Quick Unpack v1.0 beta3 for public

最新推荐文章于 2025-08-08 16:55:10 发布

原创最新推荐文章于 2025-08-08 16:55:10 发布 · 2.4k 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#import #list #numbers #button #delete #system

本文介绍了 Quick Unpack v1.0 程序，它能在 2 秒内快速解包多种简单打包器，还新增了解包 dll 的功能。同时阐述了导入恢复技术，包括处理导入列表中的虚假函数、地址匹配等，也提及了替换函数记录及删除无效记录的操作，最后说明了版本历史和下载地址。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

by:FEUERRADER

Quick Unpack v1.0 Readme

Description
-----------
The program is intended for fast (in 2 seconds) unpacking simple packers (UPX, ASPack, PE Diminisher, PECompact, PE-PACK, PackMan, WinUPack and many others). Quick Unpack tries to bypass all possible scramblers/obfuscators. From the version 1.0 the opportunity of unpacking dll is added. This opportunity makes Quick Unpack unique software product which has no similar analogues in the world!

Technology of import recovery
-----------------------------
I recommend to look through the list of import rather attentively.. There can be fake functions in it!! So the unpacked program can be unable to work because of them..
The import recovery with syd's method works so: after loading the program, the dlls which it loads are hooked. The export is scanned from them. Then the program will be dumped and the addresses which coincide with the address from that dlls will be searched for. If coincides, this address will be called Record RVA and will be included in a cycle of creation the table of import further.
If addresses casually concides with the addresses from hooked dlls, they will be added in the list of import too but if you are rather experienced in unpacking to find them, they can be removed (for this purpose numbers of the sections and their names are showed). More often import lays in one section so be very attentive please.
There are some records in the file replace.ini according to which you should replace some functions in the import list. The matter is that e.g if you call GetProcAddress(GetModuleHandle("kernel32" ), "HeapFree" ), your system will return the address in ntdll.dll and it will be the address of api-function RtlFreeHeap. I have added in this list the api I met earlier. If you will notice some records from ntdll.dll in the list of import, try to find the replacement for them in your system. If it will be impossible, simply try to remove them.
In the Quick Unpack there is the opportunity of marking possible invalid records is added, for their removing please press the button "Delete invalid".

The license and rights
----------------------
The list of sources used in coding Quick Unpack 1.0.
GenOEP.dll by Snaker
ImpREC.dll by MackT
stripper 2.11 b3 / asprotect unpacker by syd

History of the versions
-----------------------
v1.0 [+] the opportunity of unpacking dlls
[+] the Opportunity of using plug-ins and own OEP finders is added.

down:

http://ahprotect.ahteam.org/Quick.Unpack1.0.beta3.public.rar