when I am looking for packet editor, I found open project on http://www.packeteditor.com/ when I learn how it works, I see that the application is injecting a dll named WSPE.dat, when I load this WSPE.dat to ida pro, I found it was a dll that has been obfuscated. and it was something like this : SteveW obfuscator

what is that SteveW section? I also see a lot of this obfuscator on other dll, but protectionId scan result it wasn't being packed with this note :

Section [0x0] 'SteveW  ' has a higher physical size than virtual size..

and also this :

Warning : Import Table is bad !!!

here is the dll link : WSPE.dat

  • It looks like it's just a .text section as it has executable permission. – Paweł Łukasik Jul 29 at 15:18
  • 1
    Looks like a custom crypter to me, not really obfuscated. sub_6464146E has a small rol/xor/rol loop that's probably decrypting the code. – Johann Aydinbas Jul 30 at 9:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.