Leaderboard

PEP - Private exe protector is closed commercial project but i decided to share it's source code ( I purchased it about 2300 USD long time ago ) Add star to repo if you like https://github.com/NIKJOO/PEP

I have already conducted testing before, and if you compile the 32-bit plugin according to the original source code provided here (https://bbs.kanxue.com/thread-282244.htm). Original 32-bit (Imperfect Version).zip This plugin is effective on Win7 x64 SP1; But it fails in Win10/11 x64. e.g. VMP_3.8.7_x86_32-bit.vmp.exe Win7 x64 SP1 √ Win10 x64 × Win11 x64 × By recompiling the 32-bit plugin according to the modified code provided by karan, the above issue has been resolved. The revised and recompiled complete version is now uploaded as follows, and has been tested to be effective in Win7/10/11 x64. ScyllaHide_2024_x86_x64_v0.002.zip

You will find the source code for aspr_ide.dll, a dynamic link library used in software licensing and protection, specifically for applications protected by AsProtect. This DLL simulates various functions related to license validation, registration, trial period management, and hardware ID checks. With ❤️ aspr_ide.dpr

My writeups are live now: https://washi1337.github.io/ctf-writeups/writeups/flare-on/2024/

Unpacked+devirtualized: unpacked.exe Cleaned (vmp 100% removed): cleaned.exe

WindowsFormsApplication4.vmp35.exe: 1. VMUnprotect.Dumper https://github.com/void-stack/VMUnprotect.Dumper/releases/tag/1.1.0.0 2. Unset "IL Only" Flag from .NET Directory with CFF Explorer 3. Demutation Tool https://forum.tuts4you.com/topic/45162-demutation-vmprotect-net https://forum.exetools.com/showthread.php?t=21105 4. de4dot Use --keep-names ntpfg while cleaning the file using de4dot Or use --dont-rename 5. VMP Killer by DarkBullNull Use Option 2 First and Fix CRC and Debug Check https://github.com/DarkBullNull/VMP.NET-Kill https://forum.tuts4you.com/topic/45179-vmpnet-kill/ https://forum.exetools.com/showthread.php?p=131964 6. Unset "IL Only" Flag from .NET Directory with CFF Explorer 7. Use VMProtectNoDelegates to clean delegates https://forum.exetools.com/showthread.php?t=21106 https://forum.tuts4you.com/topic/45163-vmprotectnodelegates-net The only thing left if unvirtualization. WindowsFormsApplication4.vmp35-decrypted-demutate-cleaned.justify_nodel.rar

v1.0.0.4 https://github.com/mrfearless/MediaPlayer/releases/tag/1.0.0.4 Added /close command line option to close MediaPlayer once play ends (request from vitsoft on masm32 forum). Also added /minimized, /fullscreen and /volume:xx command line options. Add Ukrainian language menu resource (thanks to greenozon). Add Ukrainian language tooltips (thanks to greenozon). Add Persian language menu resources (thanks to Yashar Mahmoudnia). Add Persian language tooltips (thanks to Yashar Mahmoudnia). Add Right To Left Layout for Persian language selection (thanks to Yashar Mahmoudnia for testing). Changed play rate from slower/faster menu and buttons to a playback speed submenu and a button with a dropdown menu. Added audio stream switching via a submenu and a dropdown menu (from volume mute toggle button) (request from makson5 on github). Playback speed and audio stream menus are dynamically created when a media item is loaded. Otherwise menu will show a menu item showing "Unavailable". i button tooltip displays filename as well now. Holding CTRL whilst clicking on Help->About or i button will open folder containing MediaPlayer's ini file. Fixed menu items width on menus still showing very long widths after clearing MRU list. String resources are now compressed with rtlc in a block and are loaded and decompressed per language selection on first access. Removed some string resources, icons and bitmaps that are now redundant. MediaPlayer-x64.zip MediaPlayer-x86.zip

Moved to a new server with better hardware and a new operating system. There is a short and long version as to why it took so long. Short version, it was initially planned to be only a few hours of downtime. Had it been successful most people would never know there was an outage. Unfortunately it turned to shit. Piecing together all the bullshit from the hosting company (and registrar for the primary domain) they had issues accessing and making changes to the domain to disable DNSSEC and point nameservers to the new server. When I purchased the domain decades ago, the hosting company was in its fledgling years and the domains have been held with a relic/ legacy product of theirs. It would seem between 10 months ago (when they last made similar changes for me) and last week they have either lost access or control to make changes to the domains. This is what I have pieced together after numerous calls and online chats with them to get it resolved... Ted.

Hello! I am 14yoKID , and i have documented everything tothe best of my ability. If you have any questions, please feel free to reach out or respond to my solution. I appreciate any feedback or discussion. The first step is to look inside the crackme’s binary for any references to “Wrong key!” (the error message). We load the executable into a disassembler or debugger (IDA, x64dbg, or similar). A quick search reveals that “Wrong key! Try again.” is located around the following code: 00408C3E | A1 0CA34000 | mov eax, [0x40A30C] 00408C43 | BA D48C4000 | mov edx, 0x408CD4 ; "Wrong key! Try again." This is where program prints the "Wrong Key! message. Scrolling above that reference,we see : 00408C16 | A1 98B74000 | mov eax, [0x40B798] ; loads the user's computed key 00408C1B | 3B05 ACB74000 | cmp eax, [0x40B7AC] ; compares it to the correct key 00408C21 | 75 1B | jne 0x408C3E ; jump if not equal => "Wrong key!" This shows: The user’s input key is stored at [0x40B798]. The “correct” key resides at [0x40B7AC]. If these two values do not match, we jump to the code that prints “Wrong key! Try again.” If they do match, we take the path that prints “Correct key!, Now Try to Keygen ME !” Finding Where [0x40B7AC] Is Set : Quick look upword in disassembly reveals: 00408BB0 | E8 5BFEFFFF | call 0x408A10 00408BB5 | A3 ACB74000 | mov [0x40B7AC], eax So at address 0x00408BB0, we call a function (which we’ll refer to as sub_408A10). Right after that call, we store EAX into [0x40B7AC]. That means the function at 0x00408A10 produces the correct key in EAX. To finally find a key set a breakpoint at 0x00408BB0 or directly inside sub_408A10 at 0x00408A10. Run the program and break on that address,press F7 ( Step into ) the call to examine how the function computes EAX. Inside sub_408A10, we notice: It reads a hard-coded byte 0x5A from [0x40A298] It loops exactly four times over bytes stored at [0x40A29C..0x40A29F] ( for instance , 0xA5 , 0x3C , 0xD7 , 0x82 ) Each iteration does some arithmetic: XOR , multiply by 12345 , add 0x6789, shift bits, etc. After finishing four iterations, it multiplies EAX by 0xDEADBEEF , does a final XOR and then returns EAX. Stepping through the entire function, we see that every run ends with a single final value: EAX = 0x8981B3E0 Then writes this to [0x40B7AC]. Therefore, the correct key is a constant number: 0x8981B3E0 ( OR IS IT?? ) Even though we know the internal number is 0x8981B3E0 , how do we type it so that crackme accepts it? By stepping into the function that processes (sub_4060A8 or sub_4045D4), or simply by trial and error, we learn: The crackme expects a leading '$' to interpret the rest of the text as hex. Typing XXXX1B3E0 ( dont want to spoil fun for others ) is interpreted as the hex value 0x8981B3E0. This matches the stored correct key, so the crackme prints : Correct key!, Now Try to Keygen ME ! But why $? In this particular crackme, the $ symbol is how the program’s input-parsing routine recognizes the user’s entry as a hexadecimal number. Without the '$' prefix, the code typically treats your input as decimal (or otherwise misreads it). Since the “correct key” is stored internally as the hexadecimal value 0x8981B3E0, the crackme will only accept a matching hex number—and it specifically wants you to indicate “hex mode” with '$'. That’s why typing 0x8981B3E0 or plain 8981B3E0 fails: the program doesn’t parse those formats as the same 32-bit value. Only '$8981B3E0' matches the exact hexadecimal integer 0x8981B3E0 the crackme expects. The final answer of mine and correct/valid key is :

Hi @fearless, thanks for the new upload and the special AI podcast. I created a simple video with subtitle on it and attached another video with subtitle added as own track to have an better quality on reading. Just made for fun and for all who like reading at same time when hearing the podcast. Creating Controls In Assembler - Subtitle on Video.mp4 Below the attached video. Creating Controls In Assembler - Subtitle Track.7z greetz

A basic media player application written in x86 and x64 assembler that utilizes the MFPlayer-Library - which consists of functions that wrap the MFPlay COM implementation of the IMFPMediaPlayer and IMFPMediaItem objects. https://github.com/mrfearless/MediaPlayer Features Supports audio and video media that is natively supported by the Microsoft Media Foundation API Player controls via toolbar buttons, menu or context menu: Play/Pause Toggle, Stop, Frame Step, Volume Mute/Unmute, Fullscreen toggle, About, Exit. Custom control for Volume slider. Custom control for Seekbar slider. Custom controls for Labels (for duration of media and current position). Fullscreen enter via toolbar button, menu, context menu or F11. Fullscreen exit via toolbar button, menu, context menu, F11 or Escape. Spacebar toggles play/pause. Open media via File menu, context menu, clicking screen logo, clicking play button or drag and drop. Uses the FileDialog-Library Download The latest releases can be downloaded at https://github.com/mrfearless/mediaplayer/releases Edit: Attached v1.0.0.5 releases. MediaPlayer-x64.zip MediaPlayer-x86.zip

v1.0.0.1 https://github.com/mrfearless/MediaPlayer/releases/tag/1.0.0.1 Changed default codebase for x86 and x64 MediaPlayer to use wide/unicode for better handling and display of unicode filenames #2 #3. Ini file now is created with BOM to allow unicode - for MRU filenames. Ini file prepends a play/pause unicode glyph to its name (helps indicate that it is unicode perhaps?) Add clear recent files option (comment/wish from BOSCH on Tuts4you). Fix memory leak - missing DragFinish call #4. Fix transparent painting issue in about dialog box #1. Added use of ChangeWindowMessageFilter to better support drag and drop for UAC blocking drag and drop operations #4. Added play rate (slower/faster) buttons and menu items (request from Yashar Mahmoudnia on Tuts4you Telegram). Added step 10 seconds (backward/forward) buttons and menu items. Add additional accelerators for play rate and step 10 options. Add missing accelerator resource for x64 version (Thanks to jj2007). Combined toolbars to just one toolbar now. Edit: Fix small crash in x64 version when using slow/fast buttons or menu option - ebx instead of rbx in event notification callback - proper x64 version attached now MediaPlayer-x86.zip MediaPlayer-x64.zip

You mean few dozens of morons asking to crack random vmprotected executable? 😁 Now that's a really valuable "comuunity"!

I will be adding more courses https://pan.huang1111.cn/s/v8XwSE Pass:revteam.re

Since @Washi provided the solution first, you may mark his answer as solved. However, I’d like to share my approach as well for reference. 1) Polynomial Coefficients and Matrix 1. Username - Polynomial Coeffs The code has a function that folds ASCII values into 8 coefficients ( size = 7 ). For "CHESSKING" , we take each character's ASCII and add it to slot in the array. 2. Matrix Build We then build 5 x 5 integer matrix from these 7 coefficients. Each entry is computed via this formula : mat(r,c) = ( coeffs ( r mod 7 ) x ( c + 1)) + ( r + 1 ) ---> All in paranthesses from start has to be to the power of 2. 3. Determinant ( mod 65521 ) We do a row-reduction to find the matrix's determinant, and then take /bmod 65521. 2) Toy Elliptic-Curve Step The code defines a small curve: y2 ≡ x3 +Ax+B (modp), p=1201, A=1,B =1. ( x3 here is actually x to the power of 3 ) We have a base point G = ( 5,116 ) this goes : finalPoint= ECSM (G,detMod) That is, we "add" G to itself ( detMod ) times in elliptic-curve arithmetic. The result is ( X , Y ) . Then we define it with this formula : curveSecret= X+ (Y≪16) 3) LFSR Shuffle We take 64 bits (lowest bits) from curveSecret and feed them into a Linear Feedback Shift Register for 64 rounds, producing a new 64-bit integer lfsrOutput. This step effectively scrambles the bits further. 4) BFS-Based Knight Path The code starts at square E5 on a 10×10 board labeled A..J (files) and 1..10 (ranks). Internally, E5 is (4,4) in 0-based coordinates. For each character in the username, we do: steps= (ASCII of char) mod 5 , then run a BFS for that many expansions. The BFS uses Knight moves (like (2,1), (1,2), etc.) with wrapping if we go off the board. We capture the last enqueued square after those BFS expansions, add that to our path, and repeat for the next character in the username. 5) “Check to the King” There is a King placed on G10 → (6,9) in 0-based coordinates. We look at the final square in our BFS path. If that final square is one knight’s move away from (6,9), we do an extra step: lfsrOutput  =  lfsrOutput⊕0xA5A5A5A5 For "CHESSKING" , the BFS path’s last square does or does not cause this XOR. In our run, it does cause the XOR (i.e., it’s in position to “check the King”). 6) Nibble → Weird SAN Moves We take the final integer (lfsrOutput) and break it into 12 consecutive 4-bit nibbles. For each nibble, we pick a “weird” standard algebraic notation (SAN) chess move from the code’s move table. This yields moves like e2e4, Na3xb5, Qd1h5, etc. 7) Final Serial Part A: The BFS squares (space-separated). A dash ( - ) Part B: The 12 SAN moves from the nibble-based table. Verifying everythin we gathered so far : For "CHESSKING" : E5 I3 C1 A7 G4 C1 C1 I8 E5 G4 After the code determines the King is in check, it XORs the LFSR output with 0xA5A5A5A5 Extract 12 nibbles → map to the weird SAN table. They all turned out to be mostly e2e4, with a couple of different ones in the middle (Bf1c4, d2d4) My final answer which is my Username and Serial Key is :

-src -ARTeam.esfv -Thumbs.db -Weakness of the Windows API.Part1.pdf WeaknessoftheWindowsAPI.rar

A simple Template in Delphi with only winapi Api_WindowWithControls.txt

Today I fed the gitbook I created into NotebookLM to create a deep dive podcast. This was the summary it created: I uploaded the deep dive podcast so that it can be downloaded. Its a 43MB .wav file with a duration of about 15mins. There was about 3 or 4 instances where the podcast "hosts" reference something that they say they touched on or talked about previously, but hadn't actually done so, but other than that its actually pretty good I would say. Here is the download link for the Creating Controls In Assembler Deep Dive Podcast: https://github.com/mrfearless/creating-controls-in-assembler/releases/download/Gitbook/Creating.Controls.In.Assembler.-.NotebookLM.-.Deep.Dive.Podcast.zip?raw=true The original online gitbook is here for reference: https://fearless.gitbook.io/creating-controls-in-assembler and pdf and .epub downloads are attached or available here: https://github.com/mrfearless/creating-controls-in-assembler/releases Creating Controls In Assembler-epub.zip Creating Controls In Assembler-pdf.zip

Fun and not too difficult challenge. I always like me some VM crackmes Valid keys: Had enough fun reversing this so I made a full writeup with disassembler and devirtualized code: https://blog.washi.dev/posts/binaryshield-vm-crackme/

As in every update, We got rid of the old bugs and got a new list of bugs.

I tested the original author's code and found that it doesn't seem to bypass the protection properly on x86 systems. VMProtect does not appear to search through the entire Export Table to find the desired function. So, I modified the code to overwrite the last export function of ntdll.dll with wine_get_version and then place the original function right after it. As a result, the bypass worked successfully! void AddWineFunctionName(HANDLE hProcess) { BYTE* remote_ntdll = (BYTE*)GetModuleBaseRemote(hProcess, L"ntdll.dll"); if (!remote_ntdll) return; SIZE_T readed = 0; IMAGE_DOS_HEADER dos_header; ReadProcessMemory(hProcess, remote_ntdll, &dos_header, sizeof(IMAGE_DOS_HEADER), &readed); if (dos_header.e_magic != IMAGE_DOS_SIGNATURE) return; IMAGE_NT_HEADERS pe_header; ReadProcessMemory(hProcess, (BYTE*)remote_ntdll + dos_header.e_lfanew, &pe_header, sizeof(IMAGE_NT_HEADERS), &readed); if (pe_header.Signature != IMAGE_NT_SIGNATURE) return; DWORD export_adress = pe_header.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress; if (!export_adress) return; DWORD export_size = pe_header.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].Size; BYTE* new_export_table = (BYTE*)VirtualAllocEx(hProcess, remote_ntdll + 0x1000000, export_size + 0x1000, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE); IMAGE_EXPORT_DIRECTORY export_directory; ReadProcessMemory(hProcess, remote_ntdll + export_adress, &export_directory, sizeof(IMAGE_EXPORT_DIRECTORY), &readed); BYTE* tmp_table = (BYTE*)malloc(export_size + 0x1000); if (tmp_table == nullptr) return; // Copy functions table BYTE* new_functions_table = new_export_table; ReadProcessMemory(hProcess, remote_ntdll + export_directory.AddressOfFunctions, tmp_table, export_directory.NumberOfFunctions * sizeof(DWORD), &readed); WriteProcessMemory(hProcess, new_functions_table, tmp_table, export_directory.NumberOfFunctions * sizeof(DWORD), &readed); g_log.LogInfo(L"[VMPBypass] new_functions_table: %p", new_functions_table); // Copy ordinal table BYTE* new_ordinal_table = new_functions_table + export_directory.NumberOfFunctions * sizeof(DWORD) + 0x100; ReadProcessMemory(hProcess, remote_ntdll + export_directory.AddressOfNameOrdinals, tmp_table, export_directory.NumberOfNames * sizeof(WORD), &readed); WriteProcessMemory(hProcess, new_ordinal_table, tmp_table, export_directory.NumberOfNames * sizeof(WORD), &readed); g_log.LogInfo(L"[VMPBypass] new_ordinal_table: %p", new_ordinal_table); // Copy name table BYTE* new_name_table = new_ordinal_table + export_directory.NumberOfNames * sizeof(WORD) + 0x100; ReadProcessMemory(hProcess, remote_ntdll + export_directory.AddressOfNames, tmp_table, export_directory.NumberOfNames * sizeof(DWORD), &readed); WriteProcessMemory(hProcess, new_name_table, tmp_table, export_directory.NumberOfNames * sizeof(DWORD), &readed); g_log.LogInfo(L"[VMPBypass] new_name_table: %p", new_name_table); free(tmp_table); tmp_table = nullptr; // Setup new name & name offset BYTE* wine_func_addr = new_name_table + export_directory.NumberOfNames * sizeof(DWORD) + 0x100; WriteProcessMemory(hProcess, wine_func_addr, "wine_get_version\x00", 17, &readed); DWORD wine_func_offset = (DWORD)(wine_func_addr - remote_ntdll); WriteProcessMemory(hProcess, new_name_table + export_directory.NumberOfNames * sizeof(DWORD), &wine_func_offset, 4, &readed); // Set fake ordinal WORD last_ordinal = export_directory.NumberOfNames; WriteProcessMemory(hProcess, new_ordinal_table + export_directory.NumberOfNames * sizeof(WORD), &last_ordinal, 2, &readed); // Get address of GetCurrentTeb function to be placed after the new function BYTE* get_current_teb = reinterpret_cast<BYTE*>(GetProcAddress(GetModuleHandle(L"ntdll.dll"), "NtCurrentTeb")); DWORD get_current_teb_offset = (DWORD)(get_current_teb - remote_ntdll); // Set new function address (wine_get_version) and GetCurrentTeb function address DWORD new_function_offset = get_current_teb_offset; WriteProcessMemory(hProcess, new_functions_table + export_directory.NumberOfFunctions * sizeof(DWORD), &new_function_offset, 4, &readed); // Setup new directory export_directory.NumberOfNames++; export_directory.NumberOfFunctions++; DWORD name_table_offset = (DWORD)(new_name_table - remote_ntdll); export_directory.AddressOfNames = name_table_offset; DWORD function_table_offset = (DWORD)(new_functions_table - remote_ntdll); export_directory.AddressOfFunctions = function_table_offset; DWORD ordinal_table_offset = (DWORD)(new_ordinal_table - remote_ntdll); export_directory.AddressOfNameOrdinals = ordinal_table_offset; // Change the offset of header data DWORD old_prot; VirtualProtectEx(hProcess, remote_ntdll + export_adress, sizeof(IMAGE_EXPORT_DIRECTORY), PAGE_EXECUTE_READWRITE, &old_prot); WriteProcessMemory(hProcess, remote_ntdll + export_adress, &export_directory, sizeof(IMAGE_EXPORT_DIRECTORY), &readed); VirtualProtectEx(hProcess, remote_ntdll + export_adress, sizeof(IMAGE_EXPORT_DIRECTORY), old_prot, &old_prot); } I confirmed that my Windows 10 version works fine. cheers! ScyllaHide_x86.zip

I did it too. View this youtube video for the solution. Regards. sean.

I can only wish you luck in your search 😄

Hi! I took a look at it and shame that no one tried to solve it,here is my approach. Basic things i pulled: All four keys must differ. If any two keys are the same string, it shows “All keys must be different.” No key can contain "0@0". If you type a key like "0@0@something", it rejects it. “Erjey” can be used at most once, and if it appears, the fourth chunk of that key must be less than 6. That is, if a key has the substring "erjey", its format is X@Y@erjey@W, and W<6W < 6W<6. The third chunk in each key can be one of three strings: erjey kao tuts4you If you use something else, you get badboy error message. 2.2. Internally, a Linear Solver Digging deeper, i discovered a set of classes (d, e, j, etc.) that build a system of linear equations or inequalities. Each key of the form X@Y@{erjey|kao|tuts4you}@W is taken to mean X⋅x+Y⋅yRELWX , where the “relation” REL depends on the keyword: erjey → equality (=). kao → some inequality (≥ or ≤) depending on puzzle logic. tuts4you → the other inequality. From hints in the code and trial tests, we saw that: erjey is effectively “=”. For this puzzle’s code, kao ended up being “≥” and tuts4you was “≤” (the code flips them). Finally, after the solver ensures a feasible solution for (x, y), it calculates an “objective value” from the Name field, which must also be in the format A@B (two doubles). The code uses: objective=A×x+B×y If that objective is exactly 44 000, it shows: MessageBox.Show("Valid combination!"); That is the central condition: Ax+By=44000. 3. Constructing a Solution To guarantee the solver yields 44,000, we needed to pick (x, y) and (A,B) so that: A×x+B×y=44000. Additionally, we had exactly four constraints (the “Keys”) to pin down x and y. 3.1. The Simplest Trick: Set x=y One common approach: force x=y=c for some integer c < 6 (because the puzzle disallows “erjey@W” if W >= 6). Then we just need: (A+B)×c=44000 then this becomes A+B = 44000 / c Hence, pick any c in [1..5], and pick A + B = 44000 / c. 3.3. Example Name Then to satisfy (A+B) c=44000, choose a Name that splits as A@B with A+B=44000/c. For instance: Let c = 4. Then A+B must be 11000. We pick A = 5500 and B = 5500. So Name = "5500@5500". 3.4. Putting It All Together And if im right and if this is the keygen you have asked for : keygen.py

Creating a scrolling starfield effect in Delphi. Starfield.rar

i used an old tool 😁 PatchMe_PROCESS_WRITE_by_terco.txt

i made a video for unpacking with tools .... asprotect_unpack_by_terco.txt

1. get your fasm 2. open .asm in FASMW.EXE and build it (CTRL+F9) we done

The plugin has been updated, and for debugging 64-bit VMP APPs, no specific Windows version is required: 1. Only supports Win7 x64/64-bit systems and above. This version of the plugin only supports 64-bit debuggers for debugging 64-bit APPs 2. As there is no need to load some kernel drivers, the blue screen will not be triggered ScyllaHide_2024_x64_v0.001.zip ScyllaHide 64-bit x64: 3.8.1 ✔ 3.8.4 ✔ 3.8.5 ❓ 3.8.7 ✔ VMP_3.8.1_x64_64-bit.vmp.exe VMP_3.8.4_x64_64-bit.vmp.exe VMP_3.8.7_x64_64-bit.vmp.exe

I explained what this does over on exetools, but will repost that here: This method of anti-debug detection works due to how OllyDbg is 'abusing' a certain window feature on Windows. Windows offers multiple ways for a process to store various kinds of data within a window handles memory space. This includes things like style data, id information, custom user data and so on. There is a more specific use-case for dialog boxes that allows for the storage of a return value that can be retrieved later on which is what OllyDbg is making use of. This is done using the following: - x86: SetWindowLongA via DWL_MSGRESULT index. - x64: SetWindowLongPtrA via DWLP_MSGRESULT index. This index allows the storage of a 4 or 8 byte value (depending on which parent call is used to store it) which OllyDbg is using to store the window handle pointer of the created window child. For example, in the anti-debug code above, this is looking for certain child windows of the main CPU window which are: - 0x4CD6A8 - ACPUASM (Assembly window.) - 0x4CDA75 - ACPUDUMP (Dump window.) - 0x4CDE42 - ACPUSTACK (Stack window.) These pointers are hardcoded (static) locations inside of the OllyDbg.exe and are set using SetWindowLongA for example: // Create the dump child window and store its handle pointer.. hwnd = CreateWindowExA(0, "ACPUDUMP", (LPCSTR)&off_4B3898 + 1, 0x50300000u, 0, 0, 0, 0, wParam, 0, hInstance, 0); dword_4CDA75 = hwnd; if ( hwnd ) { SetWindowLongA(hwnd, 0, (LONG)&dword_4CDA75); ShowScrollBar(dword_4CDA75, 0, word_4CDCA6); } else { v23 = 1; } The intended purpose of the DWL_MSGRESULT / DWLP_MSGRESULT window indexes is for use with the Dialog window system within Windows. This is used with calls such as DialogBox and the window callback DlgProc that would go along with these kinds of windows. Due to how the DlgProc method functions, it cannot directly return a value other than 0/1. To account for this, Windows made these special indexes to allow for the storage of a return value to be used in the event one is needed. Since OllyDbg does not use dialog boxes for its windows or child windows related to the CPU window, this space is free for any kind of usage. This is similar to using 'GWL_USERDATA' but is basically a second instance of this same kind of value storage for non-dialog windows.

Few things i noticed that might help: in WM_PAINT invoke CreateSolidBrush,000000FFh is always creating a brush, and not deleting it afterwards, ideally you would move this to WM_INITDIALOG or somewhere before dialog is created and save the brush handle globally to use every time, something like: invoke CreateSolidBrush,000000FFh mov hBackBrush, eax then in WM_PAINT you only need to use hBackBrush for invoke FrameRect, hdd, ebx, hBackBrush But I would also remove the following at the start of WM_PAINT lea ebx,r3kt assume ebx:ptr RECT and just use invoke FrameRect, hdd, Addr r3kt, hBackBrush In CreateSpiral function there is a GetDC, but no ReleaseDC, but as its only called once its a minor thing. In ScrollThread there is multiple calls to GetDC without corresponding ReleaseDC at end of thread but looks like this thread is only called once and so few leaks wont impact it overall. The call to InvalidateRect in WM_TIMER, calls WM_PAINT, which causes the brush to be created each time and thus leaks the gdi resources. And eventually will cause the crash. I would probably restructure the code to make the spiral its own window control and handle its own drawing and update via a timer, and avoid having to create a thread at all. Hope that helps.

Hi Short tutorial for bypass Safengine 2.4 HWID Regards. Safengine Short Tutorial.rar

Can't wait

Hi, everybody! I am developing an ida plugin which can be used to analyze vmp3.5 x86. If you are interested in vmp, Then you can view the source code of the project to learn it. Suggestions and PRs are welcome. https://github.com/fjqisba/VmpHelper

Thank you for reporting! Should be fixed now... Ted.

Among the anti-debug techniques, there's an interesting one worth noting. A dummy thread is created and then it calls Sleep(0x32). (The goal is for the created thread to be detected by tools like x64dbg.) Then, it calls NtQueryObject with the ObjectBasicInformation class using the thread handle. If the returned HandleCount is greater than 1, it determines that debugging is in progress. void dummy() { Sleep(8000); } bool CheckCreateThreadHandleCount() { HANDLE hThread = CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)dummy, NULL, 0, NULL); if (hThread == NULL) { return false; } Sleep(0x32); PUBLIC_OBJECT_BASIC_INFORMATION objInfo; NTSTATUS status = NtQueryObject(hThread, ObjectBasicInformation, &objInfo, sizeof(objInfo), NULL); if (!NT_SUCCESS(status)) { CloseHandle(hThread); return false; } std::cout << "Handle Count: " << objInfo.HandleCount << std::endl; if (objInfo.HandleCount > 1) { CloseHandle(hThread); return true; } CloseHandle(hThread); return false; }

Time spent: 5 minutes from start to typing this message. It's a great example of how a compromised older version of the software (like your crackme v1.0) leads to a complete compromise of the new and improved protection. I hope to find some time on Sunday or early next week to make a writeup. But my spare time is limited these days, I apologize for that in advance.. If someone else wants to make a tutorial, I'd love to see that!

I suggest you think about this long and hard. What could possibly go wrong? I'll take the bonus points..

I recommand the people to use this protection because it's very good. The protection is advanced like Pelock but very good. Only a real reserver can do it But it needs much times to be able handle it. UnpackMe.Obsidium.1.69b1.x86_unprotect.rar

@boot How to bypass the x64 target like you had done? Regards. sean.

@Sh4DoVV How to bypass x64 version of enigma constant used target? Do we have to change CRCs and then change hwid to the given one like changing x86 version of it's hwid using @CodeExplorer's EnigmaHardwareID Tool and scripts for x86 targets? Many thanks in advance. Regards. sean.

I've made real progress: ulong ledi1 = (ulong)selfEH.ToInt64(); // ulong leax1 = *(ulong*)(ledi1+0x58); ulong valueZero = *(ulong*)(leax1+0x28); ulong Pointer = leax1+0x28; MessageBox.Show(valueZero.ToString("X8")); When valueZero is zero method has no exception handers; So I've found add that EHCount from info->EHcount from CORINFO_METHOD_INFO_Fr4_x64 has invalid value; mainly the function was called for methods with no Exception Handlers.

WaterEffect_Src.rar

Would yuo like send valid registration otherwise it's christmas day so I have free times for challenge this one for this last years? Merry Christmas day for everybody 🎂🍾🎉🎊😁🤭.

After having some free Times, I do some steps and don't find anything new. As always there are no change from it. Attach key and name to decrypt the section may be I will send a full tutorial for unpacking and patching enigma. May be the Author will know how their protection works and how to deal wit it. Have nice day

Kernel Detective Purchased from GamingMasteR many years ago. As this code is quite old... I see zero reason not to make it public. This is the driver part "Kernel Detective" the x86 Anti-Rootkit. The GUI application may be found in Application.7z Was lazy, and did the upload via the github website =p If you make use of this source... you can do two simple things: 1). Give credit to GamingMaster 2). Give credit to me (Fyyre) -Fyyre https://github.com/Fyyre/kerneldetective

v1.0.0.5 https://github.com/mrfearless/MediaPlayer/releases/tag/1.0.0.5 Moved Spacebar play/pause toggle to accelerator table instead of WM_KEYDOWN. Set focus on media player video window on enter fullscreen to allow Escape key to exit fullscreen. Hide controls and cursor after 3 seconds in fullscreen mode, show controls and cursor on WM_MOUSEMOVE or exit of fullscreen. Controls do not hide if fullscreen and an audio track is loaded. MediaPlayer-x64.zip MediaPlayer-x86.zip

Lack of any explanation whatsoever, likely the author just ripped code directly from the source of the original program; which they clearly have access to given the details of the post. For those of you seeking guidance, I'd look elsewhere (old but gold).

Sorry, I misunderstood what you meant by that sentence. The summer heat must be getting to me. Sure, if one uses SetWindowLong to change the values for Olly windows, Olly can crash with access violation like this: But as an anti-anti-debug measure one can hook SetWindowLong*/NtUserSetWindowLong and prevent this from happening. It's a neverending game of cat and mouse.

First, shellcode version is basically identical to the CheckDebug() function anyway. Don't waste your time on that. Second, the CheckDebug() function is just a convoluted way to call GetWindowLongA for all windows on the machine and checking the return values. Attached is my code doing the same thing + the compiled binary. No, it's not. AntiOlly_GWL.zip