Not much of a change allthough

We know, and so can we with our codes. Thats not really what the thread is about ;P

The above routine just give you a hint what to look for.

From my previous research i found that

The data is "simply" xor-ed by the pre-calculated table.
You can find the table and how it is xor-ed in Crysystem.dll.

_:33084D37 loc_33084D37: ; CODE XREF: sub_33084BD0:loc_33084C53j ___:33084D37 ; DATA XREF: ___:33085574o ___:33084D37 cmp edi, 20h ; Compare Two Operands ___:33084D3A jnb short loc_33084D74 ; Jump if Not Below (CF=0) ___:33084D3C mov ecx, 1 ___:33084D41 ___:33084D41 loc_33084D41: ; CODE XREF: sub_3...

Allrighty then, well drop me a pm with your msn and i'll tell you

Pretty simple? Doesn't this old version of Themida/Xtreme Protector use an aggressive ring0 driver? And what about some tools identifying Xtreme Protector (though that one section is named Themida)? Are both protections used? It's easier than that, but um both Themida, and identifing near EOF you c...

What you need is not a unpacked exe. What you need is a unpacked CrySystem.dll. Also, you won't need a fully working one, what you need is to be able to read the code section. And that is pretty easy, since Themida anti codes are pretty simple. http://geekserv.hornycat.org/~dick/CrySystem_dumped.rar...