
Ŀ
          Currently tested to be supported cryptors/packers by v1.0         
Ĵ
 Name         Tested version  Comments                                    
͵
 ASProtect    1.1 shareware   Wellknown cryptor with iat redirection,     
              only -see below exc tricks, drx clearing etc.               
͵
 ASPack       2.1             Uses compression                            
                                                                          
Ĵ
 BJFnt        1.3             Nothing special                             
                                                                          
Ĵ
 Crunch       V2              Uses compression and has some interesting   
                              anti debugging in it                        
Ĵ
 CodeCrypt    0.164 beta      W9x only cryptor, exception tricks, fake jmp
                              everywhere, uncommon entry Seg:ESP trick    
Ĵ
 Exe32Pack    1.36            Uses compression                            
                                                                          
Ĵ
 LameCrypt    1.0             Simple xor cryptor                          
                                                                          
Ĵ
 NeoLite      2.0             Uses compression                            
                                                                          
Ĵ
 NeoSpace     1.0             Very similar to NeoLite, main purpose is to 
                              reduce hd space of windows or prog dirs     
Ĵ
 Noodlecrypt  2               Jmps often between sections, so I had to    
                              update my generic OEP seeker                
Ĵ
 PCGuard W32  3.04d regged    Nice encryption, fake jumps, weak anti debug
              and shareware   stuff                                       
Ĵ
 PCPEC        "alpha preview" Nothing special here, weak encryption and   
                              anti debugging                              
Ĵ
 PCShrinker   0.71 beta       Uses aplib                                  
                                                                          
Ĵ
 PE-Compact   1.45            Uses aplib or jcalg1 compression            
                                                                          
Ĵ
 PEDiminisher 0.1             Uses aplib compression                      
                                                                          
Ĵ
 PKLite32     1.1             Uses compression                            
                                                                          
Ĵ
 PELOCKnt     2.04            idt tricks, fake jmps, partly importtable   
                              destroying, write to kernel area            
Ĵ
 PEMangle     1.0             Simple cryptor                              
                                                                          
Ĵ
 PE Nightmare 2               Uses aplib compression, only first section  
                              gets compressed, adding code a little buggy 
Ĵ
 PENinja      1.0             Makes use of millions of NOPs for confusing,
                              some sice tricks, fake jumps                
Ĵ
 PE-Pack      1.0             Uses aplib compression                      
                                                                          
Ĵ
 PESentry     0.05a           Handles relocation, imports, resources      
                              and resizes last section for append code    
Ĵ
 Shrinker     3.4 demo        Executables compressed with Shrinker cannot 
                              be encrypted afterwards, reads from itself  
                              Notice: Disable use ring0 tracer            
Ĵ
 ShrinkWrap   1.22            Older PE-Compact version with another name  
                              most likely                                 
Ĵ
 SecuPack     1.5             Uses compression, writes decrypted file to  
                              disk and then runs it (->createpr detection)
Ĵ
 SpeedSafePro ?               Protection used by Optimized Developments   
 Protection                                                               
Ĵ
 Stone's      2.0             Last version uses aplib compression         
 PE encrypter                                                             
Ĵ
 Spec         Beta 3          Simple cryptor                              
                                                                          
Ĵ
 TimeLock     3.0             Used by Preview Systems to encrypt trial    
                              applications with their Preview ZipLock     
Ĵ
 UPX          1.08d           Uses compression                            
                                                                          
Ĵ
 VBOWatch     2.0             Document says "injects powerful anti-debug  
                              code" ... not really                        
Ĵ
 VGCrypt      0.75            SEH tricks, stack tricks                    
                              Notice: Enable ring0 tracer                 
Ĵ
 WWPack32     1.20            Uses compression                            
                                                                          
Ĵ
 Winkript     1.0             Similar to LameCrypt, but is buggy: the EP  
                              RVA points after the PUSHAD at real begin   
Ĵ
 XCR          0.11            Simple cryptor                              
                                                                          
Ĵ
 Yoda Crypter 1.2             Destroyes parts of importtable, anti sice,  
                              exception tricks in v1.2, decryptor mutates 
Ĵ
 And other cryptors which haven't been tested yet....                       
 Please remember: If you have a cryptor listed here which is newer/older    
 then the version I have tested, there is a BIG chance that GUW32 will      
 unpack it too!                                                             



Ŀ
        Currently tested to be NOT supported cryptors/packers by v1.0       
Ĵ
 Name                          Comments                                    
͵
 ASProtect 1.xx                GUW can unpack aspr with a few modifications
                               but it is a lot faster + more reliable to   
                               use CASPR by SAC/UG                         
Ĵ
 tELock, Krypton               Emulate trapflag exceptions correctly       
Ĵ
 PESHiELD                      Multi threads + api jmp into                
Ĵ
 Petite 2.2                    Problems with stack (ring3 tracer)          
Ĵ
 DBPE, NFO, Armadillo          Wrong exc handling (fix bugs in exc emu)    
Ĵ
 PE-Crypt32, PCGuard 4.0       Cannot write to process... weird            
Ĵ
 VisualProtect, SD2, SecuRom   Not analyzed yet                            

