Flag: Tornado! Hurricane!


Packer Name Packer Author Classification Analysis By Last Updated
NsPacK v3.7 North Star (LiuXingPing) Compressor saphex January 10 2008
Allocation Anti-Debug Anti-Disassembly Section Name Sample
PE header no no [configurable, default = .nsp] N/A
Notes
Nothing special, just a simple compressor.

Transfer Command
00000000 61                 popa
00000001 9D                 popf
00000002 E9 ?? ?? ?? ??     jmp     value
Entry Point Signature
00000000 9C                 pushf
00000001 60                 pusha
00000002 E8 00 00 00 00     call    00000003
00000007 5D                 pop     ebp
00000008 83 ED 07           sub     ebp, 7
0000000B 8D ?? ?? ?? ?? ??  lea     ecx, [ebp-value]
00000011 80 39 01           cmp     byte ptr [ecx], 1
00000014 0F 84 ?? ?? ?? ??  jz      value
Known Unpackers
A easy way to uncompress NsPack using OllyDbg.

At entry point, add a breakpoint in the pusha instruction and
run the application. After it breaks, follow the ESP register
value in dump, add a hardware breakpoint with 4 bytes length
in the first bytes. Then run the application again. When it
breaks, the EIP will be at the transfer command.
Just single step it and EIP will be at the original entry point.

There are 31,320 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
hi!
Jul/01
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit