Problem unpacking a Morphined .exe

Originally Posted by lordnasty

Thanks,
the problem is that i want to understand how to fix the original Image Base and the size .
NaSTy

Morphine packs all data file inside ".text" section. Try to find this file data inside ".text" section after passing second decrypting loop and find original PE header, then create your custom PE header according to its.

Originally Posted by lordnasty

Thanks,
Also why the Morphine can encrypt one file several times.
NaSTy

It use polymorphism encryption that cause to face every time different ways.

[lordnasty]

Yes Vodu,
i just resolved in way that you have explained.

To find this "original" value, i track the sections table information in Olly using the VirtualAlloc/return bp.
Then with the original values i have fixed the right RawOffset/Rawsize VirtualOffset/VirtualSize.

Thanks a lot for your advice too.

NaSTy