Flag: Tornado! Hurricane!


Packer Name Packer Author Classification Analysis By Last Updated
NsPacK v3.7 North Star (LiuXingPing) Compressor saphex January 10 2008
Allocation Anti-Debug Anti-Disassembly Section Name Sample
PE header no no [configurable, default = .nsp] N/A
Notes
Nothing special, just a simple compressor.

Transfer Command
00000000 61                 popa
00000001 9D                 popf
00000002 E9 ?? ?? ?? ??     jmp     value
Entry Point Signature
00000000 9C                 pushf
00000001 60                 pusha
00000002 E8 00 00 00 00     call    00000003
00000007 5D                 pop     ebp
00000008 83 ED 07           sub     ebp, 7
0000000B 8D ?? ?? ?? ?? ??  lea     ecx, [ebp-value]
00000011 80 39 01           cmp     byte ptr [ecx], 1
00000014 0F 84 ?? ?? ?? ??  jz      value
Known Unpackers
A easy way to uncompress NsPack using OllyDbg.

At entry point, add a breakpoint in the pusha instruction and
run the application. After it breaks, follow the ESP register
value in dump, add a hardware breakpoint with 4 bytes length
in the first bytes. Then run the application again. When it
breaks, the EIP will be at the transfer command.
Just single step it and EIP will be at the original entry point.
Active in Last 5 Minutes
timtoady

There are 21,677 total registered users.


Recently Created Topics
PyEmu error when cal...
Sep/02
Restore Themida/Winl...
Sep/02
Anti-olly technique
Aug/30
RAR Password
Aug/29
Heap protection on W...
Aug/23
Why Inline asm in C+...
Aug/20
Bypassing OllyAdvance
Aug/17
Error in logic for g...
Aug/17
Has anyone seen this...
Aug/17
ARM Executable - Pat...
Aug/16


Recent Forum Posts
reverse engineering ...
raiden56
pydbg, memory breakp...
Researc...
RAR Password
Ineedhelp
RAR Password
cod
Heap protection on W...
voila
Heap protection on W...
j00ru
Heap protection on W...
voila
Heap protection on W...
j00ru
Heap protection on W...
psylocn
Why Inline asm in C+...
ronnie2...


Recent Blog Entries
meshmesh
Sep/01
Is it legal??

waleedassar
Aug/30
Anti-olly technique

QvasiModo
Aug/24
WinAppDbg 1.4 is out!

artemblagodarenko
Aug/18
Dataflow-0.2.0 released. Ne...

grzonu
Aug/17
Bypassing OllyAdvanced

More ...


Recent Blog Comments
tosanjay on:
Sep/02
PyEmu 0.0.2

GynvaelColdwind on:
Sep/01
Is it legal??

PeterFerrie on:
Aug/31
Anti-olly technique

dennis on:
Aug/26
Dr. Gadget IDAPython plugin

halsten on:
Aug/19
Dataflow-0.2.0 released. Ne...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit