v0.2

+ support for victims whose apis are not redirected

+ fix exception for newer versions of PELock

PEunLOCK PUBLiC v0.1 by cyclotron

- Support unpacking PELock v1.06

- Based on ap0x's unpack engine v1.4

- EXCLUSIVE support for FULLY protected victim under WinXP SP2

2008.3.27


c2b4_28.03.2008_CRACKLAB.rU.tgz - PEunLOCK.PUBLiC.v0.2.rar

| Сообщение посчитали полезным:

Thanks Linhanshi!

| Сообщение посчитали полезным:

Thanks. This one is public, so there is a private one.
What's the difference?

| Сообщение посчитали полезным:

Thanks !
unpacked

59c8_28.03.2008_CRACKLAB.rU.tgz - dump.rar

| Сообщение посчитали полезным:

pavka
something like this with the table:
mov temp,[table]
add temp,5

ImpREC should trace OK

in code:
1.003B023A 8B96 B8000000 MOV EDX,DWORD PTR DS:[ESI+B8] //address in code
1.003B064B 8B47 04 MOV EAX,DWORD PTR DS:[EDI+4] //8040xxxx
2.003B094E 25 FFFFFF7F AND EAX,7FFFFFFF //0040xxxx
don't know how to take it yet, it runs, motherfucker...

Archer: This is world-wide subforum, I translated the message this time but I'll delete it the next time!

-----
Чтобы юзер в нэте не делал,его всё равно жалко..

| Сообщение посчитали полезным:

Archer
yes, yes ....$$
//motherfucker - this steeply
=======






bad5_29.03.2008_CRACKLAB.rU.tgz - PEunLOCK_un.txt

-----
Чтобы юзер в нэте не делал,его всё равно жалко..

| Сообщение посчитали полезным:

Bronco
var j
var nt
var fn
var srh
var seax
var jw
var ftn
var pbase
var oep
var gmh
var iatrva
var iatb
var iatsz
var iallocib
var espval
var counter
var ImageBase
var nm


mov counter,0
gmi eip,MODULEBASE
mov ImageBase,$RESULT
GMI eip,NAME
mov nm,$RESULT
eval "{nm}_U.exe"
mov nm,$RESULT

gpa "GetModuleHandleA","kernel32.dll"
mov gmh,$RESULT
bphws gmh,"x"

erun
erun
rtu
mov espval,esp
erun
mov iatrva,esi
pause
GMEMI iatrva,MEMORYBASE
mov iatb,$RESULT
GMEMI iatb,MEMORYSIZE
mov iatsz,$RESULT
alloc iatsz
mov iallocib,$RESULT
MEMCPY iallocib,iatb,iatsz
bphwc gmh
bphws espval,"r"
erun
bphwc espval
find eip,#FFE0#
cmp $RESULT,0
je quit
bp $RESULT
erun
bc eip
sti
mov oep,eip
GMI eip,ENTRY
mov pbase,$RESULT
GMEMI pbase, MEMORYBASE
mov pbase,$RESULT
find pbase,#53515256E8000000005B81EB??????0081C3??????008BC833D283C8FFBE040 0#
cmp $RESULT,0
je quit
mov fn,$RESULT
find pbase,#????????????4?80????????????4?80????????????4?80????????????4?8 0#
cmp $RESULT,0
je quit
mov nt,$RESULT

mov srh,401000

loop:
find srh,#CC90????????#//#CC90??600C45# //#FF2556FE4700#
cmp $RESULT,0
je goep
mov srh,$RESULT
mov j,$RESULT
mov jw,$RESULT+2
mov eip,fn

mov eax,j-400000

rtr
mov seax,eax
buf seax
find nt,seax
mov ftn,$RESULT+4
mov ftn,[ftn]
and ftn,0FFFFFF
mov [j],#FF25#
mov [jw],ftn
jmp loop
goep:
mov eip,oep
MEMCPY iatb,iallocib,iatsz
sub oep,ImageBase
sub iatrva,ImageBase
mov counter,ImageBase
add counter,3C
mov counter,[counter]
add counter,ImageBase
add counter,28
mov [counter],oep
add counter,58
mov [counter],iatrva
dpe nm, eip

eval "The file is completely unpacked!"
msg $RESULT
ret

quit:
ret

| Сообщение посчитали полезным:

v0.6

+ support VB programs

v0.3

+ suppress unidentified stolen code restoration

+ make all sections writable


0b53_30.03.2008_CRACKLAB.rU.tgz - PEunLOCK.PUBLiC.v0.6.rar

| Сообщение посчитали полезным:

With this speed the author will write v1.0 in a week. ;)

| Сообщение посчитали полезным:

some problems;)

| Сообщение посчитали полезным:

Xm..What they can unpack?

| Сообщение посчитали полезным:

pavka
There is a line in "About":
"Only for fully protcted victim".

| Сообщение посчитали полезным:

v0.9

+ fix code redirection delta

d858_01.04.2008_CRACKLAB.rU.tgz - PEunLOCK 0.9.zip

| Сообщение посчитали полезным:

Hehehe.
I was right, there'll be 1.0 soon.

| Сообщение посчитали полезным:

thanx
i think he or she work hard for rlzing ver 1

| Сообщение посчитали полезным:

but this way is hard, generic replace find is better!!!!! try this.....

| Сообщение посчитали полезным:

Cyclotron: In terms of good encryption algorithm, we published books: encryption and decryption is his writing.

bbs.pediy.com/showthread.php?t=60232

| Сообщение посчитали полезным:

@linhanshi
how can we have this ebook ? any link for dl
is that english or not?

| Сообщение посчитали полезным:

v1.2

[+] support for locating and incorporating dual comctl32.dll

[+] scan for SDK marks

[+] fix magic jump matching pattern

cyclotron works hard boys

35ab_08.04.2008_CRACKLAB.rU.tgz - peunlock 1.2.zip

| Сообщение посчитали полезным:

Maybe there are some other tools from this guy?

| Сообщение посчитали полезным:

Grim Fandango ?????:
Maybe there are some other tools from this guy?
EmbededPe

| Сообщение посчитали полезным:

Grim Fandango:
Maybe there are some other tools from this guy?

IDT Protector v0.9 for Win2k by cyclotron

| Сообщение посчитали полезным:

doesnt work on XPSP3 It Crashed

| Сообщение посчитали полезным:

Shit protection. Don't run on my system. Unpacker used LOCK CMPXCHG8B EAX for self tracing and crash self.

-----
Yann Tiersen best and do not fuck

| Сообщение посчитали полезным:

pavka please unpack 1.2 version

-----
Yann Tiersen best and do not fuck

| Сообщение посчитали полезным:

PE_Kill ?????:
unpack 1.2 version
unpacked

d5c7_05.05.2008_CRACKLAB.rU.tgz - PEunLOCK_U.rar

| Сообщение посчитали полезным:

thnx again it worked now

| Сообщение посчитали полезным:

v1.2

[+] support for locating and incorporating dual comctl32.dll

[+] scan for SDK marks

[+] fix magic jump matching pattern


5327_07.05.2008_CRACKLAB.rU.tgz - PEunLOCK.PUBLiC.v1.2.rar

| Сообщение посчитали полезным:

does anyone know if project have any update from march? I got mysterious file can be partially dumped by PEunLock 0.9 while version 1.2 dies after step 3 (archive password is : helpmepls

hxxp://rapidshare.com/files/124011549/vps.rar.html

I've tried to unpack executable using wellknown pelock 1.06 unpacking tutorial but output file appeared to be broken and not sufficient for reverse engineering.. can anyone help me please?

| Сообщение посчитали полезным:

Shkoder
dll ?

| Сообщение посчитали полезным: