Leaderboard

I want to release a new tutorial about the popular theme Themida - WinLicense. So I see there seems to be still some open questions mostly if my older unpack script does not work anymore and the unpacked files to, etc. So this time I decided to create a little video series on how to unpack and deal with a newer protected Themida target manually where my older public script does fail. A friend of mine did protect unpackme's for this and in the tutorial you will see all steps from A-Z to get this unpackme successfully manually unpacked but this is only one example how you can do it, of course. So the tutorial [videos + text tutorial] is very long and has a run-time of more than three hours and of course it will be necessary that you also read the text parts I made at the same time if possible but if you are already a advanced user then you will have it easier than a newbie. So I hope that you have enough patience to work through the whole tutorial. So the main attention I set on all things which happen after normal unpacking so the unpack process is the simplest part and all what comes after is the most interesting part and how to deal with all problems that happen. It's more or less like a live unpack session. I also wrote some small basic little helper scripts which you can also use for other targets to get valuable information if you need. Short summation: Unpacking Exception analysing VM analysing with UV plugin AntiDump's find & fixing & redirecting "after fix method" Testing on other OS My Special Thanks goes to Lostin who made this unpackme and others + OS's tests. (I want to send a thank you to Deathway again for creating this very handy and helpfully UV plugin). So this is all I have to say about the tutorial so far, just watch and read and then try it by yourself. Oh! and by the way I record ten videos and not only one. If something does not work or you have any problems with this tutorial, etc. then ask in the support topic only. Don't send me tons of PM's, OK! Thank you in advance. PS: Oh! and before someone has again something to complain because of my tutorial style [goes to quickly or is bad or whatever] then I just want to say, maybe you're right so normally I don't like to create and write tutorials. This is really not my thing so keep this in your mind.

OllyPortable is my portable version of OllyDbg extended with plugins and patches for a good looking and decently working debugger environment. Main features: - Good looking buttons (thanks to the author of Olly Shadow) - Full portability (OllyPath.dll, source is included) - Tested & working on both XP SP3 and Win7 x64 - Manifest to make olly look less Win98 - Useful plugins, sometimes with custom patches Plugin descriptions: - analyzeThis: Analyze code outside the code section of the debugged program. - Asm2Clipboard: Quickly copy ASM code (with labels) to the clipboard. - ClearUDD: Plugin to clear the UDD directory from within olly. - CmdBar: Command bar to quickly set breakpoints/registers etc. - DataRipper: Rip selected data in various formats. - HiddenThreads: Plugin that finds hidden threads. - ICanAttach2: Plugin that fixed anti-attach tricks. - ida_sigs: Plugin to import IDA signatures to the debugged file. - IDAFicator: Great plugin with many features, check the manual. - MnemonicHelp: Simply plugin that loads a help file for the selected mnemonic. - ModuleBCL: Import&Export labels, comments and breakpoints. - multiasm_odbg: Extremely useful plugin for writing code caves. - ODbgScript: Script OllyDbg (Patched by me) - ODBJscript: Script OllyDbg using javascript - oDump: Fixed version of OllyDump that bypasses anti-dump techniques. - OllyCopy: Great plugin to copy addresses, bytes and patterns to the clipboard. - OllyFlow: Generate an IDA graph from analyzed code. - OllyWow64_0.2: Compatibility plugin for WOW64 - RemoveCriticality: Plugin that fixes an exploit that could crash the system when debugging. - SehSpy: Show the SEH context before the reached exception. - SigMaker: Easily make patterns and signatures. - StollyStruct: Plugin that allows viewing memory in structure form (Patched by me) - StrongOD: Hide & Bugfix plugin (Patched by me) - TLSCatch: Plugin that sets a breakpoint on TLS callbacks (when found) - X_CRYPTO: Plugin to hash bytes or text inside olly. I also included the help files for ODbgScript, ODBJScript, Multiasm, Win32 API and x86 opcodes. The list of patches and source code used can be found in the 'Patches' directory. Enjoy, Mr. eXoDia