TQ packed their conquer.exe

[intelman]

in new patch 5088, TQ has patched their conquer.exe. I cant find what is that pack, some program let me know "ChinaProtect --> dummy",....
Can anyone tell me about a unpacker can unpack this packer ?

[Hiyoal]

It hasnt been packed. Nothing picked up by PEiD.

Hiyoal

[David5646]

Originally Posted by Hiyoal

It hasnt been packed. Nothing picked up by PEiD.

Hiyoal

Well they did something See

[TmT-sibrand]

Well, i can't hex edit Conquer.exe anymore to make multiclient (edit English blablabla) cuz its written in.... idk :P

[WHITELIONX]

Same problem here there is NO English to change >.< However if you use cid proxy it CAN still be done lol but its so **** laggy that three chars will just cause annoyance

[tanelipe]

It's packed, PEID doesn't pick it up so I believe it's something less used encryption. :P

[intelman]

I used VMunpacker and get that was packed by packer "ChinaProtect -> dummy [Overlay]" <===> Can't unpack
Here is the image.

[high6]

1 sec, ill check it out.

[Sk1nny]

this is the only real reference I can find to china protect

[ChinaProtect -> dummy * Sign.By.fly]
signature = C3 E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 56 8B ?? ?? ?? 6A 40 68 00 10 00 00 8D ?? ?? 50 6A 00 E8 ?? ?? ?? ?? 89 30 83 C0 04 5E C3 8B 44 ?? ?? 56 8D ?? ?? 68 00 40 00 00 FF 36 56 E8 ?? ?? ?? ?? 68 00 80 00 00 6A 00 56 E8 ?? ?? ?? ?? 5E C3
ep_only = false

Signature based encryption I think.

[Hiyoal]

Fair enough, stand corrected. Im glad I know why though.

Hiyoal

[iliveoncaffiene]

Time to scour the web (google isn't even turning up results for a chinaprotect program)

[Pindle]

No longer packed in 5089

[Sk1nny]

Originally Posted by Pindle

No longer packed in 5089

HAHAHAHAHAHA sweet!
You Know how many of Virus scanners would have deleted that, that was a bad move, good thing they fixed it.

[taelech]

Originally Posted by Pindle

No longer packed in 5089

hehe was about to post it :P

[intelman]

Originally Posted by Pindle

No longer packed in 5089

Nice to hear that.
Yeah now it isn't packed anymore in 5089, hope they wont patch it in the future.