RPolyCrypt v1.0b Unpacker Plugin v1.00
by BoB
Created 10.05.2007


Description

This is a simple static unpacker for a RPolyCrypt v1.0b encrypted file.
What that means is that the PE File that is unpacked is not run (so is safe to use on dodgy files)

How do you know if a file is packed with RPolyCrypt ?
Well, as this uses poly code it's almost impossible to make a signature for it, and it is much easier to check by code.
So until it is added to PEiD internal signature database, here are a couple of tips..
1. EntryPoint section name is .RPCrypt
2. Going from the beginning of the entrypoint section there is lots of blank space before any code.
3. There is instruction MOV ECX, xxxxxxxx (Address may change but this crypter always uses ECX)
4. Following 3, with variable bytes between, there is CMP ECX, xxxxxxxx
5. Following 4, with variable bytes betwwen, there is XOR BYTE PTR DS:[ECX], xx

And if you still aren't sure, just try it, the plugin will check if it is RPolyCrypt 1.0b before processing :)

Usage:
Simply load the file you want to unpack into PEiD, then select the plugin from the menu.
The file will be checked to see if it is the correct version (v1.0b) and if ok then it is unpacked.
Note : The original file is overwritten.


If anyone has any other versions of this encryptor, or have another (not commercial) packer / encryptor they want an unpacker for please send encryptor to BobSoft@GMail.COM ..


Features

     o   Static unpacking ..
     o   Simple to use..
     o   Very fast ..!
     o   Written in about 1 hour! :)


Changes

Version 1.00 - 10-May-2007
     o   Unpacks any file encrypted by RPolyCrypt v1.0b ..


Info

Greets to: snaker, Jibz & Qwerton, Jupiter, BuLLeT, Jeremy Collake, _pusher_, dila, mr Haggar, Fly and all peeps on PEiD forum

Comments? Bugs?    You look like Jessica Alba? ;)    Email : BobSoft@GMail.com

I am currently unemployed so if anyone wants to hire me for programming work, please mail me.

For more plugins see my plugins site - Hosted by BuLLeT (Thanks!)

Thanks again to whoever invented coffee, without which I would never get anything done.. ;)

~ A program without bugs has either too few users, or too few uses ~