An Unknown Packer !

Originally Posted by newbie_cracker

Here is the Modified OllyDbg with following Fixes :
...
Place this in OllyDbg folder, and rename a copy of OllyDbg.ini to Modifyd.ini (For different settings between original and modified ollyDbg).

Thanks for the file.
I noticed that you removed all the exported entries (names) from ollydbg.exe. How do you handle the plugins with those modifications? They all link to ollydbg.exe + use function names. Do you just keep ollydbg.exe in the same directory and hope for the best? Or do the plugins have to be patched as well ?

every plugin maps and resolves the exports imports whtever it is called
so stripping the export table doesnt have any problem just have the original exe in the directory
actully if i remember well just view executable and modify (zeroing out)
the export table entry in peheader defeats that checks
as i think (it was just relying on the expecting a export table header)

actually i was coding to incorporate this export table elimination in runtime
on the PLUGIN NTGLOBALFLAG (see there is a big thread in this forum second or third topmost read ever since the beginning of the board quiet a honour
i would say called using tls in olly)
but i saw reports that crudds re-pair already eliminates export -table
and also some such methods were already discussed by shub-nigurrath

and i suck coding c which is what i coded the plugin in so its still sleeping in some shells around the world

also this outputdebugstring if you see also has a big thread
here (yeah i have a small percentage of contribution to that thread too
which goggles modified and crudd incorporated in his re-pair)