Leaderboard
-
CodeExplorer
Team Member57Points4,576Posts -
Stingered
Full Member19Points132Posts -
LCF-AT
Full Member+16Points6,228Posts -
Price
Full Member15Points39Posts
Popular Content
Showing content with the highest reputation since 02/15/2026 in all areas
-
3 pointsYou Chinese are showing off again. Hurry up and upload the patch3 points -
2 pointsI found the way I have define that struct in MASM64: MODULEINFO STRUCT lpBaseOfDll DQ ? ; Base address of module SizeOfImage DQ ? ; Size of the module in bytes EntryPoint DQ ? ; Entry point of the module MODULEINFO ENDS GetModuleInformation return proper value.2 points
-
1 point -
1 pointThis is what I thought at first; anyway declarated like this doesn't works; SizeOfImage has to be also a qword.1 point
-
1 point -
Just wanted to post my solution here for anyone who might stumble upon this thread. GitHubGitHub - hekliet/tsrh-kgm: Keygen for TSRh TeaM Trial Key...Keygen for TSRh TeaM Trial KeygenMe #1. Contribute to hekliet/tsrh-kgm development by creating an account on GitHub.The 'keygen' provided in this repo is a simple command line program that takes a line of input (the username) from stdin and prints a regcode. It should compile anywhere. MSVC users might have to substitute getline with gets or something, I don't know. A keygen that looks pretty and plays music can be found here: https://hekliet.nekoweb.org/tsrh-kgm/tsrh-kgm1-keygen.zip It's a Win32 executable that also works in Windows x64 and was coded on Linux using MinGW. No video, sorry.1 point -
1 point -
1 pointHi Codexplorer, First of all, I wanted to say a huge thank you for your work on the Unlicense project and for sharing your compiled version/updates. It’s an incredible resource for the community. I've been testing the tool on some specific WinLicense 3.x protected targets (specifically 32-bit/x86 binaries). While the tool works great on many samples, I encountered a few hurdles with recent Python/LIEF environments and x86 targets that might be worth looking into for a future improvement: LIEF Compatibility: Recent versions of LIEF (0.17+) seem to have changed some attributes (like MACHINE_TYPES moving to Header.MACHINE_TYPES) and now return section names as bytes instead of strings, causing TypeErrors in dump_utils.py. Frida RPC Stability on x86: I've noticed frequent TypeError: not a function errors during the setupOepTracing or enumerateModuleRanges calls when targeting x86 apps on Windows 10/11. This often leads to AccessViolation because the IAT resolution gets interrupted or fails to map correctly. Forced IAT/OEP: On some complex targets, adding a more robust "forced mode" for OEP and IAT (bypassing the Frida instrumentation if the user already knows the addresses) helped me get further, but a native implementation in your branch would be amazing. If you have any plans to optimize the x86 engine or update the dependencies handling for the newer LIEF versions, that would be a game-changer for those of us working on older automotive or industrial software. Thanks again for the hard work and for keeping this project alive! @CodeExplorer Hi Codexplorer, First of all, I wanted to say a huge thank you for your work on the Unlicense project and for sharing your compiled version/updates. It’s an incredible resource for the community. I've been testing the tool on some specific WinLicense 3.x protected targets (specifically 32-bit/x86 binaries). While the tool works great on many samples, I encountered a few hurdles with recent Python/LIEF environments and x86 targets that might be worth looking into for a future improvement: LIEF Compatibility: Recent versions of LIEF (0.17+) seem to have changed some attributes (like MACHINE_TYPES moving to Header.MACHINE_TYPES) and now return section names as bytes instead of strings, causing TypeErrors in dump_utils.py. Frida RPC Stability on x86: I've noticed frequent TypeError: not a function errors during the setupOepTracing or enumerateModuleRanges calls when targeting x86 apps on Windows 10/11. This often leads to AccessViolation because the IAT resolution gets interrupted or fails to map correctly. Forced IAT/OEP: On some complex targets, adding a more robust "forced mode" for OEP and IAT (bypassing the Frida instrumentation if the user already knows the addresses) helped me get further, but a native implementation in your branch would be amazing. If you have any plans to optimize the x86 engine or update the dependencies handling for the newer LIEF versions, that would be a game-changer for those of us working on older automotive or industrial software. Thanks again for the hard work and for keeping this project alive! @CodeExplorer1 point
-
Bypassed the license check but unpack is too complicated. The imports are very heavy wrapped. Can do it but few hours manual work will need.
1 point -
This one is an interesting sample. Code is really small, so it was stolen completely, thus it's hard to tell app code from protector code. Functional code is quite simple, just MessageBoxA. And that's it, it does nothing more. After showing the message box it starts freeing memory that definitely isn't app code. But for the sake of completeness let's get to the bottom of this. We have 8 more code bytes. And we have 1 reloc pointing there, meaning ExitProcess should perfectly fit in. Unpacked file attached with code, import and relocs restored and sections cut. unpacked.exe1 point
-
1 pointThis one is quite easy or easy protection options were chosen. Import isn't redirected. EP code is restored, sections are cut, resources rebuilt. Had to cut it in 2 parts. unpacked.part1.rar And part 2. unpacked.part2.rar1 point
-
@0X7C9 pls can u upload https://tut4u.com/hexorcist-reverse-engineering-course/ in your webdav server1 point -
1 point -
1 point -
1 point -
You can provide Another link & And solve this problem
1 point -
Server is up , woth better uplink !Use webdav client. like WinSCP host : https://eddynet.cz:9865 u: learn p: 4EKS9umUYme3WAZrC1 point
-
1 point -
Someone please share zero 2 automated reversing course. Thank you.1 point -
I added 64 bit support and generic extraction HydraDragonAntivirus/MegaDumper: Fixed 2025 version of Mega Dumper1 point -
some old tools to dump LTPs (199x, 200x) https://workupload.com/file/DarwJdWpGR81 point -
Today I release an unpacker script for Enigma Protector. Maybe you know that I created another unpacker script for Enigma in the past which no-longer works for protected Enigma files greater than 3.70+ and this is the reason why I wrote a new script, Enigma Alternativ Unpacker 1.0. So what is new in this script? This script will unpack your Enigma protected files and dump the used outer virtual machine. This means you do not need to use the DV / Enigma plugin which is used in my other script. Of course the virtual machine will be still virtualized but your unpacked files will work. It is not the best solution but for the moment it is a good "alternativ" and a working solution. Features of the script: ( 1.) Unpacking of ENIGMA 1.90 - 3.130+ ( 2.) RegSheme Bypass & HWID Changer ( 3.) Enigma CheckUp Killer ( 4.) VirtualMemory Dumper 1.90 - 3.x+ & SC Fixer M1 ( 5.) UIF Tool Necessary Sometimes! ( 6.) Enigma Intern Export & VM Scan + Log ( 7.) Improved Import Emulation Fixer ( 8.) Supports Exe & Dll Files [dll at EP!] This new script again covers almost all the protection features of Enigma Protector like my other script but it has been improved and I have added some extra things that you will see when you get to use it. I have created four video tutorials for you where you can see what you have to do in some of the different situations you may experience. Be sure that you "watch the videos" before you use the script to prevent some unnecessary questions where you can already find the answers if you watch them and then read my added text files. I also made an UnpackMe set with six different protected files (watch videos how to unpack all of them). If something does not work for you or if you get any trouble or have any questions then just post a reply on the topic (linked above) to get an answer.1 point -
1 point- Patch CRC_CHECK: 0x0046FB8D - I think I need some time to modify the source code of shfolder.dll Video_2024-01-16_170946.mp41 point -
1 point -
When new malware are discovered, it is important for researchers to analyze and understand them as quickly as possible. This task has been made more difficult in recent years as researchers have seen an increasing use of virtualization-obfuscated malware code. These programs are difficult to comprehend and reverse engineer, since they are resistant to both static and dynamic analysis tech-techniques. Current approaches to dealing with such code first reverse-engineer the byte code interpreter, then use this to work out the logic of the byte code program. This outside-in approach produces good results when the structure of the interpreter is known, but cannot be applied to all cases. This paper proposes a different approach to the problem that focuses on identifying instructions that affect the observable behaviour of the obfuscated code. This inside-out approach requires fewer assumptions, and aims to complement existing techniques by broadening the domain of obfuscated programs eligible for automated analysis. Results from a prototype tool on real-world malicious code are encouraging.1 point
-
0 pointsHi, Can someone provide MODULEINFO structure in MASM64? invoke GetModuleInformation, hProcess, qword ptr [rax], addr modInfo, sizeof MODULEINFO I realized that MODULEINFO structure is not defined anywhere!0 points
