full-disclosure - Depacting Sasser

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

From: angray at beeb.net (Aaron Gray)
Subject: Depacting Sasser

Hi,

Looking for some help. I have sucessfull depacted Blaster, that was easy, just UPX decompaction. On my way to disassembling it.

I Depacted Gaobot using unpack32 a number of times to, deyoda it, then DePEComapct it must be older codec JCALC1 algorithm.

But cannot depact/decrypt Sasser I know it is compacted with PECompact, probably it newer algorithm FFCE codec.

I can grab a memory image of it but would really like a tool to depack/decrypt it.

So is there anything that will reverse code the newer PECompacts algorithm ?

Hope you can help,

Aaron

Sorry I do not normally trade virii, they are generally availiable on the web given a bit of searching.
I would trade for a depacted Sasser however.

I am purly studying the things for study only.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040808/d4af03bd/attachment.html