PowerArchiver 2006

Khaosgott96 · Frequent poster Joined: 15 Aug 2005 Posts: 74

hey guys some of you may remember me. ive been real busy just graduating high school and all and moving on to college. ive finally finished settling with the move and ready to start cracking again. ive forgotten alot. i have even had to refer back to my own tutorials for reference. anyway if any of you remember about a year back i wrote a tutorial on Serial Fishing - PowerArchiver 2004.

it can be found on my forum at http://khaosreversing.r8.org in the tutorials section.

anyways. i moved on to trying to serial fish PowerArchiver 2006. looks ALOT different than 2004 when i pop it open in Olly. first thing i noticed is that it looks like its packed. i scanned it with PEiD, nothing found. so i tried to manually unpack it and in a failed attempt, locked up my computer.

so if any of you guys could get me a start on this i can probably do the rest my-self and ill write another tutorial on it. yes i will include pics and give credit to those who helped me figure this one out.

Greatly appreciated,

~Khaosgott96~

SKiLLa · Frequent poster Joined: 29 Mar 2005 Posts: 79

PEiD detects it as Delphi, but using haggar's PEiD signatures I get: Gleam v1.00 * (never heard of it though) ...

You can find Gleam v1.01 at: hxxp://sac.itb.it/security/gleam101.zip

EDIT: check the topic on ARTeam, seems it's ExeCryptor ...

Good luck !

bengunn · Regular Joined: 15 Apr 2005 Posts: 118

Side note: this target its one of those fairly rare times you can get a working dump of execryptor protected exe with little effort (or reversing skill), well I should say semi working, I packed and unpacked a test folder with the dumped exe and no problems but dumped power archiver is only working on the os I dumped it on. I don't spend much time with execryptor, usually there would be far too much work involved in getting a working dump to make it worthwhile.

Khaosgott96 · Frequent poster Joined: 15 Aug 2005 Posts: 74

thanks for the heads up on that. looks like they REALLY changed there protection scheme as phishing a serial from 2004 was like taking candy from a baby.

i need to start re-learning all what i knew and much more before i start screwing with Execryptor.