Does anybody know an unpacker/decryptor that can unpack Stone's PE Encrypter v2.0? I found one but it was for a previous version, not version 2.0. IDA's universal unpacker seems to hang when trying to unpack this. "waiting for unpacker to finish" forever. Thank you.
-
2unless it uses some advanced tricks, most likely you can unpack it manually with a bit of effort.– Igor Skochinsky ♦Dec 18, 2017 at 9:28
Add a comment
|
1 Answer
Depending on what you're looking to accomplish, you have a handful of options:
Use RL!dePacker 1.5, which supports unpacking Stone's PE Encryptor 2.0. The technology at the core of this unpacker, TitanEngine, has been immensely improved since its implementation back then, and is available as open source via ReversingLabs. Official video tutorial from RL can be viewed here.
FUU utilizes TitanEngine and has signatures for multiple versions of Stone's PE Encryptor, including v2.0.
Use The aPE, which allows for patching of supported packed binaries--Stone's PE Encryptor v2.0 being one of the supported packers.
A code search on GitHub for "PE Encryptor v2.0" yields additional results you may want to sift through in case any of the solutions above don't pan out.
-
Are you sure this "RL!dePacker 1.5" is virus free? My AV is going nuts with it.– savramDec 18, 2017 at 16:08
-
2Mine did as well. Virus Total shows more positives than negatives: (virustotal.com/#/url/…), but if you're weary, just run it and your target within a VM or use something like Sandboxie: sandboxie.com– dsasmblrDec 18, 2017 at 16:12
-
I used RDG Packer Detector v0.7.6.2017 to determine that the PE is packed with Stone's PE Encrypter, but oddly FUU doesn't seem to recognize that, and RL!dePacker just seems to freeze. They don't seem able to find the OEP.– savramDec 18, 2017 at 17:22
-
Try using Exeinfo PE to see what it thinks it's packed with: exeinfo.atwebpages.com– dsasmblrDec 18, 2017 at 17:57
-
1@savram, any chances that you'd share the binary with us? We may be able to help Dec 19, 2017 at 6:49