Unpackers/decrypters/unprotectors

Generic/universal unpackers/dumpers

ProcDump by G-RoM, Lorian and Stone. 18.I.2000.
ProcDump32 1.6.2 (161K). Torn@do's Procdump Site. ProcDump scripting for dummies by COKiNE. Updated ProcDump script (2K).

News:
- Updated Task/Mod init code to run correctly under NT2K.
- Fixed up an obvious bug that avoided to snapshot modules correctly ! Thanx to Elicz for spotting this.
- Added Aspack 2000 support.
- Updated ProcDump user manual, Unpack.txt, history.txt.

- Dump to disk a running process & fix it so that u can discompile it.
- Dump to disk a part of any process.
- Dump to disk a module & fix it for analyzis.
- Unpack a given PE file using Wellknown strategy OR using an universal analyzis.
- Rebuild a Dump you made with SoftICE + dumper in a regular PE file.
- Edit the PE header datas, remove sections, Change PE directory infos, import and export sections from PE file.
- Kill a running process.
- Able to unpack/decrypt: BJFNt, ENC, Activision Packer, Manolo, NeoLite, Petite, Securom, VBOX , Shrinker 3.2&3.3, WWPACK32, ASPACK, PE-PROT 0.9 and many more...

Win32 Intro by Vitaly Evseenko. 21.IX.1999.
Win32 Intro v0.71 (26K).

Win32Intro is a generic executable unpacker/dumper. It can unpack compacted or encrypted Win32 executable files without knowledge about their compressor and without any need of debugger. It also unpack files that includes some anti-debugging traps (for instance, use of int 03).

Related links:
- UN-PACK.

Unpackers for freeware packers/protectors

PE-Shield.

UNPE-SHiELD by G-RoM. 1.VI.1999.
UNPE-SHiELD v0.14 (20K).

UNPE-SHiELD is a program, which decrypts 32-bit Windows EXE files "protected" by PE-Shield. The version supported are the 0.1á, 0.1b, 0.1c and 0.1d.

PESHiELD 0.2b2 unpacker by Unknown One. 16.XI.2000.
PESHiELD 0.2b & 0.2b2 Unpacker 2.0 (93K).

PESHiELD v0.2b & 0.2b2 specificied unpacker. Included source.

UnPeShield by Iczelion. 22.VIII.2000.
UnPeShield 1.1 (9K).

News:
- Added checking routine for multiple encrypted files.

This unpacker is written in win32asm, for use with PEShield version 0.25 only. Full Win32Asm source code included.

CodeCrypt.

de-CodeCrypt by xOANINO. 10.V.2000.
de-CodeCrypt 0.164b (61K).

Full ASM source included. The resulting rebuilded exe is 100% like the original one.

un-CodeCrypt by totnak. 02.IV.2000.
un-CodeCrypt 0.163 (4K).

Unpacker for CodeCrypt v0.163 beta. Included full NASM source.

Others.

UnPEPack by M.o.D. 21.IX.2000.
UnPEPack 1.0 (137K).

UnPEPack is a unpacker for files compressed with PE-Pack.

Bye PE-Crypt by Iczelion & Plushmm. 22.I.1999.
Bye PE-Crypt v1.02 fixed (16K).

The ultimate unpacker for PE-Crypt 1.02. Can decrypt any files encrypted by PE-Crypt 1.02, including DLLs. Coded entirely in win32asm by Iczelion & Plushmm.

PEUNLOCK-NT *aLL VERSIONS* by xOANINO. 22.I.1999.
PEUNLOCK-NT *aLL VERSIONS* (39K).

- All known PELOCK-NT versions supported : v2.01, v2.02b, v2.03, v2.04.
- Full original PE (EXE/DLL) rebuild, 99% accuracy in the rebuild process.
- Multiple layers support : automatically detect how many layers of PELOCK-NT are applied to the file, and decrypt all in one shot.
- Decrease file size removing unnecessary section (PELOCKnt), removing it from the object table too.
- Full source included.

UnPEProt by Lorian. 23.I.1999.
UnPEProt v0.9 (19K).

If you should ever face in reallife with this stupid crap calling itself a PE protector this little handy unpacker will save you the 1 minute you spend on doing a manual unpack.
BTW: this unpacker like PE-PROT itself does only run under win9x

UNPCPECa by Prophecy. 24.VI.1999.
UNPCPECa (13K).

UNPCPECa will decrypt any PE executable/dll which has been encrypted with PCPEC "alpha - preview" or PCPECa for short. PCPEC stands for Phrozen Crew PE enCrypter. It is a passive decrypter, it does not require the executable/dll to be loaded.

tEunlock by r!sc & DAEMON. 06.X.2000.
tEunlock 1.0 (18K).

-Kills the Telock section & almost rebuilds resource section
-Support for the following versions v0.41b, v0.41c and v0.42
- Source code included.

unNFO by Dulek. 17.V.2000.
unNFO 1.0 (5K).

unNFO is a program, which decrypts any PE executable files encrypted by NFO v1.0.

DeX by Chafe. 29.X.2000.
DeX 0.99 (168K).

Decompressor for PeX v0.99. DeX is able to reconstruct most parts of the header and sectiontable. Flags cannot be restored and sectionnames are only guessed, but the output is possible to execute and disassemble. Included source.

NoodleKiller by Unknown One. 07.XII.2000.
NoodleKiller 1.0 (7K).

Includes source code.

UnVGCrypt by LuTiN NoIR. 15.X.2000.
UnVGCrypt 0.1 (19K).

UnVGCrypt is a little VGCrypt decryptor, i wrote during one afternoon ... so for thus who want to learn unpackers/uncryptors i believe it is a good approach. Included ASM sources.

Unpackers for commercial packers/protectors

Shrinker.

DeShrink by [j0b]. 12.II.2000.
DeShrink 1.6 (189K).

News:
- DLL is discontinued for now.
- Shrinker 3.4 files are now unshrinked fine again.
- Missing resources in unpacked files are now copied from original file (will fix the problem of unpacked files showing no main icon or crashing on execution.
- Autodetection for Shrinker 3.4 now included (the Checkbox remains clickable though to prevent this feature becoming a way to overcome deshrink. =)

DeShrink is a tool to unpack Files compressed with the all so popular Shrinker done by Blink Inc.

UnShrinker by Andrew Shipinsky. 12.I.1999.
UnShrinker (36K).

Decompress shrinked files with Shrinker 3.2/3.3.

Ned by snajder. 19.I.2000.
Ned 2.3 (8K).

News:
- Bugs fixed.

NED is deshrinker for SHRINKER 3.xx compressed files(NE-Visual Basic 3.0). I made it 'cause all other similar programs doesn't support NEs. This is is the first public release of NED. It works with NE VB 3.0 files ONLY!!!

ASPack.

un-ASPack by dtg. 26.VIII.1999.
un-ASPack v1.0 (26K).

Unpacks ASPack 1.02b, 1.07b, 1.08.00/1/2/3. Included full asm source.

UnAspack by Bi Wei Guo. 13.VI.2000.
UnAspack 1.0.9.1 (73K).

News:
- support another version of ASPack 2.1.

Very good unpacker for ASPack. With GUI.

Anti-Aspack by LuTiN NoIR. 17.XI.2000.
Anti-Aspack 0.2 (39K).

This is a small Aspack unpacker. It currently works on files protected with Aspack v2.11 only. It works only under w9x because I use ring0 mode to let the loader decrypts himself. Source included.

PECompact.

PEunCompact by Chafe. 10.X.1999.
PEunCompact v0.01 (28K).

This is an unpacker for programs packed by a program called PECompact. It has only been tried with programs compressed using PECompact v0.971b, so I don't know if it works with others as well.

tNO-Peunc by aK_ of tNO. 21.V.2000.
tNO-Peunc v1.5 (15K).

News:
- Recoded some portions of code
- Added support upto PE-Compact 1.30

tNO-Peunc is an Unpacker for PE-Compacted files and will create 100 % working and "disassembleable" unpacked Versions of the packed PE-Files in its final Release.

UnPECompact by yoda. 22.IX.2000.
UnPECompact 1.2 (69K).

News:
- "optimize file size" option.
- UnPECompact.exe works now sometimes on win NT/2k.
- UnPECompact was successfully tested under win ME.

UnPECompact is an Unpacker for exe files which have been compressed with PECompact. It should unpack all PECompact versions. Source code included.

ASProtect.

Asprotect Deprotector by r!sc. 22.X.2000.
r!sc's Asprotect Deprotector 0.6 (32K).

rAD is a little asprotect decryptor/unpacker. It currently works on files protected with asprotect v1.1 only. Source code included.

Anti Aspr by LuTiN NoIR/TeeJi. 04.IX.2000.
Anti Aspr 1.0 (20K).

This program is intended to obtain a functional dump programs protected with Asprotect. It removes the anti-debugger as well as the destruction of the import table. It also recovers new eip and makes indefinitely loop the prog on it even in memory. Then a dumper and a rebuilder (modified) deal with creating a dump.

CASPR by SAC. 23.XI.2000.
CASPR 0.952 (65K).

News:
- support another ASProtect versions

- Support ASProtect v1.0 - v1.1.
- Own decryption and decompression code.
- Import table rebuilding engine.
- Export table rebuilding engine.
- API hook technic.
- Win32(Win9x,WinMe,WinNT and Win2k) compatible.

Armadillo.

Un-Armadillo by therain. 21.VIII.2000.
Un-Armadillo v1.4 (46K).

News:
- Suppor Armadillo 1.83.
- No more NT/2000 support.

Un-Armadillio is a program used to remove Armadillioing in programs.

Armadillo Killer by ArmKiller. 11.XI.2000.
Armadillo Killer 1.1 (20K).

Deprotector for Armadillo 1.7x - 1.8x.

DBPe.

undbpe by tender. 19.IX.1999.
undbpe 1.2 (1K).

Remover for dbpe (aka phantasm 1.2).

UnDBPE by totnak. 10.IX.2000.
UnDBPE 1.5 (3K).

remover for dbpe (ding boy pe lock) v1.50.

CD.

C.u.Dilla by r!SC. 02.XI.1999.
C.u.Dilla r1 final (17K).

Safedisk/C-dilla unwrapper / decryptor.. Runs on WIN9x ONLY!
It runs the process, hooks into it, fixes it, dumps it, then fully rebuilds it, all with one click of a button. it works on CDilla from april '99 to the present day.. (oct'99).
Tested with lots of games including Tiberian sun v1.08/v1.13, Driver, Prince of Persia 3D, Rainbow Six Rouge Spear, Roller Coaster Tycoon...

unSafedisc by r!SC. 26.IX.2000.
unSafedisc 1.55 (14K).

News:
- corrected crc bug.

A tool to deprotect SafeDisc copy protection.

Safedisc Annihilator by ArthaXerxes. 01.XI.2000.
Safedisc Annihilator 1.1.

Safedisc Annihilator is a generic Safedisc crack. It will allow you to run the program without the original CD inserted. Sometimes, you may even be able to run the program without any CD inserted at all, this depends on the target (i.e. some programs ask for the CD, some not).

Others.

PCGuard Decryptor by da DAEMON. 24.X.2000.
PCGuard Decryptor 0.7 (21K).

- decrypts each section that got encrypted
- kills 100% of the pcgw code
- it has got support for these versions: 2.10d, 3.00d, 3.02d, 3.03d (shareware versions).
- also tries to rename the section names back to their original ones

Petite enlarger by r!sc. 11.IX.2000.
Petite enlarger 1.3 (37K).

News:
- recoded commandline parser.

Emulates how petite unpacks the program into its own address space, then rebuilds the file in a buffer and dumps to disk. Included source code.

eLicense VTCyberPack Unwrapper by MAK & EinZtein. 23.XI.2000.
eLicense VTCyberPack Unwrapper 1.0 (155K).

It traces the entrypoint of your target eLicense VTCyberpack-Protected application, dumps it, rebuilds the imports, and corrects the PE-Header. You are now free from whatever limit, eLicense VTCyberpack might have caused, and you are free to patch the target application in any way you like.

DeSoftSentry by Cyber Daemon. 27.IX.2000.
DeSoftSentry 0.5 (59K).

Unpacker for SoftSentry 3.0. Included version for 9x, NT and source.

VBOX Unwrapper by MKEZ Productions. 25.IX.2000.
VBOX Unwrapper 1.3 (244K).

It traces the entrypoint of your target VBOX-Protected application, dumps it, rebuilds the imports, and corrects the PE-Header. You are now free from whatever limit, VBOX might have caused, and you are free to patch the target application in any way you like.

WKT_tElock_Dumper by Gadix/MrOcean. 27.X.2001.
WKT_tElock_Dumper 1.2 (10K).

News:
- support for telock 0.95, 0.96 & 0.98.
- support MUTEX & CMS protection.

GENERIC_WKT_tElock_Dumper can be to unwrap all tElock versions since 0.60 (with some few modifications you can make it for ALL versions). Probably works with many "no public versions".

Ni2Untelock by Ni2. 31.XII.2000.
Ni2Untelock Suite 0.71b (62K).

Unpacker for tElock 0.61 and upper. With source codes.

PeDiminisher Unpacker by LaptoniC. 14.IV.2002.
PeDiminisher Unpacker v1.0 (35K).

These are two unpackers for PeDiminisher with different approaches.