0

Does anybody know an unpacker/decryptor that can unpack Stone's PE Encrypter v2.0? I found one but it was for a previous version, not version 2.0. IDA's universal unpacker seems to hang when trying to unpack this. "waiting for unpacker to finish" forever. Thank you.

6
+25

Depending on what you're looking to accomplish, you have a handful of options:

  1. Use RL!dePacker 1.5, which supports unpacking Stone's PE Encryptor 2.0. The technology at the core of this unpacker, TitanEngine, has been immensely improved since its implementation back then, and is available as open source via ReversingLabs. Official video tutorial from RL can be viewed here.

  2. FUU utilizes TitanEngine and has signatures for multiple versions of Stone's PE Encryptor, including v2.0.

  3. Use The aPE, which allows for patching of supported packed binaries--Stone's PE Encryptor v2.0 being one of the supported packers.

  4. A code search on GitHub for "PE Encryptor v2.0" yields additional results you may want to sift through in case any of the solutions above don't pan out.

  • Are you sure this "RL!dePacker 1.5" is virus free? My AV is going nuts with it. – savram Dec 18 '17 at 16:08
  • 2
    Mine did as well. Virus Total shows more positives than negatives: (virustotal.com/#/url/…), but if you're weary, just run it and your target within a VM or use something like Sandboxie: sandboxie.com – dsasmblr Dec 18 '17 at 16:12
  • Not sure how long I should wait for "RL!dePacker 1.5" to finish, but it says "Unpacking started" and doesn't go anywhere from that. FUU doesn't work. aPE not an option, I need to unpack. Damn, I think I might need to learn how to unpack shit manually. – savram Dec 18 '17 at 17:12
  • I used RDG Packer Detector v0.7.6.2017 to determine that the PE is packed with Stone's PE Encrypter, but oddly FUU doesn't seem to recognize that, and RL!dePacker just seems to freeze. They don't seem able to find the OEP. – savram Dec 18 '17 at 17:22
  • 1
    @savram, any chances that you'd share the binary with us? We may be able to help – Megabeets Dec 19 '17 at 6:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.