Add support for ExeLock Executable File Protector#1
Open
ZenoArrows wants to merge 5 commits into
Open
Conversation
NeoLite variant that uses Deflate64 and one extra obfuscation step
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
ExeLock is a NeoLite variant that uses Deflate64 and one extra obfuscation step. It can be detected by looking at
use_zlibin the header.The single extra obfuscation step is that in the executable sections all relative call instructions have been changed using the following logic during compression:
I think the intention was to make both cases relative to the bounds of the section with the sign bit marking whether it's relative to the start or the end of the section. However in the latter case they seem to have forgotten that the address is still relative to the current call instruction, but that could've simply been some extra obfuscation.
ExeLock is used as a packer for RollerCoaster Tycoon 1 and 2, having a convenient unpacker is helpful in studying one of the last games that still used mostly hand-written assembly. It's important to note that the original CD release of RCT2 was additionally protected by SecuROM and this script does not patch out any DRM scheme.