by:FEUERRADER
Quick Unpack v1.0 Readme
Description
-----------
The program is intended for fast (in 2 seconds) unpacking simple
packers (UPX, ASPack, PE Diminisher, PECompact, PE-PACK, PackMan,
WinUPack and many others). Quick Unpack tries to bypass all possible
scramblers/obfuscators. From the version 1.0 the opportunity of
unpacking dll is added. This opportunity makes Quick Unpack unique
software product which has no similar analogues in the world!
Technology of import recovery
-----------------------------
I recommend to look through the list of import rather attentively..
There can be fake functions in it!! So the unpacked program can be
unable to work because of them..
The import recovery with syd's method works so: after loading the
program, the dlls which it loads are hooked. The export is scanned from
them. Then the program will be dumped and the addresses which coincide
with the address from that dlls will be searched for. If coincides,
this address will be called Record RVA and will be included in a cycle
of creation the table of import further.
If addresses casually concides with the addresses from hooked dlls,
they will be added in the list of import too but if you are rather
experienced in unpacking to find them, they can be removed (for this
purpose numbers of the sections and their names are showed). More often
import lays in one section so be very attentive please.
There are some records in the file replace.ini according to which you
should replace some functions in the import list. The matter is that
e.g if you call GetProcAddress(GetModuleHandle("kernel32" ),
"HeapFree" ), your system will return the address in ntdll.dll and it
will be the address of api-function RtlFreeHeap. I have added in this
list the api I met earlier. If you will notice some records from
ntdll.dll in the list of import, try to find the replacement for them
in your system. If it will be impossible, simply try to remove them.
In the Quick Unpack there is the opportunity of marking possible
invalid records is added, for their removing please press the button
"Delete invalid".
The license and rights
----------------------
The list of sources used in coding Quick Unpack 1.0.
GenOEP.dll by Snaker
ImpREC.dll by MackT
stripper 2.11 b3 / asprotect unpacker by syd
History of the versions
-----------------------
v1.0 [+] the opportunity of unpacking dlls
[+] the Opportunity of using plug-ins and own OEP finders is added.
down:
http://ahprotect.ahteam.org/Quick.Unpack1....eta3.public.rar
