--컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴--� unCOM - Generic COM unpacker --컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴--� UnCOM is able to unpack ALLMOST every scrambler written by a 'beginner', even if there's heavy anti-debugging code included. Please note unCOM executes parts of the host file - so DO NOT unpack viruses! usage: uncom phile.com - Shows only cryptor infos uncom phile.com unpacked.com - Unpacks phile.com uncom phile.com new.com /Options Options --컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴--� /? Show a short help /INFO /I Check only with Crypter is used and quit without unpacking /NOSAVE Don't patch file while copying /NULL Force second level automatic size determination. Works only if automatic file size is used. /Usage Show's this short help /V Verbose breakpoint mode Options can now be mixed! Options are NOT case sensitive. You can use the slash "/" or the hyphen "-" to start an option. Options can be set using the environment variable UNCOM (set UNCOM=...). To unset an option set by setting UNCOM=... you can use the a "-" at the end of the option (for example: set UNCOM=/nosave -> uncom a: -nosave-). ENVIRONMENT VARIABLE FOR UNCOM: e.g.: set UNCOM=/NULL or: SET uncom=-Option /Option /Option ... ADT --컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴--� ADT means that the protector includes anti debugger tricks. Cryptor's --컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴--� I have tested unCOM at least on these protectors, stickers or scramblers: NSP N0P Shit Protector (3 versions) - done by Ka0t (and Ghostbuster?) Very good antidebugging tricks! unCOM is as far as I know the only availiable unpacker - even TRON fails. Vandal Scrambler ABK-Prot Simple Scrambler found on ABK-DEPROT Binlock Scrambler, ADT Lore.155 Scrambler found in intros from Lore BBS. 155 bytes F-Xlock 1.15 Sticker, virus shield by Frisk, scanned by TBSCAN as Piter.C virus :-) Rand0m/Tulpe Unreleased protector by Rand0m, unCOM can handle all known versions. ADT - good! I have written for this protector a generic patching unit. Use the switch /nosave to examine what unCOM has patched/NOP'ed. Iceman/ABK Compressor found in intros from Iceman and in the file ABK-DEPROT. unCOM does a generic unpacking and size calculation. At least three different versions known. CryptCom Known versions Dropper-D, A, B, ^UE and ^WA Dropper-D Simple scramblers 29-33 bytes RC1 ROSE COM Crypt I, like CryptCom 33 bytes - not in the public (meanwhile I have released it in April 97 at the TPiNC party) T-Pack 0.50 LZ COM Compressor - nice and short from Germany :) There are two variants: Small and larger decompression routines. Switch /m1 and /m2 UnCOM can unpack both versions, automatic size calculation Sometimes I use this packer, because it can compress files where ComPack fails! HD-Killer Buggy scrambler, kills int 1 & 3, ADT Comlock Scrambler DeepCrypt 0.10 Moshe 0.10 Scrambler, 31 bytes? Sea.Prot.32 Scrambler found on the file CES.COM from SEA Sea.SelfCheck Simple selfcheck routine (128 bytes) found on the file CES.COM from SEA UCF.Pack Unknown COM packer found in LOADFIX.COM from UCF, automatic file size calculation. Crypt.26 Found in a virus dropper. The shortest protector/scrambler I have found yet. ProCrypt 1.0 By Lukas Fabian Moser. 1072 bytes. Scrambler with a stack trick to fool debuggers. CryptCom.41 Found in a virus dropper. Unknown Scrambler. Immune 1.0 COM/EXE file protector from 1992. No ADT. Has an option to scramble the host. unCOM can unpack both versions, the size must be adjusted manually (files are about 800 too long :). XComor Prepending cryptor, for that reason the cryptor length can LordCaligo not calculated. I have 2 versions: 0.99f = 170 bytes, AD 0.99g = 274 bytes, AD Cypoxl 77 bytes, no AD. UnCOM uses special breakpoint mode on it ComCrypt 40 bytes. Very intelligent program name... :) Got the protector from Hanno's EXE Mailing list. MSCC 110 bytes, AD - easy to bypass and many more --컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴--� Send me all those scramblers unCOM can not unpack, as well as a short mail if it can unpack a protector NOT in this list! --컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴--� (C)opyright 1987-97 (ALL RIGHTS RESERVED!) 旼컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴커 � ROSE Softwareentwicklung 넴 � Dipl.-Ing. (FH) Ralph Roth 넴 � Finkenweg 24 넴 � 넴 � D 78658 Zimmern o. R. 넴 � 넴 � FAX/AB: +49.741-32647 넴 읕컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴켸� 賽賽賽賽賽賽賽賽賽賽賽賽賽賽賽賽� EMail: Ralph_Roth@p2.f2101.n246.z2.fidonet.org Fido: 2:246/2101.2 Type Bits/KeyID Date User ID pub 512/CC3742A5 1995/02/08 Dipl.-Ing. (FH) Ralph Roth, Fido: 2:246/2101.2 -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQBNAi847YIAAAECANEe8vGPyKnR0bVoMO9vEu0hD+pMItDzLSvxqWF8W8YWzZ3U AdhzfNDKL9uEo6BY/jHAF3m8vi5T//pgOsw3QqUABRG0HVJhbHBoIFJvdGggPHJh ckBmaC1hbGJzaWcuZGU+iQBVAwUQMvEC1v/6YDrMN0KlAQGq1AH9GOZnCI5VSJK6 EJGPK8UwYnzIhN3YGg1uBBCzsrMnPucB8J8GnaYxfA/r9bBsjfUYPkhI9s0XumAt ScbHr68TxrQuRGlwbC4tSW5nLiAoRkgpIFJhbHBoIFJvdGgsIEZpZG86IDI6MjQ2 LzIxMDEuMokAVQMFEDL45u+ZiMHovEmyvQEBZScB/iWIEez/0zVa4e0lYQjgy82i TBemfNnm3ABzr9e9iqbO5Vg0Ne2FxquawIo6Nl4wvzD1oyuGl6PDo592M5+41CiJ AFUDBRAyxov///pgOsw3QqUBAbEhAf9cIvlfV0oTQ7tZ58V/xlVfY7YoCdHpjbif bBw8sdUZLhpueAEZKEUOO2BVMFnP4toA8CgDS27gSYowQRrk/3DD =sAec -----END PGP PUBLIC KEY BLOCK-----