Quickunpack is a common shell removal tool that can remove the vast majority of compression shells and a small portion of encryption shells. Generally, the software author will shell the software that he prepared to release. This can reduce the volume of the software, and prevent the software from being reverse engineering to a certain extent. Shelling software is generally divided into two types: compression shell, such as UPX and ASPack. The other is the encrypted shell, such as themida and asprotect. Quick unpack is suitable for shelling the former. If you want to write or make other modifications to a software, if the software is shelled, the software needs to be shelled first. Shelling is very complex and requires a wealth of software debugging and Assembly knowledge. In particular, the encryption shell is actually a software cracking process. Quickunpack is the best shelling program I have ever used. It can take off most of the shells. Last Version 2.0 final was released about half a year ago. This release is version 2.1. According to official instructions, you can remove the following shells:
32 Lite Anslympacker Area51 cryptor Armadillo (minimal protection) Asdpack ASPack Asprotect (old versions) Beroexepacker CD-cops Ddem Depack Dragonarmor Exe32pack Execryptor (old versions) Exefog Exesax Exeshield Exestealth Fearz crypter Freecryptor Fricryptor FSG Hidepe Hidepx Hmimys-packer Jdpack Kbys Kkrunchy Lamecrypt Manolo MEW Minke Neolite NME Nspack Orien Packman Pecompact Pediminisher PE-PACK Pencrypt Perplex pe-Protector Petite Pex Pi cryptor Pklite32 Pollybox Polyene Protection plus Qrypt0r nutral poly Quickpack Rlpack Sopelka Stealthpe Telock (not all versions) Themida (minimal protection) Unnamed scrambler Upack Upolyx Uprotector UPX Windofcrypt Winupack Wwpack32 Yoda crypter Yoda Protector Yzpacker ... Copying others...
Compared with the previous version, 2.1 has made the following improvements:
[!] Fixed writable bugs like crash on some applications while restoration of resources [!] Multithreaded Applications are now handled properly [+] Added ability to set end of module when tracing import functions. when a reference to import is found it's analyzed if it leads to some space outside of the module (not to trace some internal functions ). but some packers redirect import to the last section. this option is intended to aid this problem. this is RVA [+] Added ability to put import table at given RVA instead of adding extra Section [+] Added ability to set rdtsc Delta for rdtsc hook (see more on rdtsc_delta in scripts.eng.txt) [+] Load libraries only option added to import recovery methods. this option doesn' t actually recover import it just puts 1 import function from every loaded DLL into the import table. thus dump will be loaded with all the necessary libraries and will use old addresses for import functions which were set by a protector. this option can be used if import redirection is too complicated but the dump will stop working after service pack or some other patch installation [+] Execute functions while tracing import option is added. By default while tracing import functions are not executed but some protectors need result of these functions to operate correctly so this option can be used [+] Process call xxx/jmp xxx option is added. some protectors change import CILS and jumps from call [XXX]/JMP [XXX] To Call xxx/jmp xxx. this option is intended to work also with these redirections [+] Added several new functions and variables for the scripts [+] Usar's generic OEP finder now supports DLLs [+] New Vista manifest added
Because it is in English, I made a simple Chinese version, so the interface is basically Chinese. Click here for the official English version. There are many software functions. In addition to shelling EXE files, you can also shell DLL files by appending processes. In addition to manual shelling, you can also write scripts for automatic shelling. Download (1.1 m): S. evxz | nano disk | mediafire |