Jump to content
Tuts 4 You

Leaderboard

  1. CodeExplorer

    CodeExplorer

    Team Member


    • Points

      202

    • Posts

      4,218


  2. jackyjask

    jackyjask

    Full Member+


    • Points

      89

    • Posts

      1,438


  3. LCF-AT

    LCF-AT

    Full Member+


    • Points

      26

    • Posts

      6,100


  4. m!x0r

    m!x0r

    Full Member


    • Points

      26

    • Posts

      31


Popular Content

Showing content with the highest reputation since 05/19/2025 in all areas

  1. TitanHide has been updated to support the latest VMProtect v3.9.4 changes. The service name is now used as the device name, as well, so the check for \\.\TitanHide will fail if you name the service the differently. Latest version (v0019) download link
    10 points
  2. Version v0.7 FIXED FINAL

    232 downloads

    ============================ AT4RE Power Loader v0.1 (Release Date: 26/03/2025) ============================ [+] Console interface [+] Loader Coded in C++ with CRT (big Size: 85 KB when compressed about 190 KB uncompressed). [+] Supports patching single or multiple Relative Virtual Addresses (RVAs). Root Folder Contents: [+] ATPL.EXE (AT4RE Power Loader) [+] Version History.txt ============================ AT4RE Power Loader v0.2 (Release Date: 16/04/2025) ============================ The most powerful loader against strong and hard protectors. It also works with medium-level protectors, packers, compressors, and even unprotected executable files. Main Features: [+] GUI Coded in Borland Delphi 7 [+] From the GUI, you can browse to select the target file (maximum filename length is 255 characters). [+] You can also copy and paste the file name into the input field. [+] Choose between x32 and x64 loader versions. [+] Loader data can be entered only in the format shown in filed or in the screenshot. [+] Set a base timeout in milliseconds (Minimum: 00, Maximum: 9999 — i.e., 9.99 seconds). [+] Set 1-byte opcodes in the Opcode field using HEX characters (Opcode is the Original First Byte of RVA1). [+] Configure Opcode Timeout in milliseconds (Minimum: 00, Maximum: 9999 — i.e., 9.99 seconds). [+] Set the Loader Timer Delay in microseconds (Min: 00, Max: 9,999,999 — i.e., 9.99 seconds). [+] Configure the loader to start as Administrator. [+] Directly pack the loader with UPX. [+] Generate Loader.exe [+] Save or open projects for future use from File menu. [+] Set the GUI to "most on top" from the View menu. [+] Access the official website, report bugs, and find more information via about in the Help menu. Loader Details: [+] Coded in C++ using the Windows Pure API. [+] Loader size is 10 KB uncompressed, and 5 KB when compressed. [+] Supports Windows 7, 8, 10, and 11 (both x32 and x64). Features include: [+] Anti-ASLR [+] Anti-Anti-Debug [+] Anti-CRC Check [+] Automatically detects the base address. [+] Detects when the protector unpacks code into memory. [+] Can apply temporary patches after a specified delay in microseconds (Patch and restor original bytes). [+] Can apply permanent patches only with 00 Flag [+] Supports patching single or multiple Relative Virtual Addresses (RVAs). [+] Capable of patching up to 2048 bytes. [+] Can run as Administrator or Normal user mode. Root Folder Contents: [+] Project folder (Save or open projects for future use) [+] UPX folder (includes upx32.exe and upx64.exe) [+] ATPL.EXE (AT4RE Power Loader) [+] Version History.txt ============================ AT4RE Power Loader v0.3 (Release Date: 10/05/2025) ============================ The most powerful loader against strong and hard protectors. It also works with medium-level protectors, packers, compressors, and even unprotected executable files. Main Features: [+] Added Support Patching DLLs (Only DLLs Loaded by Target.exe). [+] Added Drag Drop Feature: For .EXE, .REG, .ICO Files. [+] Added Insert Loader Data feature (For Respect the Correct Format). [+] Added Registry Keys Manager (Max size: 1 KB / 1024 characters). [+] Added Delete Files feature (Max size: 1 KB / 1024 characters). [+] Added Icon Changer. [+] Added New Project option from File menu (Clears all fields). [+] Added Commands Shortcut Ctrl+N, Ctrl+O, Ctrl+S in File menu. [+] Added Contact Us section from Help menu. [+] Updated About from Help menu from box to a form. [+] Updated display fonts for Loader Data, Registry, and Files. [-] Removed "My Target run as admin". Loader Details: [+] Size is now 17 KB uncompressed, 7 KB when compressed. [+] Loader now Support Patching DLLs (Only DLLs Loaded by Target.exe). [+] Loader can now add or delete registry keys. [+] Loader can delete files. [+] Automatically requests Run as Administrator when needed (e.g.,Target need administrator privilege, modifying registry or deleting files from protected folders). [+] Icon support added. Root Folder Contents: [+] Icons folder (includes 5 icons). [+] Lib folder (includes bass.dll). [+] Project folder (Save or open projects for future use). [+] ResH folder (includes ResHacker.exe). [+] UPX folder (includes upx32.exe and upx64.exe). [+] ATPL.EXE (AT4RE Power Loader). [+] Version History.txt ============================ AT4RE Power Loader v0.4 (Release Date: 16/05/2025) ============================ The most powerful loader against strong and hard protectors. It also works with medium-level protectors, packers, compressors, and even unprotected executable files. Main Features: [+] Added Import menu. [+] Added Support .1337 patch files exported by x64dbg. [+] Set Opcode automatically when Load .1337 file. [+] Added OpenDialog when Double Click on: - Target Name field. - Loader Data field. - Registry field. - Custom icon field. Loader Details: [+] Fixed bug with registry feature. [+] Default icon changed. [+] Compressed Loader with Default icon 8 KB. Root Folder Contents: [+] Icons folder (includes 5 icons). [+] Lib folder (includes bass.dll). [+] Project folder (Save or open projects for future use). [+] ResH folder (includes ResHacker.exe). [+] UPX folder (includes upx32.exe and upx64.exe). [+] ATPL.EXE (AT4RE Power Loader). [+] Version History.txt
    7 points
  3. The tool created with love for all RCE community. If you have any feedback bug repport share it here...
    5 points
  4. The best loader at all. For packed exe and dll. Moreover it is antivirus friendly !!!! The created loader is not detected by windows defender as a malware or a virus. Thanks to at4re And thanks to our forum members for the sharing
    4 points
  5. Registration Opened !
    3 points
  6. Tested Successfully with Targets Protected by: VMProtect، Themida, EXECryptor, Obsidium, The Enigma Protector....
    3 points
  7. @guily6669 how about you find & compose an email to support? you are legitimate user of the product, so try some old school tactics ask them about your pain points
    2 points
  8. guyz you playing Morze games? ... .. .. ... . . ...
    2 points
  9. Have you read and checked this: https://www.newskillgaming.com/manuales/Gungnyr-manual-EN.pdf You should be able to reduce/increase light intensity with the function button and arrow up/down. Also colour should be choosable with the function button and DEL. Read more in the guide above. Or, are you saying that this doesn't work? You might need the software also in order for all functions to work: https://www.newskillgaming.com/en/newskill-gungnyr-pro-optomechanical-rgb-gaming-keyboard-with-interchangeable-switches
    2 points
  10. what type of binary is your FW about? what CPU/controller/HW it is built for?
    2 points
  11. 82,989 downloads

    A collection of tutorials aimed particularly for newbie reverse engineers. 01. Olly + assembler + patching a basic reverseme 02. Keyfiling the reverseme + assembler 03. Basic nag removal + header problems 04. Basic + aesthetic patching 05. Comparing on changes in cond jumps, animate over/in, breakpoints 06. "The plain stupid patching method", searching for textstrings 07. Intermediate level patching, Kanal in PEiD 08. Debugging with W32Dasm, RVA, VA and offset, using LordPE as a hexeditor 09. Explaining the Visual Basic concept, introduction to SmartCheck and configuration 10. Continued reversing techniques in VB, use of decompilers and a basic anti-anti-trick 11. Intermediate patching using Olly's "pane window" 12. Guiding a program by multiple patching. 13. The use of API's in software, avoiding doublechecking tricks 14. More difficult schemes and an introduction to inline patching 15. How to study behaviour in the code, continued inlining using a pointer 16. Reversing using resources 17. Insights and practice in basic (self)keygenning 18. Diversion code, encryption/decryption, selfmodifying code and polymorphism 19. Debugger detected and anti-anti-techniques 20. Packers and protectors : an introduction 21. Imports rebuilding 22. API Redirection 23. Stolen bytes 24. Patching at runtime using loaders from lena151 original 25. Continued patching at runtime & unpacking armadillo standard protection 26. Machine specific loaders, unpacking & debugging armadillo 27. tElock + advanced patching 28. Bypassing & killing server checks 29. Killing & inlining a more difficult server check 30. SFX, Run Trace & more advanced string searching 31. Delphi in Olly & DeDe 32. Author tricks, HIEW & approaches in inline patching 33. The FPU, integrity checks & loader versus patcher 34. Reversing techniques in packed software & a S&R loader for ASProtect 35. Inlining inside polymorphic code 36. Keygenning 37. In-depth unpacking & anti-anti-debugging a combination packer / protector 38. Unpacking continued & debugger detection by DLL's and TLS 39. Inlining a blowfish scheme in a packed & CRC protected dll + unpacking Asprotect SKE 2.2 40. Obfuscation and algorithm hiding
    2 points
  12. thanks a lot for this !!
    2 points
  13. @jackyjask @CodeExplorer has it..
    2 points
  14. Best tool I like I tested some of the target working well
    2 points
  15. Found how to solve it. Put bp on ntdll.dll and it lands to ntdll.dll:$52DD6 #521D6 <RtlAllocateHeap>. But there are many calls like this. The question is can this be done by script or every call have to be solved manually?
    2 points
  16. Hi X0rby, tried to solve this unpackme, thank you for the afford. I have a question. For example: 00409F46 | E8 D2F55100 | call asmtomachinecode.vmp_dump_scy.92951D | 00409F4B | CE | into | 00409F4C | 5E | pop esi | 00409F4D | C3 | ret | you solve it as: 00409F46 | FF15 E8E00A02 | call dword ptr ds:[<HeapAlloc>] | 00409F4C | 5E | pop esi | esi:"U‰еjяhP@A" 00409F4D | C3 | ret | How to do it if you don't have the original non packed file?
    2 points
  17. A very good tool for patching !!!!
    2 points
  18. Forgive me for speaking frankly. There is no need to use the so-called "KeyGen", and it can be directly forced to bypass this protection. Those who boast about "KeyGen" but do not provide effective solutions are useless besides wasting forum space and questioner's time. Video_2025-01-25_181545.mp4
    2 points
  19. does anyone happen to have src of this good tool? https://web.archive.org/web/20140814051125/https://sourceforge.net/projects/improvenetdeobf/files/Source Code/
    1 point
  20. the files are not there anymore
    1 point
  21. Can someone share new link for this
    1 point
  22. does anyone have fresh link?
    1 point
  23. could any one share this in english version
    1 point
  24. View File Rika .NET Obfuscator v2025.04.07 About File: .NET Framework 4.8, 32-bit preferred Used Obfuscator: Rika .NET Obfuscator Latest Used Features: Code Virtualization & Anti Tamper Difficulty: 6/10 Goal: Find the Password or deobfuscate it competely. Submitter Fr0Mu Submitted 05/25/2025 Category UnPackMe (.NET)  
    1 point
  25. 28 downloads

    About File: .NET Framework 4.8, 32-bit preferred Used Obfuscator: Rika .NET Obfuscator Latest Used Features: Code Virtualization & Anti Tamper Difficulty: 6/10 Goal: Find the Password or deobfuscate it competely.
    1 point
  26. Hey, if you're still looking for a .NET obfuscator, you might want to try Rika .NET. It’s simple to use, works with modern .NET apps, and includes a solid virtualization feature that isn’t common in most of the obfuscators. I’m actively working on it and always open to ideas or feedback. You can find more info and join the community here: Website
    1 point
  27. Hello, If you're still looking for a practical and actively maintained .NET obfuscation tool, you might want to check out Rika .NET. It's lightweight, easy to integrate, and offers solid protection for most modern .NET applications. It has virtualization feature and not widely used so there's no any public tool. I'm actively working on improving it and open to feedback. You can find more info below and our community channels in the website. Website
    1 point
  28. 1 point
  29. i have the same problem as you
    1 point
  30. Can anyone share shadows version of x64dbg I have the standard version (vanilla) with scyllahide plugin but The enigma i work at always detect the debuger so maybe shadow version of x64dbg will solve this problem thank you all
    1 point
  31. If you are familiar with the Armadillo program, you will remember that this software had a very interesting feature called "Nanomits", which was created to prevent dumps from being taken from protected processes. The source code below is actually a re-engineered version of the original product's behavior that is available to everyone https://github.com/NIKJOO/Nanomits Give repo a star if you find it useful.
    1 point
  32. not so much , in modern CPUs you feel nothing
    1 point
  33. View File VMProtect x64 v3.6 HWID Lock (All Protection Options) Unpackme x64 - VMProtect 3.6 HWID License (All Protection Options) VMP x64 SDK + HWID Lock +etc... WwW.Tuts4you.CoM https://forum.tuts4you.com/ If you can unpack it, please make a tutorial... I will mark the answers with tutorials as a solution. The compressed package includes a simple MP4 display, please pay attention to check... Created by boot / From Tuts4you 2023.06.21 Submitter boot Submitted 06/21/2023 Category UnPackMe  
    1 point
  34. i may banter a lil in the opening, but that is how i was taught when i was in highschool learning ASM from the ukranians and russians, bootkits from the chinese You give a short shoutout or point to be made and ya write and code Here, i use the LCRN (LCG) from the GiantBlack Book of Viruses (Physicist Dr. Mark Ludwig) and his 16-bit many hoops and recreated it for x86 (32 bit) VXWriteUp.pdf
    1 point
  35. By the way .... we can reduce the size by removing the SysUtils and resource (no need for that) : SysUtils; {$R *.res}
    1 point
  36. Great! Based on the sample you provided, I successfully built x86/x64 binary files. aspr_ide_msvc.zip
    1 point
  37. a small one built in assembly aspr_ide.rar
    1 point
  38. I recommand the people to use this protection because it's very good. The protection is advanced like Pelock but very good. Only a real reserver can do it But it needs much times to be able handle it. UnpackMe.Obsidium.1.69b1.x86_unprotect.rar
    1 point
  39. You're lying! 1. What you do is just use a tool to earn money for you, the tool isn't yours, the PR isn't made by you, nothing is yours. 2. When you're accused, you attempt to let us believe you do many many things, but all you do is just download a tool and then find it doesn't work, and then you have to ask for unpacking here, like you rename real software to 1.dll/test.exe and disguise it as unpackme. 3. Most files you uploaded are client's files to make money for you: (1) This is a famous game cheat, many clients ask for cracking, so you ask for unpacking it many times. https://forum.tuts4you.com/topic/32843-ilprotector-unpacker/page/7/#findComment-222472 https://forum.tuts4you.com/topic/32843-ilprotector-unpacker/page/8/#findComment-223427 (2) A commercial software, disguised as unpackme by renaming to 1.zip https://forum.tuts4you.com/topic/32843-ilprotector-unpacker/page/8/#findComment-222582 (3) Two different commercial softwares, one is for CAD, one is for Kingdee, you want people to unpack 2 softwares at the same time. https://forum.tuts4you.com/topic/44372-net-reactor-v69/#findComment-224036 (4) Disguise as UnpackMe, administrator @Teddy Rogers found and deleted it. https://forum.tuts4you.com/topic/41297-smd-for-agile/page/6/#findComment-223653
    1 point
  40. Hello, everyone. Is this enigma x64 one still able to be bypassed? Waiting for your replies as soon as possible. Many thanks in advance. Regards. sean.
    1 point
  41. A complete version of the web site has been converted into a Windows executable. It looks and behaves like the site, but with the added benefits of : No adverts Search facility for finding Run Time Library entries and .Net Methods. Fast access to 1,000+ pages of tutorial/reference pages - the full site and more System.Drawing.Graphics .Net class pages - 44 methods each with examples illustrated with graphical output Printing of pages precisely to any paper size or format RTL lists printable by letter, function, unit or category History drop-down of recent and popular RTL pages Database tutorials, not available on this web site Copy full text copy is enabled at last (the secret revealed by a user) Delphi Basics Offline 7.3.zip Serial.txt
    1 point
  42. @ziyoulang168 Use this. aspr_api.zip Regards. sean.
    1 point
  43. The easy way with "CodeDoctor" plugin ==>> Unpack Asprotect .... & you just need to add aspr_ide.dll file
    1 point
  44. There are two private plugins I have written myself, which can support to search sequences for command for xDbg. They are not yet complete and have many bugs, currently in version 0.0.0.2. They may continue to update in the future... PS: I am trying to solve how to be compatible ?? ?? Fuzzy matching of forms and special mnemonics, such as the problem of CONST or R32/R16 or [R32]/[R16] Who can provide some ideas? Search4Sequences_v0.002_x86_x64.rar
    1 point
  45. Difficulty : 8 Language : C++ Platform : Windows 32-bit and 64-bit OS Version : All Packer / Protector : VMProtect 3.0.9 Description : The objective is to interpret virtualized functions in the attached binaries. No additional options have been used - no memory protection, no import protection and no compression. The virtualized function(s) will execute when the following key(s) is/are pressed: VMP32 (V1) : P VMP32 (V2) : 1 and 2 VMP64 (V1) : P VMP64 (V2) : 1 and 2 The virtualized functions are not very large. Detailed information of the interpreting procedure/internals or a complete solution paper is preferable. I will post similar challenges for other protectors if someone supplies me with a recent version (CodeVirtualizer, Themida, Enigma ...). Accepted solutions: VMP32 (V1) : @Raham VMP32 (V2) : @Raham VMP64 (V1) : @SmilingWolf @fvrmatteo VMP64 (V2) : @fvrmatteo @SmilingWolf @mrexodia @xSRTsect Files: devirtualizeme32_vmp_3.0.9_v1.rar devirtualizeme32_vmp_3.0.9_v2.rar devirtualizeme64_vmp_3.0.9_v1.rar devirtualizeme64_vmp_3.0.9_v2.rar Screenshot :
    1 point
  46. Hi Guys and here is my solution for 32bit one. devirtualizeme32_vmp_3.0.9_v1_deVM_Raham.zip PS: my decompiler is in progress state, so tell me if you found mistake in X86 instructions. Kind Regards
    1 point
  47. CreateToolhelp32Snapshot + Process32Next -> works fine on win 7 64bit injecting 32bit dll in 32bit process -> works fine win7 64bit injecting 32bit dll in 64bit process -> fail CreateToolhelp32Snapshot + Module32First + 32bit process wants to read 64bit process -> probably fail
    1 point
×
×
  • Create New...