Unpackers/decrypters/unprotectors

Generic unpackers/dumpers3

ProcDump 1.5.0 by G-RoM, Lorian and Stone. Updated: 20.VII.1999. Files: ProcDump32 (105K). New script.ini (2K). Bhrama client for Petite 2.1 (52K) by Kill3xx. Torn@do's Procdump Site. News: - Added a new param in script.ini, can be usefull sometimes. - Fixed a small GUI bug in options dialog. - Added even more features linked to new ini param. - Randomized some names for some ProcDump mode. - NT compliance should be nearly perfect (may be even 100%). - Many many other news... - Dump to disk a running process & fix it so that u can discompile it. - Dump to disk a part of any process. - Dump to disk a module & fix it for analyzis. - Unpack a given PE file using Wellknown strategy OR using an universal analyzis. - Rebuild a Dump you made with SoftICE + dumper in a regular PE file. - Edit the PE header datas, remove sections, Change PE directory infos, import and export sections from PE file. - Kill a running process. - Able to unpack/decrypt : BJFNt, ENC, Activision Packer, Manolo, NeoLite, Petite, Securom, VBOX , Shrinker 3.2&3.3, WWPACK32, ASPACK, PE-PROT 0.9 and many more...

Win32 Intro v0.71 (26K) by Vitaly Evseenko. Updated: 21.IX.1999. Win32Intro is a generic executable unpacker/dumper. It can unpack compacted or encrypted Win32 executable files without knowledge about their compressor and without any need of debugger. It also unpack files that includes some anti-debugging traps (for instance, use of int 03).

Specific unpackers/dumpers

DeShrink V1.5 (283K) by [j0b]. Updated: 03.VI.1999. News: - Major, major bug fixed. Add a new feature – add a new bug =). When version 3.4 files where unpacked, DeShrink regularly reported “ too many encrypted sections or not a shrinker section” on error. DeShrink is a tool to unpack Files compressed with the all so popular Shrinker done by Blink Inc.

UnShrinker (36K) by Andrew Shipinsky. Updated: 12.I.1999. Decompress shrinked files with Shrinker 3.2/3.3.

Ned 2.2 (8K) by snajder. Updated: 08.XII.1999. News: - Bugs fixed. NED is deshrinker for SHRINKER 3.xx compressed files(NE-Visual Basic 3.0). I made it 'cause all other similar programs doesn't support NEs. This is is the first public release of NED. It works with NE VB 3.0 files ONLY!!!

un-ASPack v1.0 (26K) by dtg. Updated: 26.VIII.1999. Unpacks ASPack 1.02b, 1.07b, 1.08.00/1/2/3. Included full asm source.

UnAspack 1.0.5.0 (70K) by Bi Wei Guo. Updated: 19.XI.1999. News: - Change detect code for ASPack 1.08.04. More files can be dectected now. Another unpacker for ASPack. With GUI.

PEunCompact v0.01 (28K) by Chafe. Updated: 10.X.1999. This is an unpacker for programs packed by a program called PECompact. It has only been tried with programs compressed using PECompact v0.971b, so I don't know if it works with others as well.

C.u.Dilla r1 final (17K) by r!SC. Updated: 02.XI.1999. Safedisk/C-dilla unwrapper / decryptor.. Runs on WIN9x ONLY! It runs the process, hooks into it, fixes it, dumps it, then fully rebuilds it, all with one click of a button. it works on CDilla from april '99 to the present day.. (oct'99). Tested with lots of games including Tiberian sun v1.08/v1.13, Driver, Prince of Persia 3D, Rainbow Six Rouge Spear, Roller Coaster Tycoon...

Un-Armadillio v1.0 (246K) by therain. Updated: 12.IX.1999. Un-Armadillio 1.0 is a program used to remove Armadillioing in programs.

Bye PE-Crypt v1.02 fixed (16K) by Iczelion & Plushmm. Updated: 22.I.1999. The ultimate unpacker for PE-Crypt 1.02. Can decrypt any files encrypted by PE-Crypt 1.02, including DLLs. Coded entirely in win32asm by Iczelion & Plushmm.

PEUNLOCK-NT *aLL VERSIONS* (39K) by xOANINO. Updated: 22.I.1999. - All known PELOCK-NT versions supported : v2.01, v2.02b, v2.03, v2.04 (send me others if u have, but i think there's no other versions around) - Full original PE (EXE/DLL) rebuild, 99% accuracy in the rebuild process. Output file is 100% the same with the only difference of :   - section names if PELOCKNT was used without the -N switch   - section characteristics (crypted objects flags are changed to WRITE)   - for DLLs, PE characteristics is changed and i havent found a way to set it back to original - Multiple layers support : automatically detect how many layers of PELOCK-NT are applied to the file, and decrypt all in one shot. Multiple layers of different versions (ex: v2.04 above v2.01 above v2.03 etc....9 are supported too. - Decrease file size removing unnecessary section (PELOCKnt), removing it from the object table too. - Full source included.

UnPEProt v0.9 (19K) by Lorian. Updated: 23.I.1999. If you should ever face in reallife with this stupid crap calling itself a PE protector this little handy unpacker will save you the 1 minute you spend on doing a manual unpack. BTW: this unpacker like PE-PROT itself does only run under win9x

UNPE-SHiELD v0.14 (20K) by G-RoM. Updated: 1.VI.1999. UNPE-SHiELD is a program, which decrypts 32-bit Windows EXE files "protected" by PE-Shield. The version supported are the 0.1á, 0.1b, 0.1c and 0.1d.

UNPCPECa (13K) by Prophecy. Updated: 24.VI.1999. UNPCPECa will decrypt any PE executable/dll which has been encrypted with PCPEC "alpha - preview" or PCPECa for short. PCPEC stands for Phrozen Crew PE enCrypter. It is a passive decrypter, it does not require the executable/dll to be loaded.

de-CodeCrypt 0.13b (12K) by xOANINO. Updated: 10.XI.1999. Full ASM source included. The resulting rebuilded exe is 100% like the original one.

un-CodeCrypt 0.14 (3K) by Lakan. Updated: 09.XII.1999. Unpacker for CodeCrypt v0.14 beta. Included full NASM source.

undbpe 1.2 (1K) by tender. Updated: 19.IX.1999. Remover for dbpe (aka phantasm 1.2).