Quick Unpack v0.4 final Readme
==============================
Description
-----------
The program is for the really quick unpacking of the easy packers (UPX, AsPack, PE Diminisher, PE-PACK, etc). Has the small size and is pretty fast.
Quick Unpack can unpack:
ASPack 2.12
UPX 1.xx
FSG 1.33
PE Diminisher 0.1
PECompact 1.84
...
Usage
-----
You have to specify the address (in hex) for Quick Unpack to stop on. When the program stops, it will do the dump. It can be either OEP or any other VALID EIP, which is executed by a program.
You can also press the ">" button and Quick Unpack will try to find the OEP using external modules. If the attempt is successful, then you'll see the obtained OEP in the "OEP" field. If attempt has failed, probably the file is a non-executable one or due to some other reason.
Quick Unpack will try to resolve IAT (NT-systems ONLY!) when "Rebuild import" is checked.
If the unpacked file doesn't run then try unpacking the file without optimizing the filesize ("Optimize file" option).
Limitations
-----------
IAT recovery is working under Win2000/XP/2003 ONLY.
Licensing
---------
Sources that were used while writing Quick Unpack:
e32unpack sources by bedrock
GenOEP.dll by Snaker
ImpREC.dll by MackT
NDump.dll by NEOx [uinC]
RebPE32.dll by NEOx [uinC]
All the modules have been taken from the open resources.
History
-------
v0.4 final.
[+] Added new OEP-finding system for UPX, ASPack and FSG.
[!] Small bugz are fixed
v0.3. [+] Dump engine has been rebuilt
Quick Unpack now uses dump engine from PE Tools by NEOx [uinC].
[+] New method of dump rebuilding. thx NEOX again :)
[!] No picture of Quick Unpack anymore :)
[+] Added support for new packers (for example, FSG).
[+] Small bugz are fixed
v0.2. First version.
Greetings
---------
My thanks for the help and advices: Aster!x, Volodya/WASM.RU, MozgC [TSRh], NEOx, Bad_Guy, RideX... and everyone from CrackLab, EXETools and woodmann.net.
发表于 2009-6-5 02:11
发表于 2009-6-5 06:30
