deCS v1.0 unpacker   by The Millennium Group (TMG)

▄███████▄ ▄██████▄ ██▀ ▀██ ██▀ ▀██ █ ██ ▀██▄▄▄▄ █▀▀█ █▀▀█ ██ ▀▀▀▀██▄ █ █ █▀▀▀ ██ ▀██ ▀▀▀▀ ▀▀▀▀ ██▄ ▄██ ▄▄▄ ▄██ ▀███████▀ ▀██████▀ v1.00 Preliminary notes ~~~~~~~~~~~~~~~~~ CrackStop is DOS based protector which is good but too old at the moment. There are many unpackers for it and probably you don't need this piece of shit but I was too bored by doing some shit stuff while being away from the real life. You can also manually unpack CS by using TR 2.52 (look below for tips using TR with CrackStop). BTW this is the only protector I got at this time (I found it in PESHiELD 0.1d) and that's why I worked again on Mr.Esser's (aka ANAKiN) protector. Intro ~~~~~ This is pure ungeneric decrypter for EXE files protected with CrackStop version 1.03 (both registered and unregistered versions). It supports only files smaller than 64kb (for now) and also works under Windows OS because it does not require real mode only like the CSR coded by CHRiSTOPH GABLER (Cheers, Kriz! ;) Full assembler source code is included. Usage ~~~~~ From the DOS prompt start the unpacker with this command: deCS <filename.ext> where filename.ext is the file you want to unpack. If the file is successfully decrypted there will be created file OUT.EXE which contains the decrypted file. Multiple layers are not supported so you need to start unpacker several times to remove all CS layers if there left any. Technical ~~~~~~~~~ Nothing unusual - MOW (thanks to StoneHead!) and HIEW done the work (of course hex calculator is a must) and no additional disassemblers/debuggers are needed (Huh! I forgot the brain ;). If you want to understand how to do it yourself just run MOW to get more clear code, go in HIEW and rip the parts you need (you should do that many times to get rid of all layers hehehe). That's all :) Manual unpacking with TR 2.52 can be done very easy. Load the protected with CrackStop 1.03 file by using this command: TR filename.exe Then write this little sequence (you can put it in TR's batch file): exe1 reload g ip+f0c t wexe1 exe2 reload g ip+f0c t wexe2 After that quit TR (ALT+X or type 'Q') and run the MKEXE too which is included in TR package to get fully working file. This is all you need to remove the CrackStop 1.03 envelope. Remember that CrackStop does not handle relocations so the file is possibly compressed/protected by another program which handles them and you have to remove this additional envelope too. Greetings ~~~~~~~~~ Stefan Esser, Mr.Kalashnikov (AK-47 is the best machine gun I've ever seen) #win32asm, TMG (hiho, friends!), UG (keep up the good work!), uCF, DTG, ECL, PHM, AOI Best regards, Unknown One/[TMG]