deCS v1.0 unpacker by The Millennium Group (TMG)
1 of 1 file
unknown one
-
This download is an executable MS-DOS program that will not run on a modern computer.
It needs a DOS emulator such as DOSBox-X, Staging;
or a virtualized MS-DOS or FreeDOS system.
Browsers may flag this download as unwanted or malicious. If unsure, scan it with VirusTotal. -
Last modified Dec 3, 2017 7:32:38 PM
MD5 checksum 2040d5beb15449f68195271313ceb5e9
Mime type Zip archive data
Download de-crackstop.10-the unknown one.zip
Size 5 kB
- Zip - DOS / Computer tool
- Unknown One, program credits
3 items in the archive
- DECS.ASM
- DECS.COM
- README.TXT
▄███████▄ ▄██████▄
██▀ ▀██ ██▀ ▀██
█ ██ ▀██▄▄▄▄
█▀▀█ █▀▀█ ██ ▀▀▀▀██▄
█ █ █▀▀▀ ██ ▀██
▀▀▀▀ ▀▀▀▀ ██▄ ▄██ ▄▄▄ ▄██
▀███████▀ ▀██████▀
v1.00
Preliminary notes
~~~~~~~~~~~~~~~~~
CrackStop is DOS based protector which is good but too old at the moment.
There are many unpackers for it and probably you don't need this piece of
shit but I was too bored by doing some shit stuff while being away from the
real life. You can also manually unpack CS by using TR 2.52 (look below
for tips using TR with CrackStop). BTW this is the only protector I got at
this time (I found it in PESHiELD 0.1d) and that's why I worked again on
Mr.Esser's (aka ANAKiN) protector.
Intro
~~~~~
This is pure ungeneric decrypter for EXE files protected with CrackStop
version 1.03 (both registered and unregistered versions). It supports only
files smaller than 64kb (for now) and also works under Windows OS because
it does not require real mode only like the CSR coded by CHRiSTOPH GABLER
(Cheers, Kriz! ;) Full assembler source code is included.
Usage
~~~~~
From the DOS prompt start the unpacker with this command:
deCS <filename.ext>
where filename.ext is the file you want to unpack. If the file is
successfully decrypted there will be created file OUT.EXE which contains
the decrypted file. Multiple layers are not supported so you need to start
unpacker several times to remove all CS layers if there left any.
Technical
~~~~~~~~~
Nothing unusual - MOW (thanks to StoneHead!) and HIEW done the work (of
course hex calculator is a must) and no additional disassemblers/debuggers
are needed (Huh! I forgot the brain ;). If you want to understand how to
do it yourself just run MOW to get more clear code, go in HIEW and rip the
parts you need (you should do that many times to get rid of all layers
hehehe). That's all :)
Manual unpacking with TR 2.52 can be done very easy. Load the protected
with CrackStop 1.03 file by using this command:
TR filename.exe
Then write this little sequence (you can put it in TR's batch file):
exe1
reload
g ip+f0c
t
wexe1
exe2
reload
g ip+f0c
t
wexe2
After that quit TR (ALT+X or type 'Q') and run the MKEXE too which is
included in TR package to get fully working file. This is all you need to
remove the CrackStop 1.03 envelope. Remember that CrackStop does not handle
relocations so the file is possibly compressed/protected by another program
which handles them and you have to remove this additional envelope too.
Greetings
~~~~~~~~~
Stefan Esser, Mr.Kalashnikov (AK-47 is the best machine gun I've ever seen)
#win32asm, TMG (hiho, friends!), UG (keep up the good work!), uCF, DTG,
ECL, PHM, AOI
Best regards,
Unknown One/[TMG]