GENERIC / MULTIPLE UNPACKERS

 

 

GENERIC UNPACKER WIN32 1.0 BETA8 01.08.2001 CHRISTOPH GABLER / UG2001

GUW32 is a generic unpacker for packed / crypted WIN32PE files. The purpose of this little utility is to genericly and automatically unpack all kind of protections from portable executable files. The main idea behind GUW32 is to handle this type of encryption without knowing anything of the cryptors themselves, such as the used algorithm. Features include Ring0 tracers, Ring3 traces, Trapflags , Single stepping , Import rebuilding ( using MackT's ImpREC ) and even packer detections. Win32ASM sources are included as the project is open source. This is the first public release.

 

PROCDUMP 1.62 FINAL RELEASE 03.06.2000 LORIAN + G-ROM + STONE

ProcDump is brand new type of tool that allows u to Dump, Unpack some Protected PE files without any need of debugger. What ProcDump can do : Dump any 32 bits running process/module by using the CodeShot engine. Phoenix engine can restore the Import table & PE header. Phoenix engine can reoptimize a PE file and Dump made with CodeShot. Shiva engine can start & unpack a given PE file (at least it tries !!). With the help of script language, u can unpack in a few secs well-known packers and learn to ProcDump how to unpack the others. Alter a given file PE header, kill some object physically. Bhrama server can wait a client send a PID to dump : Client tell to ProcDump when it is good to dump ;). This version contains the Script Update.

 

QUICKDUMP 1.0 03.06.2000 DEFILER

QuickDump is an easy to use memory dumper.

 

WIN32INTRO 0.71 03.06.2000 VITALY EVSEENKO

Win32Intro is a generic executable unpacker/dumper. It can unpack compacted or encrypted Win32 executable files without knowledge about their compressor and without any need of debugger. It also unpack files that includes some anti-debugging traps (for instance, use of int 03).

 

UCFCUP 386 / CYBERWARE UNIVERSAL UNPACKER 3.4 FINAL 03.06.2000 SAGE / CYBERWARE , UNITED CRACKING FORCE

CyberWare Universal Unpacker unpacks old MS-DOS executable files processed with *ANY* EXE- or COM- file packer (cryptor or protector), thus making them easy for further analyzing, hacking or reverse engineering.

 

UN-PACK 2.2 ( GUI 1.21 ) 16.09.2001 SNOW PANTHER / UG2001

This is a File Identifier / Unpacker by Snow Panther. Designed for unpack specially , Identifies most COM/EXE compilers/cryptors/packers/protectors, MZ/ELF/LE/LX/NE/PE headers support , Full executable files analyzing , The best extensions database (more than 1060 ...) , Internal COM dumper and tracer , Support for TEU unpacker , Built-in API functions for unpackers , 3 types of file detection , The most powerful file analyzer available today!

New Features : New detections, GUW32 support, Bugfixes

 

UNPACKER 2.5.2 28.09.2000 NEX

With this program you can unpack (not uncompress) some type of packed files, so called Fastfiles . The files supported are PAK , GOB , ZFS , ZWB & WDT.

 

VOLKT 2.0 07.10.2000 NUMIT_OR

This is a generic unpacker for DLL , OCX & VXD files . The dumped file will not work if you don't set the true entry point of the program in the PE header.

 

 

SPECIFIC UNPACKERS

 

 

ANTI-ASPACK 0.2 01.09.2000 LUTIN-NOIR

This is a small ASPack unpacker. It currently works on files protected with ASPack v2. 11 only. It works only under WIN9X.

 

ANTI-PACE UNIVERSAL TOOL 3.0R1 31.07.2001 J@KER / ZONE

Anti-Pace Universal is a unpacker/decrypter for PACE's Anti-Piracy Interlok protected files. The resulting rebuilded output file, is 99% like the original one.

 

ARMADILLO DEPROTECTOR 1.1 17.02.2001 THE_ANALYST

It is an unpacker to unprotect files that has been protected by Armadillo, version up to 1.90. If the file is protected with the new versions of Armadillo, it requires you to modify the EP to the OEP using SICE

 

ARMADILLO KILLER 1.3 ( 2.01 BETA ) 13.08.2001 ARMKILLER

This is a deprotector for Armadillo 1.7x - 2.0x. It even supports the new CopyMem protection in Armadillo.

New Features : Added support for versions 2.0x

 

AS-ANTIPROTECT 0.98 BETA 30.01.2001 VAG / UNPACKING GODS

Finally this famed ASProtect unpacker makes it out to the public as a beta. It's been in development for a long time. This program uses sophiscated unpacking algorithm, has nice and comprenshive GUI and works much better than other ASProtect unpackers out ;) . It allows you to browse and edit most of protection paramethers and partially of fully remove protection from files.

 

ASPACKDIE 1.1 03.03.2001 YODA / F2F

This is a small unpacker for files compressed by ASPack 2.11. Full source code included.

New Features : Added support for 2.11c and 2.11d

 

BYE-PECRYPT 1.02 03.06.2000 ICZELION + PLUSHMM

The ultimate unpacker for PE-Crypt 1.02. Can decrypt any files encrypted by PE-Crypt 1.02, including DLLs. Coded entirely in win32asm by Iczelion & Plushmm.

 

CASPR 1.100 BETA ( 1.012 ) ( CASPR GUI ) 25.06.2001 SAC / UNPACKING GODS

CASPR is a cool unpacker for ASProducts . Features include Support ASProtect v1.0 - v1.2x , ASPack 1.0b - 2.11x , Own decryption and decompression code , Import table rebuilding engine , Export table rebuilding engine , API hook technic , Win32 (Win9x,WinMe,WinNT and Win2k) compatible. No GUI.

New Features : Support for one many old and new ASProtect versions , Support for four other ASPack versions , Option for Overlays , Export Table Rebuilding engine , New commandline parameter *-s* , Minor bug fixes.

 

COPYLOK REMOVER 1.0 07.04.2001 LOCKSMITH

CopyLok remover is a tool that is aimed to remove the copy protection system from PanLok used as CD protection on a few games. Without saying that this protection is annoying for backuping CD, it's even annoying if you plan to run it under NT where the original game could work without sometimes.

 

C.U.DILLA RELEASE 1 FINAL 03.06.2000 R!SC

Safedisk/C-dilla unwrapper / decryptor.. Runs on WIN9x ONLY! It runs the process, hooks into it, fixes it, dumps it, then fully rebuilds it, all with one click of a button. it works on CDilla from april '99 to the present day.. (oct'99). Tested with lots of games including Tiberian sun v1.08/v1.13, Driver, Prince of Persia 3D, Rainbow Six Rouge Spear, Roller Coaster Tycoon...

 

DAEMON'S PC GUARD DECRYPTOR 0.7 24.10.2000 CYBER DAEMON / UG2000

A decryptor for files processed with PC Guard 3.03d . Features include decryption of each section that got encrypted and complete removal ( not always ) of pcgw code .

New Features : Added two msg-boxes (fixed bug) , Added support for version 3.02d of pcguard32 , Kills now really 100% of pcgw code , No need anymore to remove the attributes of licence file , Section name fixer added .

 

DEASPACK 2.11 18.12.2000 UNKNOWN ONE / TMG

This is a little program to decrypt the polymorph layer of the ASPack 2.11 packed files and decompress them. No resources rebuilding is done so the ASPack section will be kept in the output file to make the file run OK (not giving error while loading icon resource) and first icon group and version info will be available too.

 

DECODECRYPT 0.164 B 03.06.2000 XOANINO

Full ASM source included. The resulting rebuilded exe is 100% like the original one.

 

DE-CRUNCH 1.1 25.02.2001 DAEMON / UG2001

This is a little unpacker for the *most* powerful PE-Compressor Bit-Arts Crunch. The current version supports Crunch 1.2 and Crunch 2.0

 

DECRUNCHIT 1.0B 14.04.2001 LIXUS / REFORM

This is an unpacker for Crunch V2 Build 2.0.0.2 which can unpack EXE/OCX/DLL/SCR files.

 

DENOODLECRYPT 2 07.12.2000 DAEMON / UG2000

Unpacker for NoodleCrypt Version 2.It works by settting two "breakpoints", executes the code till it jumps back to host, then import table is getting decrypted + injected and afterwards its getting dumped to disk.

 

DE-PEPACK 1.2 10.07.2001 UNKNOWN ONE / TMG

This is unpacker for executable files compressed with PE-PACK versions 0.99 and 1.0. It does pure ungeneric decompressing of the file. Full source code is included. There are some other unpackers (including ProcDump), but they failed on some files I tested them with so there comes this pure ungeneric decompressor.

New Features : Changed the depack algo from APLiB to ones ripped from both supported versions to correctly unpack even more files.

 

DE-PEPROT 0.9 BETA 02.03.2001 UNKNOWN ONE / TMG

This is ungeneric unpacker for files protected with PE-PROTECT 0.9 beta by CHRiSTOPH GABLER. There is another unpacker written by Lorian/uCF but it is only Win9x compatible and now you can decrypt PE-PROTECTed files on WinNT/2k too. PE-PROT does not crypt resources section so no rebuilding is needed and it's section is removed from the file (correct image size is set in the PE header to let the file load on WinNT/2k). Full win32 assembler source code is included.

 

DESHRINK 1.6 03.06.2000 [J0B]

DeShrink is a tool to unpack Files compressed with the all so popular Shrinker done by Blink Inc.

Features : DLL is discontinued for now. - Shrinker 3.4 files are now unshrinked fine again. - Missing resources in unpacked files are now copied from original file (will fix the problem of unpacked files showing no main icon or crashing on execution. - Autodetection for Shrinker 3.4 now included (the Checkbox remains clickable though to prevent this feature becoming a way to overcome deshrink.

 

DE-SOFTSENTRY 0.5 12.09.2000 CYBER DAEMON / UG2000

This is a tool to unpack files protected with Soft-Sentry 3.0 . You need to enter the EOP of the unpacked executable and the program will do the rest for you. New Features : Added the bruteforce option... very useful for the lamers out there :) hehe , Rewritten/improved some shit , Improved error checking , Release source code (tidying up the code+commenting most parts).

 

DE-VISUAL PROTECT 2.57 11.05.2001 +DZA / TNT!

This is unpacker for files wich got protected by Visual Protect v2.57. iT Will work even the files have expired ;). It was coded 100% in win32asm and it's open-source. Sources included.

 

DEX 0.99 30.10.2000 CHAFE

DeX is able to reconstruct most parts of the header and sectiontable. Flags cannot be restored and sectionnames are only guessed, but the output is possible to execute and disassemble.

 

DE-YODA'S CRYPTOR 1.0 21.12.2000 UNKNOWN ONE / TMG

This is a little ungeneric decryptor for files protected with Yoda's Crypter 1.0.

 

DE-YODA'S CRYPTER 1.2 21.02.2001 C-RIPPER

This is a decryptor for files protected with yoda's crypter v1.2.

 

ELICENSE CYBERPACK UNWRAPPER 1.0 25.11.2000 EINZTEIN + MAK / UNITED CRACKING FORCE

This UCF tool traces the entrypoint of your target eLicense VTCyberpack-Protected application, dumps it, rebuilds the imports, and corrects the PE-Header. You are now free from whatever limit, eLicense VTCyberpack might have caused, and you are free to patch the target application in any way you like. This tool will only work with Windows 2000.

 

FOXDEC 1.07 08.10.2000 GLASHA GENERAL SOFTWARE

This is a nice utility to decrypt FoxPro and Visual FoxPro files . The program creates a decrypted version of the encrypted program & writes it on the disk . This decrypted code is completely executable.

 

GUARDANT PE ENVELOPE REMOVER 0.5 22.07.2001 SNOW PANTHER / UG2001

This is a simple unpacker for the Guardant Dongle PE envelope.

New Features : Bugfix for constant section size , New Logo.

 

NED 2.31 07.08.2001 SNAJDER

NED is deshrinker for SHRINKER 3.xx compressed files(NE-Visual Basic 3.0). I made it 'cause all other similar programs doesn't support NEs. This is is the first public release of NED. It works with NE VB 3.0 files ONLY!!!

New Features : Fixed bug that was occuring if some of the segments wasn't compressed.

 

NI2UNTELOCK71B ( COMPLETE SET ) 02.01.2001 NI2 LABS

This is the complete set of unpackers for TELock from 0.61 to 0.71 viz 0.61 , 0.70, 0.71 and 0.71b. This suite also has a TELock version detector!

New Features : Added support for TELock 0.71B.

 

NOODLE KILLER 1.0 08.12.2000 UNKNOWN ONE / TMG

This is a decrypter for for files crypted with NoodleCrypt 2. It does pure ungeneric decrypting of the NoodleCrypt layer.

 

PEUNLOCKNT ( ALL VERSIONS ) 03.06.2000 XOANINO

All known PELOCK-NT versions supported : v2.01, v2.02b, v2.03, v2.04 (send me others if u have, but i think there's no other versions around) - Full original PE (EXE/DLL) rebuild, 99% accuracy in the rebuild process. Output file is 100% the same with the only difference of : - section names if PELOCKNT was used without the -N switch - section characteristics (crypted objects flags are changed to WRITE) - for DLLs, PE characteristics is changed and i havent found a way to set it back to original - Multiple layers support : automatically detect how many layers of PELOCK-NT are applied to the file, and decrypt all in one shot. Multiple layers of different versions (ex: v2.04 above v2.01 above v2.03 etc....9 are supported too. - Decrease file size removing unnecessary section (PELOCKnt), removing it from the object table too. - Full source included.

 

PE-ENCRYPTOR REMOPVER 1.3 03.06.2000 ANAKIN

A fine unpacker by ANAKIN for Stone's PE-ENCRYPTOR.

 

POXYLOKV 1.3B 21.06.2001 R!SC

This is a decryptor type thing for every known version of Codelok / Copylok , the commercial CD copy protection.

 

R!SC'S ASPROTECT DEPROTECTOR ( rAD ) 0.6 23.10.2000 R!SC

Here it is...a decryptor for ASProtect 1.1 by r!SC . It currently unpacks files packed with ASProtect 1.1 and it does it's job damn good.

New Features : Updated data_dump.txt , Little bug fix for rsrc sections's raw size . This version does not work on Win 2K .

 

R!SC'S PETITE 2.0 / 2.1 ENLARGER 1.3 09.09.2000 R!SC

Unpacker for files packed with Petite 2.2/2.1 . Source Codes included .

New Features : Recoded commandline parser (hopefully some NT users can open files now :)

 

SAFEDISC ANNHILATOR 1.1 22.10.2000 ARTHAXERXES

A program to remove SafeDisc protection .

 

SALESUNAGENT 0.1 08.09.2000 PREDATOR / PC

A generic unlocking program for applications "protected" with the SalesAgent wrapper. The executable is unpacked making it work like an unprotected one . Guided unpacking procedure...

 

SOFTUNLOCX 1.0 29.03.2001 DAEMON / UG2001

This is an unpacker for files protected with SoftLocx 5.0.1 by Bit-Arts. It also works with quite a few releases of the protector!

 

STOPICE 1.0 DEPROTECTOR 2.0 25.08.2001 B0RD3N / TEAM EMBRACE

This patch will enable you to run Delphi 2/3/4/5 applications which are using StopIce v1.0 when SoftIce is loaded. Generally StopIce reboots the computer if it detects Softce to be loaded. This patch removes this problem for all your debugging needs.

New Features : Interface changed.

 

TEUNLOCK 1.0 05.10.2000 R!SC + DAEMON

Unpacker for all versions of TELOCK featuring killing the Telock section & almost rebuilding resource section and support for the versions v0.41b, v0.41c and v0.42.

 

THE BIT-ARTS SOLUTION 1.2 08.06.2001 DAEMON / UG2001

An all in one soultion for all Bit-Arts range of products which include support for support for Trial Wrap v5.1 build 5.1.0.0 , Softlocx v5.0.1 (SME) , Softlocx v5 SDK build 5.0.0.6 , Softlocx v4 IDE build 2.0.1 and some other versions + Crunch 1.0 , Crunch 1.2 and Crunch 2.0.

 

TNO-PEUNC 1.5 03.06.2000 AK_ / TNO

tNO-Peunc is an Unpacker for PE-Compacted files and will create 100 % working and "disassembleable" unpacked Versions of the packed PE-Files in its final Release.Support for upto Vesrion 1.30.

 

UNARMADILLO 1.40 ( 1.30 ) 21.08.2000 THERAIN

Un-Armadillio is a program used to remove Armadillioing in programs.Supports Version 1.83 .

New Features : No more NT/2000 Support.

 

UNASPACK 1.0.9.1 12.06.2000 BI WEI GUO

Very good unpacker for ASPack. With GUI.Supports upto ASPack version 2.1 .

New Features : Added a new version of ASPack 2.1 .

 

UNASPACK WIN32DASM FIX 05.07.2000 ©ONT®OL / INCORPORATED

This is kind of a useless tool ;0)...All it does is that it fixes the problem due to which the unaspacked files do not disassemble specially under W32Dasm...Instead you'll now get an error and the file should disassemble without memory and string references.....Thats about it.

 

UNASPACK 1.0.1A 02.04.2001 YONGPEN YOU

This is a small unpacker for files packed with ASPack 2.11, 2.11c and 2.11d.

 

UNASPR 1.0 01.09.2000 LUTIN NOIR + TEEJI

Yes !!!! It's finally here..An unpacker for ASProtect . Guess it'll save a lot of you a lot of time . It's not perfect but it does it's job more often than not . It could unpack ASPack 2.1 and Awave 7.0 but failed to unpack ASProtect 1.0 . You might have some problems with the documentation as it's in French but let's not take any credits away from the author . Source codes included.

 

UNBJFNT 1.3 12.08.2000 BANE
It is an unpacker for files packed with .BJFNT Version 1.3 by Bane.

 

UNDBPE 1.2 03.06.2000 TENDER

Remover for dbpe (aka phantasm 1.2).

 

UNDBPE 1.5 11.09.2000 TOTNAK

Remover for dbpe (ding boy pe lock) v1.50.

 

UNIVERSAL FLASH UNPROTECTOR 3.0 09.10.2000 ©ONT®OL / INCORPORATED

This is an unprotector for all Flash Player Movies that were saved with the " PROTECT FROM IMPORT " option on.It allows you to import and edit the movies in Flash/Director again . It features compltete support for movies exported from Flash 2.0,3.0,4.0 and 5.0 .

New Features : Support for Flash 5.0.

 

UNLOCX 5 09.12.2000 CHAFE

This program decrypts, decompresses, restores mutated code and finally rebuilds the Softlocx'ed program to a executeable state. If the locked program uses Softlocx's feature of unlock-levels, Unlocx is able to append a small loader that sets the needed environment-variable.

 

UNNFO 1.0 03.06.2000 DULEK

unNFO is a program, which decrypts any PE executable files encrypted by NFO v1.0 .

 

VISUAL PROTECT UNWRAPPER 15.04.2001 MKEZ PRODUCTIONS / UCF

This is an unwrapper for files protected with Visual Protect 2.5.3. It works under WIN2K only though.

 

UNPCPECA 03.06.2000 PHROPHECY
UNPCPECa will decrypt any PE executable/dll which has been encrypted with PCPEC "alpha - preview" or PCPECa for short. PCPEC stands for Phrozen Crew PE enCrypter. It is a passive decrypter, it does not require the executable/dll to be loaded.

 

UNPECOMPACT 1.32 02.01.2001 YODA / F2F

UnPECompact is an Unpacker for exe files which have been compressed with one of the new PECompact version (1.32-1.40 beta6). It's not very fast and it can only rebuild files full if they have an OriginalFirstThunk :( . Source Codes included. New Features : Now one can optionally optimize the filesize , UnPECompact.exe works now sometimes on Win NT/2k , UnPECompact was successfully tested under Win ME.

New Features : support for another PEC version (1.23 or 1.24) added , New option of"Force full IAT rebuilding" , Reorganized some internal things.

 

UNPENIGHTMARE 1.3 11.06.2001 REDRAGON / UG2001

This is a DOS single decryptor for files encrypted with PE-Nightmare 1.3 ( included in the package ). Source codes included.

 

UNPEPACK 1.0 22.09.2000 YODA / F2F

UnPEPack is a unpacker for files compressed with PE-Pack. The Rebuilder is sometimes slow - the rebuilding can then take up to some minutes :(

 

UNPEPROT 0.9 03.06.2000 LORIAN

If you should ever face in reallife with this stupid crap calling itself a PE protector this little handy unpacker will save you the 1 minute you spend on doing a manual unpack. BTW: this unpacker like PE-PROT itself does only run under win9X.

 

UNPESHIELD 0.14 03.06.2000 G-ROM

UNPE-SHiELD is a program, which decrypts 32-bit Windows EXE files "protected" by PE-Shield. The version supported are the 0.1á, 0.1b, 0.1c and 0.1d.

 

UNPESHIELD 0.25 1.1 03.06.2000 ICZELION

This unpacker is written in win32asm, for use with PEShield version 0.25 only. Full Win32Asm source code included. New Features : Added checking routine for multiple encrypted files.

 

UNPESHIELD 2.4 31.03.2001 UNKNOWN ONE / TMG

This is unpacker for the famous and one of the best protectors for it's time called PESHiELD versions 0.1d, 0.2b, 0.2b2 and 0.25. The files that are encrypted by these versions of the protector are automaticaly decrypted.

New Features : added support for PESHiELD 0.1b and 0.1c versions and now every version of this protector I found on the web can be unpacked , Added option to clear (remove) the PESHiELD 0.1x layer from file which results in smaller size.

 

UNPESHIELD 0.2C2 1.0 27.10.2000 UNKNOWN ONE /TMG

Unpacker for files packed with PEShield 0.2C2. Support for files less than 60 KB .

 

UNSAFEDISC 1.5.5 26.09.2000 R!SC

unSafedisc is a tool to remove SAFEDISC Version 1 Copy Protection from windows executables.

New Features : the crimson fix, i messed up the crc_with_reloc code, and it seems it didnt get the correct crc for unreal tourny. Well, it worked with crimson, so i was happy, and didnt bother testing any other games.. tested now with crimson & ut and works fine. Could'nt leave 154 as the final because of this bug, so 155 is the final final version ever.

 

UNSAFEDISC 2.40.10 11.09.2001 R!SC

unSafedisc is a tool to remove SAFEDISC Version 2 Copy Protection from windows executables. This suite release includes the SafeCast 2.02.40 dumper and rebuilder.

New Features : Supports all SafeDisc v2 upto 2.40.10

 

UNTELOCK 1.0 02.03.2001 UNKNOWN ONE / TMG

This is a little unpacker for files protected with tELock 0.60 public version only. It successfully decrypts the tELock layer (even the polymorph one) and decrypt and decompress it. No resources rebuilding is done. Full source code is included.

 

UNVGCRYPT 0.1 17.10.2000 LUTIN NOIR
This is a little decryptor for files packed with VGCrypt 0.75 only . It directly decrypts the file and does not dump it .

 

UNWINGAMES 1.0 08.07.2001 [NTSC]

This is a simple unpacker for the WinGames Protection system.

 

UNXYDYNE 1.0 08.07.2001 [NTSC]

This is a simple unpacker for the XDyne protection system.

 

UN-YODA'S CRYPTER 0.9 12.02.2001 SNOOFY / AMOK

This is a decrypter for files packed with Yoda's Crypter version 1.2. It may not handle all files correctly though.

 

VBOLOCK GENERIC UNPACKER 2.3 27.07.2000 ©ONT®OL / INCORPORATED

This is a kind of unpacker/unprotector (actually it isnt) for any file protected with VBOLock ! It works with ANY file protected with ANY released version of the the VBOLock Protection System by MoonLight Software. It features support for VBOLock 2.2 , 2.1 , 2.0 , 1.1 and Intermediate Versions. The popup error that came up removed for some files but not all ;0) and even files that come up with the popup error are " unpacked " successfuly.Tested upto WebCrypt 1.1d released June 11, 2000.

New Features : Popup Error removed...??? ;0)

 

VBOX 4.3 GENERIC UNWRAPPER 1.3 03.11.2000 MKEZ PRODUCTIONS

This is a generic Unwrapper for VBOX 4.3 . It traces the entrypoint of your target VBOX-Protected application, dumps it, rebuilds the imports, and corrects the PE-Header.

 

VIPER'S SALESAGENT KILLER 1.0 14.09.2001 VIPER / K-FOR

This is a small SalesAgent unwrapper.

 

VISUAL DEPROTECTOR 1.0 23.12.2000 DAEMON / UG2000

This is an unpacker for Visual Protect. It currently supports versions 2.5.2, 2.5.3, 2.5.5 . It set 1 breakpoint, patches few things in memory and executes the program and dumps when the OEP is reached!