Hi guys ,
i tryed days ago to unpack PI2 backdoor client by doing his:
-Dumping to HD the Exe loaded in memory
-Rebuilding the OEP
-Using ImpRec
but the exe give me an error ,if scanned with peid i got this :



never seen before this type of protection :
*MPEG Layer II/III music file.*
Link to download the file :
www.sendspace.com/delete/z9kkzd/ae1l4
Can sameone try to unpack it when you got same lil free time ?
Much appreciated and thanks so much in advance ;)
/iNNos/

| Сообщение посчитали полезным:

iNNos
try to update peid signatures, or use other analizer

and i cann't download file cause
"Sorry, there was an error. The file may have already been deleted or it may be in use"
please upload to rapidshare

-----
Я ещё не волшебник, я только учусь...

| Сообщение посчитали полезным:

Hi Assass1n ,
sorry for link ,here is the working link on rs:
rapidshare.com/files/31992791/PI2.2.0.rar.html
I tryed also other analizer like exeinfo ,scanit ,prot id ,but seem the same or seem not protected but is protected in reality and i never seen that type of protection before (maybe is a fake but dont know)
ps:
sorry my english
iNNos

| Сообщение посчитали полезным:

What password on archive?

| Сообщение посчитали полезным:

iNNos ?????:
rapidshare.com/files/31992791/PI2.2.0.rar.html
Man mb you write Pass here?

| Сообщение посчитали полезным:

May be it was glued with some music file O_o

| Сообщение посчитали полезным:

ahahaha very nice

-----
Я ещё не волшебник, я только учусь...

| Сообщение посчитали полезным:

Hi guys,
mmmh didnt checked if was pass protected lol (drunked 2 glass of wine when posting :\ ) sorry here is the file without pass:
rapidshare.com/files/32011515/PI2.2.0nopass.rar.html

resorry for links
iNNos

| Сообщение посчитали полезным:

Packer: ExeStealth 2.7
Unpacked: dump.ru/files/f/f78646454/

| Сообщение посчитали полезным:

Thanks so much Vovan666 for it
iNNos

| Сообщение посчитали полезным: