Flag: Tornado! Hurricane!


Packer Name Packer Author Classification Analysis By Last Updated
NsPacK v3.7 North Star (LiuXingPing) Compressor saphex January 10 2008
Allocation Anti-Debug Anti-Disassembly Section Name Sample
PE header no no [configurable, default = .nsp] N/A
Notes
Nothing special, just a simple compressor.

Transfer Command
00000000 61                 popa
00000001 9D                 popf
00000002 E9 ?? ?? ?? ??     jmp     value
Entry Point Signature
00000000 9C                 pushf
00000001 60                 pusha
00000002 E8 00 00 00 00     call    00000003
00000007 5D                 pop     ebp
00000008 83 ED 07           sub     ebp, 7
0000000B 8D ?? ?? ?? ?? ??  lea     ecx, [ebp-value]
00000011 80 39 01           cmp     byte ptr [ecx], 1
00000014 0F 84 ?? ?? ?? ??  jz      value
Known Unpackers
A easy way to uncompress NsPack using OllyDbg.

At entry point, add a breakpoint in the pusha instruction and
run the application. After it breaks, follow the ESP register
value in dump, add a hardware breakpoint with 4 bytes length
in the first bytes. Then run the application again. When it
breaks, the EIP will be at the transfer command.
Just single step it and EIP will be at the original entry point.

There are 30,783 total registered users.


Recently Created Topics
How can i find conne...
Nov/27
How can I write olly...
Oct/05
Career: Malware Reve...
Sep/30
How to produce separ...
Sep/20
How to decompile a f...
Sep/16
How to trap mouse cl...
Sep/03
Intel pin in loaded ...
Jun/27
Going to do today wi...
Jun/27
how to create delphi...
Jun/27
enabling menu in a s...
Jun/18


Recent Forum Posts
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n
OOP_RE tool available?
van7hu
Should binaries be n...
Kolisar
Problem with ollydbg
nullx42
!findtrampoline Immu...
skycrack
looking for a softwa...
raxen
Documenting reversed...
raxen
.orpc section what's...
mbin


Recent Blog Entries
oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

oleavr
Apr/17
frida.re 1.2.0 is out, with...

More ...


Recent Blog Comments
djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

newlulu on:
Jun/10
Branch tracing and LBR acce...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit