Flag: Tornado! Hurricane!


Packer Name Packer Author Classification Analysis By Last Updated
NsPacK v3.7 North Star (LiuXingPing) Compressor saphex January 10 2008
Allocation Anti-Debug Anti-Disassembly Section Name Sample
PE header no no [configurable, default = .nsp] N/A
Notes
Nothing special, just a simple compressor.

Transfer Command
00000000 61                 popa
00000001 9D                 popf
00000002 E9 ?? ?? ?? ??     jmp     value
Entry Point Signature
00000000 9C                 pushf
00000001 60                 pusha
00000002 E8 00 00 00 00     call    00000003
00000007 5D                 pop     ebp
00000008 83 ED 07           sub     ebp, 7
0000000B 8D ?? ?? ?? ?? ??  lea     ecx, [ebp-value]
00000011 80 39 01           cmp     byte ptr [ecx], 1
00000014 0F 84 ?? ?? ?? ??  jz      value
Known Unpackers
A easy way to uncompress NsPack using OllyDbg.

At entry point, add a breakpoint in the pusha instruction and
run the application. After it breaks, follow the ESP register
value in dump, add a hardware breakpoint with 4 bytes length
in the first bytes. Then run the application again. When it
breaks, the EIP will be at the transfer command.
Just single step it and EIP will be at the original entry point.

There are 29,892 total registered users.


Recently Created Topics
Decompiling raw bina...
May/22
Incorrect bitness wh...
May/20
PaiMei stalker modul...
May/19
Attach to program us...
May/13
IDA PRO how to make ...
May/12
FACT: OpenRCE is dead.
May/08
Int 3 anti debug?
May/05
help needed - Beginn...
May/03
Attaching IDA Pro to...
Apr/27
File type
Apr/21


Recent Forum Posts
Ollydbg 2.0 - Plugin...
openrce...
IDA PRO how to make ...
codeinject
FACT: OpenRCE is dead.
codeinject
IDA Resource Viewer ...
r2x64
FACT: OpenRCE is dead.
djnemo
FACT: OpenRCE is dead.
codeinject
FACT: OpenRCE is dead.
pedram
help needed - Beginn...
araujo
Attaching IDA Pro to...
codeinject
Int 3 anti debug?
codeinject


Recent Blog Entries
nfljerseysmart
May/23


nfljerseysmart
May/23


laangels
May/22
The Reason You Need A Mark ...

laangels
May/22
Buy Albert Pujols Jersey an...

lowpriority
Apr/13
OllyMigrate Plugin for Olly...

More ...


Recent Blog Comments
clarisonic on:
Apr/03
New version of Ollydbg!

clarisonic on:
Apr/03
New version of Ollydbg!

trackerx90 on:
Mar/04
SuppressDebugMsg As Anti-De...

coachfactory on:
Feb/25
Portable Executable Format ...

coachfactory on:
Feb/25
A new Anti-Olly trick.

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit