Does anybody know an unpacker/decryptor that can unpack Stone's PE Encrypter v2.0? I found one but it was for a previous version, not version 2.0. IDA's universal unpacker seems to hang when trying to unpack this. "waiting for unpacker to finish" forever. Thank you.


1 Answer 1


Depending on what you're looking to accomplish, you have a handful of options:

  1. Use RL!dePacker 1.5, which supports unpacking Stone's PE Encryptor 2.0. The technology at the core of this unpacker, TitanEngine, has been immensely improved since its implementation back then, and is available as open source via ReversingLabs. Official video tutorial from RL can be viewed here.

  2. FUU utilizes TitanEngine and has signatures for multiple versions of Stone's PE Encryptor, including v2.0.

  3. Use The aPE, which allows for patching of supported packed binaries--Stone's PE Encryptor v2.0 being one of the supported packers.

  4. A code search on GitHub for "PE Encryptor v2.0" yields additional results you may want to sift through in case any of the solutions above don't pan out.

  • Are you sure this "RL!dePacker 1.5" is virus free? My AV is going nuts with it.
    – savram
    Dec 18, 2017 at 16:08
  • 2
    Mine did as well. Virus Total shows more positives than negatives: (virustotal.com/#/url/…), but if you're weary, just run it and your target within a VM or use something like Sandboxie: sandboxie.com
    – dsasmblr
    Dec 18, 2017 at 16:12
  • I used RDG Packer Detector v0.7.6.2017 to determine that the PE is packed with Stone's PE Encrypter, but oddly FUU doesn't seem to recognize that, and RL!dePacker just seems to freeze. They don't seem able to find the OEP.
    – savram
    Dec 18, 2017 at 17:22
  • Try using Exeinfo PE to see what it thinks it's packed with: exeinfo.atwebpages.com
    – dsasmblr
    Dec 18, 2017 at 17:57
  • 1
    @savram, any chances that you'd share the binary with us? We may be able to help
    – Megabeets
    Dec 19, 2017 at 6:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.