-
-
[ZT]Quick Unpack 1.0 beta 7 by FEUERRADER
-
发表于: 2007-1-28 02:44
-
Quick Unpack v1.0 Readme
========================
Description
-----------
The program is intended for fast (in 2 seconds) unpacking simple packers (UPX, ASPack, PE Diminisher, PECompact, PE-PACK, PackMan, WinUPack and many others). Quick Unpack tries to bypass all possible scramblers/obfuscators. From the version 1.0 the opportunity of unpacking dll is added. This opportunity makes Quick Unpack unique software product which has no similar analogues in the world!
Technology of import recovery
-----------------------------
I recommend to look through the list of import rather attentively.. There can be fake functions in it!! So the unpacked program can be unable to work because of them..
The import recovery with syd's method works so: after loading the program, the dlls which it loads are hooked. The export is scanned from them. Then the program will be dumped and the addresses which coincide with the address from that dlls will be searched for. If coincides, this address will be called Record RVA and will be included in a cycle of creation the table of import further.
If addresses casually concides with the addresses from hooked dlls, they will be added in the list of import too but if you are rather experienced in unpacking to find them, they can be removed (for this purpose numbers of the sections and their names are showed). More often import lays in one section so be very attentive please.
There are some records in the file replace.ini according to which you should replace some functions in the import list. The matter is that e.g if you call GetProcAddress(GetModuleHandle("kernel32"), "HeapFree"), your system will return the address in ntdll.dll and it will be the address of api-function RtlFreeHeap. I have added in this list the api I met earlier. If you will notice some records from ntdll.dll in the list of import, try to find the replacement for them in your system. If it will be impossible, simply try to remove them.
In the Quick Unpack there is the opportunity of marking possible invalid records is added, for their removing please press the button "Delete invalid".
The license and rights
----------------------
The list of sources used in coding Quick Unpack 1.0.
GenOEP.dll by Snaker
ImpREC.dll by MackT
stripper asprotect unpacker by syd
History of the versions
-----------------------
v1.0 beta7 [+] Improved interface
[+] Fixed small bugs
Down:
http://qunpack.ahteam.org/wp-content/uploads/2007/01/quickunpack10beta7.zip
========================
Description
-----------
The program is intended for fast (in 2 seconds) unpacking simple packers (UPX, ASPack, PE Diminisher, PECompact, PE-PACK, PackMan, WinUPack and many others). Quick Unpack tries to bypass all possible scramblers/obfuscators. From the version 1.0 the opportunity of unpacking dll is added. This opportunity makes Quick Unpack unique software product which has no similar analogues in the world!
Technology of import recovery
-----------------------------
I recommend to look through the list of import rather attentively.. There can be fake functions in it!! So the unpacked program can be unable to work because of them..
The import recovery with syd's method works so: after loading the program, the dlls which it loads are hooked. The export is scanned from them. Then the program will be dumped and the addresses which coincide with the address from that dlls will be searched for. If coincides, this address will be called Record RVA and will be included in a cycle of creation the table of import further.
If addresses casually concides with the addresses from hooked dlls, they will be added in the list of import too but if you are rather experienced in unpacking to find them, they can be removed (for this purpose numbers of the sections and their names are showed). More often import lays in one section so be very attentive please.
There are some records in the file replace.ini according to which you should replace some functions in the import list. The matter is that e.g if you call GetProcAddress(GetModuleHandle("kernel32"), "HeapFree"), your system will return the address in ntdll.dll and it will be the address of api-function RtlFreeHeap. I have added in this list the api I met earlier. If you will notice some records from ntdll.dll in the list of import, try to find the replacement for them in your system. If it will be impossible, simply try to remove them.
In the Quick Unpack there is the opportunity of marking possible invalid records is added, for their removing please press the button "Delete invalid".
The license and rights
----------------------
The list of sources used in coding Quick Unpack 1.0.
GenOEP.dll by Snaker
ImpREC.dll by MackT
stripper asprotect unpacker by syd
History of the versions
-----------------------
v1.0 beta7 [+] Improved interface
[+] Fixed small bugs
Down:
http://qunpack.ahteam.org/wp-content/uploads/2007/01/quickunpack10beta7.zip
|
|
|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
