[EP_X0FF]

Hello,

is there any available freeware packers for x64 Windows?

As you might know TDL4 uses MPRESS for it's C&C user mode library - cmd64.dll

Quick googling didn't revealed anything else, except Vmpotect which is out of my interest.

If you know something else, please post here.

Regards.

edit:

Armadillo x64 obtained :)

[GamingMasteR]

lARP64 by lena151
Free version doesn't support protection, only compression.

PESpin

[EP_X0FF]

IAPR64 Free does not working. Free version cannot pack any file, just throwing idiotic message "Unregistered".
Pro version simple not work without activation key.

PESpin x64 sucks with it two-processes :)

[ArkKup]

had the same problem with IAPR64 :evil:

PESpin x64 sucks with it two-processes :)

why does it suck ? looks pretty cool to me ;)

[EP_X0FF]

Because it firstly strange to see two processes (packed and unpacked) in processes list. And secondary such behavior remembers classical malware cryptors :)

[ArkKup]

strange or not but I guess the goal was to prevent attaching debugger to unpacked process. I saw this trick first time few years ago in Armadillo x86, but with Softice
it was not a problem to break into the unpacked process. Now there is only windbg and all exceptions are going firstly through user mode debugger (parent process), so its not so easy to overcome this type of protection. well, from AV point of view, use of any packing equals "its malware", but some people just want to protect there non malicious code against patching and disassembling.

[Brookit]

eXPressor

"support for packing (not protecting) PE+ (64bit files); exe, dll, tls support; not yet .net;"

[EP_X0FF]

eXPressor

"support for packing (not protecting) PE+ (64bit files); exe, dll, tls support; not yet .net;"

Thanks.
Well, it locks my Windows 7 x64 at startup. Hard reset the only way. Will try later in some virtual environment.

edit:
ok, worked fine in vm.

[Brookit]

Good to know!

Another packer which is able to handle PE+: Obsidium

[GamingMasteR]

Well, it locks my Windows 7 x64 at startup. Hard reset the only way. Will try later in some virtual environment.

This happens when booting windows with "/debug" switch turned on only ?