                                      
                                          
                               
                                     
                               

                                     v2.3

                 PESHiELD 0.1d, 0.2b, 0.2b2 and 0.25 unpacker

Intro
~~~~~

This is unpacker for the famous and one of the best protectors for it's time
called PESHiELD versions 0.1d, 0.2b, 0.2b2 and 0.25.  The files that are
encrypted by these versions of the protector are automaticaly decrypted.

What's new
~~~~~~~~~~
v2.3
- added support for PESHiELD v0.1d (really harder to make decryptor than
  all other protectors I messed with - this is my first decryptor for
  polymorph layer). As I said, the decryptor for PESHiELD layer is mutated
  and it is polymorph one. The weak attack point is that it doesn't use
  the junk/garbage instructions to change decryption key (ANAKiN only uses
  constant values and the counter).

v2.2 (unreleased to public)
- added support for PESHiELD v0.25 (Iczelion's unpacker has same probs
  as I had before in decrypting twice encrypted w32dasm.exe so I simply
  added the support to mine with few changes only. Greetings to Iczelion!)

v2.1 (unreleased to public)
- displaying of information about unpacking process
- coded relocations decompression (still not written in output file)

v2.0
- now it is win32asm version
- file size limit does not exist anymore
- nice looking GUI added (thanks tARG0N/[cRO] for the gfx :)
- added support for PESHiELD 0.2b
- PE file checksum calculation (credits to tE! for his sources)

v1.0
- it is DOS version of PESHiELD 0.2b2 unpacker
- support for files smaller than 60KB

Usage
~~~~~
Using the unpacker is really easy (who does not know how to use GUI? ;):
- select the file to unpack
- press Unpack button and there is created OUT.EXE file which is the decrypted
  EXE file

Multiple encryption layers are supported and decrypted automaticaly. There are
available few options that affect decrypting process:

- Confirm multiple layers - asks to continue decrypting when finish current
  layer. It can be used for studying the PESHiELD code or when the unpacker
  cannot recognize and decrypt an unknown/patched/cracked PESHiELD version.

- Recalculate PE checksum - this options uses a procedure written by tHE
  EGOiSTE that calculate the new PE checksum and writes it in PE header.
  The checksum is unused in Win9x systems but it is used on drivers that
  run on WinNT and Win2000 (that's what I know of). Most linkers left this
  checksum to zero. This PE header manipulation can cause problems because
  PESHiELD layer can use heuristic antivirus checks which include PE header
  and object table (sections headers) and if another PESHiELD layer left
  (using Confirm multiple layers option or just unsupported version) then
  the file may stop running (the protector will stop execution due to false
  alarm).

- Change code section flags - when you want to get working disassembleable
  file (at least for w32dasm) you can change code section flags to make that
  possible. Again this can cause problems running the file if there left
  another PESHiELD layer with turned ON heuristic antivirus checks.


To do
~~~~~
- rebuilding the resources allowing to remove the PESHiELD layer(s) from file
- heuristic section rename
- adding support for other PESHiELD versions (if anyone has unsupported
  by this unpacker versions, please mail them to: unknone@mail.com)
- creating .DLL with exported unpacker procedure (guess why ;)

Greetings
~~~~~~~~~
Everyone :)

Special greetings
~~~~~~~~~~~~~~~~~
ANAKiN, Iczelion, tHE EGOiSTE, totnak, VAG, r!sc, Daemon 

Contacts
~~~~~~~~
You can reach me via e-mail (unknone@mail.com) or via IRC (EFNet, #win32asm
and #UG2000).

Best regards,
Unknown One/[TMG]
