Unpacker for tELock 0.60 *PUBLIC version*
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

This is a little unpacker for files protected with tELock 0.60 public version
only. It successfully decrypts the tELock layer (even the polymorph one) and
decrypt and decompress it. No resources rebuilding is done. Full source code
is included.

Intro
~~~~~
tELock is one powerfull protector which implements many features that make the
protected file hard to be unpacked using debugger. These are the main features
(got them from tELock doc and some my comments are written in [] brackets)

- Decreases size of most executable files a lot while leaving them executable
- Support of .dll and .ocx files [haven't tested the unpacker with them]
- Protects your files against patching and disassembling [there are memory
  patchers that work OK with tELock-ed files and DeDe disassembles Delphi
  programs without any problem]
- PE - Optimization (Alignments, PE-Checksum, Relocs stripping ..) [very good
  features that most protectors do not implement]
- Shellintegration (context-menu: 'Open with tElock')
- Drag'n'drop capabilities
- Increased security by selfintegrity checks and several encrypted layers
  [non-polymorph ones, easy to defeat them with disassembler only!]
- Debugger Breakpoint detection on all API functions used by a compressed file
- Softice(tm) detections
- Debugger trace (singlestep) detections
- 'Frogsice' detection
- Unique: Easy-to-use Mutex checks [unpacker only decrypts but doesn't show
  the mutex name so you must implement it yourself]
- IAT redirection [good against old dumpers and rebuilders]
- Sections/Objects renaming [nice option to disable it :]
- Importtable encryption (tElock uses an own DLL loader) [very weak place
  against ungeneric unpacking because the import table is compressed in its
  original state and no rebuilding is needed]
- [Polymorph layer inside tELock layer which decrypts the code used to decrypt
  the sections. This code has a polymorph part too so it is a little bit hard
  to make ungeneric unpacker].
- [Anti-dump features that are WinNT and Win2k compatible - some dumpers are
  not affected because they read the original PE header from the file and not
  from memory]
- [No more lame fake/junk macros ;]

There is an unpacker for this nice protector. It works only with the public
version of tELock 0.60 put on several sites (www.suddendischarge.com,
protools.cjb.net, codersdomain.cjb.net) between 13 and 20 december 2000.
Probably there are other 0.60 public versions (the same as ASPack and
ASProtect versions;) and probably the unpacker will fail to decrypt them. It
is just a little example how to defeat some polymorph code and how to write
little unpackers.

Greetings
~~~~~~~~~
All greetings go to tHE EGOiSTE/TMG for his great protector. Good luck in your
life, Ego!
To all TMG members: Keep the good work! I'll be back!


Best regards,
Unknown One/[TMG]