how unpack this -> EXECryptor

[t4d]

Some info to force Execryptor to be blinded to patching code (OLLY related):

This technique works on simple checking routine aka bytescout (wxw.bytescout.com) use in their stuffs.

1. 4 dwords with CRC seeds at file offset 110h (EXE) 050h (DLL). Execryptor check CRC before Anti-Debug routine.

2. BP ReadFile till you see PE string in STACK listing. Push CTRL-M and look for e.g. first CRCs string (point 1.). Put HW Break on access every of 4 CRC seedes separately. Olly stops and you see compared values (after patching you see which code you have to write to file offset 110h (EXE) 050h (DLL) back, also you will have to fix value in EAX to continue on next CRC check; do not forget there are 4 CRC check-points). After checking all of 4 CRC seeds remove all hardware breakpoint!!

3. You have to find from where EXECryptor read byte(s), which you want to patch aka HW Break on write. Simple patch them using HEX editor, find new crc strings, write them and enjoy.


If olly starts exe before OEP and EXECryptor fire complaint message use HW Break on execute on user32.UserClientDllInitialize, after you can put BP ReadFile and remove all hardware breakpoint !! (EXECryptor complaint about it)

It looks the only VERY VERY hard (level 8) crackme that didnt cracked for 1,5 years.

[MaRKuS-DJM]

Execryptors strongest part is morphing. this makes it hard to find the antidebug. but i think this crackme (execryptor) is using a int2e to kill olly.

[D-Jester]

Originally Posted by MaRKuS-DJM

is using a int2e to kill olly.

I have never heard of int2e?

could you perhaps explain a bit.

Peace

[JMI]

OK. Time to try the old search engine and enter:

"anti-debugger detection int 2e" and/or "int 2e and debugger detection" (without the quotes, of course.)

and see what you get!

or, gasp, you could try the search button here, and enter "int2e" (again without the quotes.)

Regards,

Originally Posted by D-Jester

I have never heard of int2e?

could you perhaps explain a bit.

Peace

Hi D-Jester,

Some time ago there was a file posted in this forum which was named DEBUG-ME
It was made by a member of Ar-Team. (Teerayoot)
he has used INT2EW in his Debug-Me.
Just take a look at that file.
Hope it helps you to understand.

Best Regards,
Android.

I wonder

I still cannot download but would be nice to know what packing options (morphing?) were used to pack that.

no morphing...only basic packing all on in the unregistered version...But the script is for IAT only,in not morphed...it may work in morphed but i cannot pack any...don't have registered execryptor to be sure what i pack and with what optionz...

hehe
crackme cracked

though gives enough ideas about the hardness of the stuff

But EXECryptor still not cracked )

Question about the morphing, does it really matter?

Can you just make a DLL to inject which will scan the whole code section and dump it in 0x1000 blocks like how Arma can be attacked? Does the morphed code depend on the protector (like CALL instructions into protector code for example)

BTW I like those idea about patching CreateFile, but really you can debug CreateFile and do the same thing.

Really remember a debugger can use other things as breakpoints other than 0xCC. I have custom unpacker debugger code that uses other types of exceptions as its breakpoints...when exception comes thru it checks its internal table to see if it belongs to the debugger or not Perhaps this could be a improvement for Olly in the future, to allow the user to set custom exception breakpoints. Really in ring3 a debugger ownz azz over any program it just has to hide itself well and it can do this by debugging/emulating the instructions that the protector tries to use for detection.

-Lunar