Leaderboard

StrongName tools: - added SamePKT tool - added 64 bits support for all tools StrongName2.rar

I wanted to devirtualize it manually so I made a disassembler for it using the new yara-x to locate the handlers and the bytecode. Probably going to turn it into a full devirtualizer from binaryshield bytecode straight to x86_64. I saw these values(the one in the cmp comment) put them as input since it was valid I didn't go further. You can find my work at https://github.com/xlatbx59/Bshld, the file with the disassembly is at https://github.com/xlatbx59/Bshld/blob/master/binshield.txt. It was fun to reverse

No, the above script won't work due to Themida anti-debug tricks, even if program starts with the debugger. I got to say: Themida is great protector. Too bad about antivirus detections like https://www.malwarebytes.com/blog/detections/riskware-patcher-themida I made some new updates to Unlicense: - fixed winlicense v3 detection for the above https://storage.custos.dev/ResourceCryptor_latest.7z - fixed imports for winlicense v3 x64 OEP still needs to be fixed as currently stops before real OEP; You could try --force_oep: --force_oep=0x0115E 0x0115E = OEP rva; as long as you know OEP rva. unlicenseFixed2.rar

Unfortunately you didn't include the entire command-line and the whole log. In general, this VS error indicates that VS cannot find the required include files. You either didn't run it from the "Developer command prompt for VS 2022" OR you don't have the the correct SDKs of Visual Studio installed, OR the PATH variable is borked in some way.. There are several workarounds: Option A: use a Python version from that time period. In my tests Python v3.9 works out of the box and doesn't even need VS Build Tools. Option B: change version requirements for the project: 1) make a folder for unlicense, say c:\projects\unlicense 2) open command prompt, change to that folder and clone the unlicense repo there: git clone https://github.com/ergrelet/unlicense.git . Or just download ZIP and unpack it into that folder. 3) edit pyproject.toml to change versions of python packages. For you, the most important is the xxhash version, pick one where there is a pre-compiled wheel file available for your version of Python. I'd use "^3.6" there, it seems to be compatible. If that does not work, try "^3.1", that's the oldest version with a pre-built v3.11 wheel. That should be enough for you. 4) run pip install . - it should run build process, find the pre-built packages in PyPI and happily use them, instead of compiling xxhash from source. Option C: try installing/building xxhash package and figure out what went wrong. Ain't got no time for that..

Here compiled unlicense with codeexplorer's fixes: unlicense compiled With pyton 3.09 and 3.11 versions.

"THEMIDA OPTION_ADVANCED_OEP_IAT_SCRAMBLE" refers to a specific, advanced protection option within the Themida software protection tool. It is a setting that scrambles the Import Address Table (IAT) to make it harder for attackers to analyze the application's functions at the Original Entry Point (OEP), a key target for software cracking What it is: It's a Themida protection feature that modifies the Import Address Table (IAT). How it works: By scrambling the IAT, the option makes it significantly more difficult for attackers to identify and analyze the functions the program uses at its Original Entry Point (OEP). Purpose: The goal is to enhance the security of the application by complicating reverse-engineering and cracking attempts that often rely on manipulating the OEP and IAT. OPTION_ADVANCED_OEP_IAT_SCRAMBLE VALUE YES

This setting breaks existing public unpackers

NtUserGetForegroundWindow also has to marked for some advanced targets In my tests Unlicense has some problems with virtualized entry points: sometimes the targets starts, sometimes it doesn't start.

And here is my first fix: fixed jmp dword ptr [import thunk] on old version was wrongly fixed by call dword ptr. imports_fixed1.rar

Hi everyone, Maybe some of you heard it already, but Sigma and I are working on an x32/x64 debugger for Windows for a few months now... The debugger currently has the following features: variables, currently command-based only basic calculations, can be used in the goto window and in the register edit window. Example: var*@401000+(.45^4A) software breakpoints (INT3, LONG INT3, UD2), currently command-only (just type 'bp addr') hardware breakpoints (access, write, execute), also command-only stepping (over, into, out, n instructions), can be done with buttons/shortcuts memory allocation/deallocation inside the debuggee quickly access API adresses (bp GetProcAddress) syntax highlighting, currently not customizable simple memory map (just addr+size+module+protection basically) The debugger has an easy GUI, for which we looked a lot at Olly Debug engine is TitanEngine, disassembler BeaEngine, icons are from various sources (see About dialog). We use QT for the GUI part. If you have a suggestion, a bug report, need more info, want to contribute, just post here or send me a private message. The latest public build + source can always be found on http://x64dbg.com (click 'Source'->'bin_public') to download the latest build. For now, you can also download the first 'alpha' here We would love to hear from you! Greetings, Mr. eXoDia & Sigma

Up!

I am trying to compile Unlicense https://github.com/ergrelet/unlicense I've installed vs_BuildTools.exe VS 2022 However when I run: pip install git+https://github.com/ergrelet/unlicense.git I get: https://ibb.co/BKPT5MHf How to fix the above error?

git clone https://github.com/ergrelet/unlicense.git cd unlicense ### Replace the necessary files with your updates pip install --upgrade pip pip install . pip install pyinstaller pyinstaller unlicense.spec

I don't know how to create exe with PyInstaller. Also I didn't finished my updates yet.

Only a moderator or the author can mark as solved. I have removed solved status for this challenge. If there are posts incorrectly marked as solved please report or send me a PM... Ted.

Both options are useless.

Hi unfortunately you can't find correct hwid from license key

Hi guys, I've been working on an Appfuscator string decryptor which I used on a malware called Gremlin Stealer ( https://bazaar.abuse.ch/sample/d21c8a005125a27c49343e7b5b612fc51160b6ae9eefa0a0620f67fa4d0a30f6/ ). I used the AsmResolver library. It still needs two things: replace variables by their value and patch ternary operators to decrypt all the strings. I guess I need to look at the control flow graph for that. You can take a look and even contribute or give suggestions on how to approach the problems. GitHubGitHub - lowlevel01/deGremlin: Decrypt and Patch strings...Decrypt and Patch strings obfuscated with Appfuscator. Tested on Gremlin Stealer. - lowlevel01/deGremlin

The target has a license server that collects minimal, anonymized information about the launch. Information about debugger detections, code integrity violations, launches in virtual environment, etc. is also transmitted to the license server. Most likely, you simply did not reach the point where the application would display a MessageBox with a message about detecting a debugger. The debugger was detected by 3 out of 3 methods, ScyllaHide was unable to deceive any of them. The screenshot shows the log of your last target launch.

rar file is password protected

I don't have hwid themida crackme. I have licensed Themida v3.1.8.0 Themida v3.2.2.22. Can someone test this, specially build for OPTION_ADVANCED_OEP_IAT_SCRAMBLE, but it must find OEP for standard options also. It is an x96dbg script; my first fixed x96dbg script: Themida v2.x.x.x OEP Finder fixed.txt https://workupload.com/file/n7nE5xJ9vCM

Even TitanHide won't help against this target This is because most people do not know how to properly configure the protection options for Themida. Most just use the default settings.

Server is up , woth better uplink !Use webdav client. like WinSCP host : https://eddynet.cz:9865 u: learn p: 4EKS9umUYme3WAZrC

Many thanks. Python v3.9 did the trick. Other command line I have to run: pip install poetry pip install yapf poetry run unlicense instead of poetry run yapf -r -d unlicense

Here is little video i can make. tool I use.rar Edit: Rar Pas 1

damn it's already been taken down :/ thank you for trying to upload it anyways!

Reverse Engineering Denuvo in Hogwarts Legacy Slides Sogen Emulator Source Ted.

Seems like we have a winner! 👍

damn it! this is GENIOUS! (instead of WinAPI old dirty crap!!!) easy! just read the docs :) built a binary using that multi-precision lib: (left vs last build fom @Stuttered ) FileSizeCALC_0.0.11.zip

Update v0.0.10. Thx @jackyjask for pointing to the BigNumber library and assist. See attached. FileSizeCALC_v0.0.10.rar

Only because this is how the online app does it, I guess? this — PostimagesApp still needs some clean up, and the stretchable is fine. The internal VER I don't care about atm. Nice! I'll take a look at the changes.

not a bug just curiuos - why TB, PB lines are always showing e+-xxx scientific format? also would be nice to allow resizing the window as for big values one need to use scroller..... wow! why is that? :) nice to have - actual build -

hi, i am new to devirtualization topic and this challenge was very good for beginners and me. first, my goal was not just obtain the keys but devirtualize whole function automatically and recompile back to be able to patch it. i lifted handlers to LLVM IR and recompiled in a new binary to analyze it this is my final output i know its a little difficult to read, but at least you can see the correct keys clearly if you look at if statements. sadly, code crashes at runtime, i dont know why. it will probably take really long time to identify the problem. i dont think i will do that. maybe i might try VTIL instead of LLVM. i would like to see others approaches on fully devirtualizing this vm. great challange again.

Would yuo like send valid registration otherwise it's christmas day so I have free times for challenge this one for this last years? Merry Christmas day for everybody 🎂🍾🎉🎊😁🤭.

Antidebug is available in the final version

Sry, but super hyper antidebug,antihijack and etc. dosnt work also whit x64dbg .... You made the protection worse than ever, any cracker will break it. One jump and fake screen bye bye see my pic...

U use again some cheap trick heree but , u know result ..... Keep in mind that I cracked the latest dongles Guardant,Senselock and etc. this will that stop me? name: Mr.Leng key:B4HMR2CA76ACVESM2CL7A7X355RQ63RLGYYVW5VYEV48FWGJ8DZRJ44C78SFN3FF9PPF6UBUERAKCJUY9YJXGT3DXB9JX78A39YLBHUFUDGT @lengyue real hwid is here other vmp instruction u are add here on this target are bullshit rva:451904 Enigma shutdown.rar

let's give a try

Nice. How to do?

Fun and not too difficult challenge. I always like me some VM crackmes Valid keys: Had enough fun reversing this so I made a full writeup with disassembler and devirtualized code: https://blog.washi.dev/posts/binaryshield-vm-crackme/

I need Tips on how to make enigma protector hard to bypass by check some boxes

Hi Short tutorial for bypass Safengine 2.4 HWID Regards. Safengine Short Tutorial.rar

@Sh4DoVV Can you bypass it without the license key file? Use this key file. Win64GUI.key Regards. sean.

These Chinese forums are paid and you need to be Chinese to join....Chinese people want to learn from our forums but they don't accept any NO-Chinese to learn from them - using websites like Baidu to upload or video hosters that need Chinese number also.

Video_2024-02-12_112004.mp4 Regards. sean.

I remember a previous conversation where CodeCracker asked for something related to Eazfuscator, but I can't recall the specific question. However, I do remember that you provided a solution but I'm surprised that you didn't share your tool, as most beginners nowadays use CodeCracker's tools. He's a humble person who sets a good example for the community. What have you contributed so far? The previous generation loved to share knowledge, but now the well-known reversers keep things private. I understand that some people still copy-paste for profit, but there are also genuine individuals who want to dive deep into the field. Unfortunately, many people have quit, because it's a struggle to learn more without a master. It's hard to find one these days. Ra1n, I know you're skilled, and I'm sorry for what I said, but it's the truth. The reversing community is dying. I miss the good old days when the best were humble and shared their knowledge.

Console example x64plgmnrc.exe -G "C:\x64dbg_root" // Set root path for x64dbg x64plgmnrc.exe -U // Update list from server x64plgmnrc.exe -S // Show list of plugins x64plgmnrc.exe -i x64core // Install last version of x64dbg x64plgmnrc.exe -i AdvancedScript // install AdvancedScript https://github.com/horsicq/x64dbg-Plugin-Manager

How to Unpack this VMProtect 3.5 Challenge - 2022/01/10 by @BlackHat Tutorial : Video Tutorial : Best Regards BlackHat awesome.vmp35_BH_unp.exe