Introduction

PESpin is a Windows executable files protector, compressor coded in pure Win32ASM using MASM.
It allows compression of the whole executable - code, data and resources,
leaving them executable and protects against patching and disassembling.
Compatibility with all operating systems Windows 98/ME/NT/2K/XP/Vista

PESpin is released as Freeware.

PESpin is owned and copyrighted by cyberbob. You must treat the software and its associated documentation like any other copyrighted material.


Feature, Options, Controls

History

v1.32

  • Added DLLs support

v1.304

  • Fixed compatible with VMWare
  • Updated aPlib

v1.3

  • Added Debug blocker option

v1.2

  • Private version not available to public

v1.1

  • Added CRYPT_START & CRYPT_END markers
  • Added CLEAR_START & CLEAR_END markers

v1.0

  • Added Code redirection option
  • Added optimize MS-DOS header size option
  • Cleaned up GUI a bit

v0.7

  • Added auto configuration saving
  • Generally improve file protection

v0.41

  • Added Compress resources option
  • Win2003 bug fixed

v0.3

  • Added compression
  • Added Strip Overlays option

v0.2

  • Generally improve a little bit whole loader code

v0.1

  • Added password protection option
  • Aded remove the OEP option

v0.b

  • First official version


Feature, Options, Controls

Program options

List of features

  • Decreases size of most PE-files a lot while leaving them still functional
  • Protects your files against patching/modifications and disassembling
  • PE - Optimization (Alignments, PE-Checksum, stripping of unused relocation info ..)
  • Drag'n'drop capabilities
  • Selfintegrity checks and several encrypted layers
  • Polymorph decryption routines
  • Advanced import table protection
  • Anti-debug and anti-trace tricks
  • Application password protection
  • Removing OEP
  • Sections/Objects-renaming
  • Checksum protection
  • Entire thing written in assembler (win32asm)

Options, Controls

[Add Debugger detection]
Adds Debugger detection to your file.

[Close program after: ... minut]
If you select this option the application will be terminated(without any message)
after time-out value.
Please note that when using this option for .DLL files after DLL_PROCESS_ATTACH message you will receive DLL_THREAD_ATTACH message.

[API Redirection]
All refers to import function will be placed somewhere in alloceded memory.
It's advised that this option is always selected.

[Section names]
'User name'- type maximum 8 chars or nothing then sections names will be cleared.
'Random known protector,packer'- random section name from my database.
'Don't rename' - section names will be the same as in original file.

[Antidump protection]
Protect application against code dumping from memory.

[Password protection]
Protected file will be encrypted using entered password <6,128> characters.
You need to enter password every time that your program is going to be executed.

Attention
It's not possible to recover a password that has been lost!

[Remove the OEP]
PESpin will remove physically few instructions after your Orginal Entry Point(OEP).
Disable this option if your program returns control to the OEP after being executed.

[Code redirection]
Code inside application will be protected, so that even after the dump of protected file
to hard drive the program won't execution.

Attention
Don't use this option if your application uses SMC(Self Modyfying Code).

[Debug blocker]
Briefly put, this causes the program to create two instances whenever it is run - called "parent" and "child" processes.
Some parts of code will be emulated in the "parent" process and the results will be passed to "child" process.

Attention
Don't use this option if your application uses SMC(Self Modyfying Code).
Disable if your application won't run or runs significant slower.

[Strip overlays]
Removes the (mostly) useless data at the end of a file.
Disable for flash executables.

[Strip .reloc section if possible]
Remove the .reloc section from an executable file.
By default not applied to .DLL files.

[Compress resources]
Compress your file's resource section. By default RT_MANIFEST, RT_ICON, RT_VERSION, RT_GROUP_ICON aren't compressed.
Disable this option if you have some 'exotic' resources that must remain uncompressed.

Attention
Disable for FASM executables.

[Optimize MS-DOS header size]
Optimize original MS-DOS header, but leave dos stub warning message.

[Create backup file]
Create backup file.

Please note that while processing .DLL files most of protection features won't be apply.
This is due to slightly different loading process.


Feature, Options, Controls

Crypt markers

Code between encryption markers CRYPT_START and CRYPT_END is encrypted during process of file protection and when protected file is executed, code is being decrypted closely before it is used and is again encrypted right after use (runtime protection against dumping).

C/C++, Asm Macro Usage

CRYPT_START
// your code goes here

CRYPT_END

Delphi Macro Usage

{$I crypt_start.inc}

// your code goes here

{$I crypt_end.inc}

Sample application is located in \Examples directory.
This option is only applied to .exe files


Feature, Options, Controls

Clear markers

CLEAR_START and CLEAR_END markers offers ability to remove blocks of code after being executed.
These macros should only be placed in regions of code that are executed once in your application.
Any attempt to re-execute a block of code inside those macros will cause an exception in the protected application.

C/C++, Asm Macro Usage

CLEAR_START

// your code goes here

CLEAR_END

Delphi Macro Usage
{$I clear_start.inc}

// your code goes here

{$I clear_end.inc}

Sample application is located in \Examples directory.
This option is only applied to .exe files

Example for C/C++

// To insert these macros, you need to include the "pespin.h" in your application source code

#include "pespin.h"

BOOL CALLBACK DlgP (HWND hDlg, UINT message, WPARAM wParam, LPARAM lParam)
{
 switch (message)
 {
  // initialization of main window, it's executed only one time
  // so we can use CLEAR_START and CLEAR_END macros
  case WM_INITDIALOG :

   // code between CLEAR_START and CLEAR_END will be executed
   // and then erased from the memory
   CLEAR_START

   SetWindowTextA(hDlg,"PESpin Markers Test");
   SendMessage(hDlg,WM_SETICON,(LPARAM) 0,(WPARAM) LoadIcon(hInst,MAKEINTRESOURCE(ID_ICON)) );

   CLEAR_END

   return TRUE;

  case WM_COMMAND :
   switch (LOWORD (wParam))
   {
    case IDCANCEL :
     EndDialog (hDlg, 0);
     break;
   }
   break;
 }

 return FALSE;
}

Example for Delphi

procedure TfrmMain.FormShow(Sender: TObject);
begin

{$I clear_start.inc}

// routine which should be executed only once...
...
...

{$I clear_end.inc}

end;


Feature, Options, Controls

Warranty

This software is provided as-is, without warranty of ANY KIND,
either expressed or implied, including but not limited to the implied
warranties of merchantability and/or fitness for a particular purpose.
The author shall NOT be held liable for ANY damage to you, your
computer, or to anyone or anything else, that may result from its use,
or misuse.Use it at YOUR OWN RISK.


Credits

Credits, Contact, Greets

Credits
PESpin has been programmed by cyberbob in Win32ASM using MASM.
My main goal was to make PESpin stable and compatible, so if you find any bugs
please let me know about them.

The Compression library aPlib is copyrighted and coded by Joergen Ibsen
(Homepage: http://www.ibsensoftware.com/)

Contact
e-mail: cyberbobpl@tlen.pl www: http://pespin.w.interia.pl
msn: cyberbob_mib@hotmail.com

Greets'n'Hellos to
cybult, ryba, hinte!, WiteG, ToMKoL, yoda, tE!, Iczelion, bart, uNdErX,
Stanley White, ReWolf, K0rt, Z0MBiE.

Have a nice day,
cyberbob