

3. He could made a wrong dump (wrong context, range, layer or even process - like Armadillo does).


Regards.