UpKPEiDSign.V20090904.By.fly[CUG] Peid最新加壳签名

;UpKPEiDSign.V20090904.By.fly[CUG] ;http://www.unpack.cn ;UpK软件安全社区以软件安全技术研究和软件安全工具共享为特色 ;UpK论坛欢迎大家交流，理性宽容与人为善，遵守《UpK坛规》，认同论坛理念融入UpK交流氛围增强UpK荣誉发展UpK软件安全社区 ;___________________________________PEiD___________________________________ ;PEiD: http://www.peid.info ;The file userdb.txt is used to store the external signatures. ;External signatures can be modified by the user as and when he requires. ;The signatures are in the format ;The ?? in the signature represent wildcard bytes (they are skipped while scanning) ;ep_only can be either true or false. When true, the signature is scanned for at the EntryPoint only. ;Else it is scanned throughout the file. ;A '*' in the results of PEiD signifies that the external database was used for scanning the file. ;___________________________________2009___________________________________ [Fish Pe Packer V1.02 -> hellfish * Sign.By.fly * 20090120] signature = 60 E8 07 00 00 00 61 68 ?? ?? ?? ?? C3 5E 56 8B 56 02 ?? ?? ?? AD 01 D0 5B 36 89 43 02 66 3E C7 43 FA EB 05 53 AD 01 D0 89 C3 C7 43 FC 00 10 00 00 C7 43 F8 00 80 00 00 89 53 F4 AD 01 D0 89 43 F0 AD 01 D0 89 43 10 52 6A 04 FF 73 FC AD 50 6A 00 3E FF 53 08 89 C5 6A 04 FF 73 FC AD 50 6A 00 3E FF 53 08 89 C1 5A 83 EE 08 AD 50 55 AD AD 50 AD 01 D0 50 6A 02 6A 00 6A ?? 51 89 CF FF 53 10 83 C4 20 FF 73 F8 6A 00 57 FF 53 0C ep_only = true [Fish Pe Packer V1.03-V1.0X -> hellfish * Sign.By.fly * 20090119] signature = 60 E8 21 00 00 00 EB 18 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 5E 56 8B 56 1C 89 F3 ep_only = true [Fish Pe Packer V1.04-V1.0X -> hellfish * Sign.By.fly * 20090120] signature = 60 B8 ?? ?? ?? ?? FF D0 5A 00 00 ?? ?? ?? ?? 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 57 56 53 55 89 E5 8B 45 20 01 45 24 50 FC 8B 75 18 01 75 1C 56 8B 75 14 AD 92 52 8A 4E FE 83 C8 FF D3 E0 F7 D0 50 88 F1 83 C8 FF D3 E0 F7 D0 50 00 D1 89 F7 83 EC 0C 29 C0 40 50 50 50 50 50 57 AD 89 C1 AD 29 F6 56 83 CB FF F3 AB 6A 05 59 E8 9C 02 00 00 E2 F9 8D 36 8D 3F 8B 7D FC 8B 45 F0 2B 7D 20 21 F8 89 45 E8 ep_only = true [VMware ThinApp VV3.396.0.0 -> VMware * Sign.By.fly * 20090124] signature = 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB C1 20 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 2E 00 00 68 28 01 00 00 E8 2C FF FF FF E9 ?? FF FF FF CC CC CC CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8 87 00 00 00 49 E2 09 8B C3 E8 7D 00 00 00 EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D 00 00 00 0B C5 5D 8B D8 E8 5F 00 00 00 3D 00 00 01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00 00 73 08 83 F8 7F 77 04 41 41 41 41 56 8B F7 2B F0 F3 A4 5E E9 F0 FE FF FF 33 C0 EB 05 8B C7 2B 45 0C 5E 5F 5B C9 C2 08 00 ep_only = true [VMware ThinApp V4.0.0.2200 -> VMware * Sign.By.fly * 20090124] signature = 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 94 1A 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 28 00 00 68 C8 00 00 00 E8 2C FF FF FF E9 ?? FF FF FF CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8 87 00 00 00 49 E2 09 8B C3 E8 7D 00 00 00 EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D 00 00 00 0B C5 5D 8B D8 E8 5F 00 00 00 3D 00 00 01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00 00 73 08 83 F8 7F 77 04 41 41 41 41 56 8B F7 2B F0 F3 A4 5E E9 F0 FE FF FF 33 C0 EB 05 8B C7 2B 45 0C 5E 5F 5B C9 C2 08 00 ep_only = true [VMware ThinApp V4.0.1.2866 -> VMware * Sign.By.fly * 20090124] signature = 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 72 13 00 00 2B C3 50 68 00 00 20 46 68 00 60 00 00 68 58 01 00 00 E8 71 FC FF FF E9 DA FC FF FF 55 8B EC 8B 48 3C 83 EC 0C 53 56 57 8D 7C 01 78 8B 0F 85 C9 74 7E 8B 77 04 83 FE 28 72 76 8D 1C 01 8B 53 18 85 D2 74 6C 8B 43 20 3B C1 72 65 8D 14 90 03 F1 3B F2 72 5C 83 65 FC 00 2B C1 03 C3 83 7B 18 00 89 45 F4 76 4B 8B 4D FC 8B 45 F4 8D 04 88 8B 0F 3B 08 77 31 8B 30 FF 75 08 8B C1 89 45 F8 FF 15 2C 30 20 46 8B 4F 04 03 4D F8 8D 44 30 01 3B C1 77 13 2B 75 F8 FF 75 08 03 F3 56 FF 15 28 30 20 46 85 C0 74 12 FF 45 FC 8B 45 FC 3B 43 18 72 B5 33 C0 5F 5E 5B C9 C3 8B 55 FC 39 53 14 76 F1 8B 43 1C 8B 0F 3B C1 72 E8 8D 04 90 8B 57 04 03 D1 8D 70 04 3B D6 72 D9 2B C1 8B 04 18 EB D4 FF 25 5C 14 20 46 00 00 00 00 56 6A 01 FF 74 24 14 6A 00 FF 74 24 18 E8 DC 07 00 00 8B F0 83 C4 10 85 F6 75 04 33 C0 EB 28 68 AB 14 20 46 E8 0B FF FF FF 59 85 C0 74 ED 8B 4C 24 14 68 5C 14 20 46 FF 74 24 10 03 C6 6A 01 C7 01 56 14 20 46 FF D0 5E C2 10 00 ep_only = true [NoobyProtect V1.1.4.0 -> Nooby * Sign.By.fly * 20090201] signature = E9 ?? 00 00 00 4E 6F 6F 62 79 50 72 6F 74 65 63 74 20 53 45 20 31 2E 31 2E 34 2E 30 ep_only = true [NoobyProtect V1.2.9.0 -> Nooby * Sign.By.fly * 20090218] signature = E9 ?? 00 00 00 4E 6F 6F 62 79 50 72 6F 74 65 63 74 20 53 45 20 31 2E 32 2E 39 2E 30 ep_only = true [NoobyProtect V1.X.X.X -> Nooby * Sign.By.fly * 20090201] signature = E9 ?? 00 00 00 4E 6F 6F 62 79 50 72 6F 74 65 63 74 20 53 45 20 31 2E ?? 2E ?? 2E ep_only = true [JDProtect.V20081208.demo DLL -> 天乐软件科技 * Sign.By.fly * 20090119] signature = 8B 44 24 08 83 F8 01 75 1F E8 92 FE FF FF E8 3D 01 00 00 8B 44 24 0C 8B 4C 24 04 50 6A 01 51 E8 5C 57 00 00 83 C4 0C C3 85 C0 75 1E 8B 54 24 0C 52 50 8B 44 24 0C 50 E8 44 57 00 00 83 C4 0C E8 7C 46 00 00 B8 01 00 00 00 C3 8B 4C 24 0C 8B 54 24 04 51 50 52 E8 26 57 00 00 83 C4 0C C3 90 90 E8 ep_only = true [Xenocode Virtual Application Studio -> Xenocode * Sign.By.fly * 20090203] signature = 58 00 65 00 6E 00 6F 00 63 00 6F 00 64 00 65 00 20 00 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 20 00 41 00 70 00 70 00 6C 00 69 00 61 00 6E 00 63 00 65 00 20 00 52 00 75 00 6E 00 74 00 69 00 6D 00 65 00 00 00 00 00 30 00 78 00 30 00 30 00 31 00 31 00 00 00 00 00 30 00 78 00 30 00 30 00 31 00 32 00 00 00 00 00 30 00 78 00 30 00 30 00 31 00 33 00 00 00 00 00 30 00 78 00 30 00 30 00 31 00 34 00 00 00 00 00 30 00 78 00 30 00 30 00 31 00 35 00 ep_only = false [Xenocode Virtual Application Studio 2009 -> Xenocode * Sign.By.fly * 20090203] signature = 58 00 65 00 6E 00 6F 00 63 00 6F 00 64 00 65 00 20 00 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 20 00 41 00 70 00 70 00 6C 00 69 00 61 00 6E 00 63 00 65 00 20 00 52 00 75 00 6E 00 74 00 69 00 6D 00 65 00 00 00 00 00 30 00 78 00 30 00 30 00 31 00 31 00 00 00 00 00 30 00 78 00 30 00 30 00 31 00 32 00 3A 00 20 00 00 00 00 00 30 00 78 00 30 00 30 00 31 00 33 00 00 00 00 00 30 00 78 00 30 00 30 00 31 00 34 00 00 00 00 00 30 00 78 00 30 00 30 00 31 00 35 00 ep_only = false [Private exe Protector V3.0-V3.0X -> SetiSoft Team * Sign.By.fly * 20090215] signature = 00 2E ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??