Jump to content
Tuts 4 You

[unpackme] Themida 1.9.1.0


Teddy Rogers

Recommended Posts

Woah! 18 MB !

That's why I love driver based protections ^_^

Did you just check all the protection options ? Or are there several in it ? Dont want to download 18 MB, it wouldnt take too much time but, heh, still too long :D

Edited by Killboy
Link to comment
Teddy Rogers

Everything that makes it interesting is included :rolleyes:

Yes, it is good at pumping up a file around 403KB to over 3MB... :P

Ted.

Link to comment
  • 2 weeks later...

Themida removed drivers from the protection a long time ago...

Good to see the newest version out, time to take a crack at it :)

Link to comment

Wow, pain in the @$$, and there is no protections enabled. I got a working dump for A, really dont think i can do the rest of them. But still trying. LOL :rolleyes:

Edited by What
Link to comment
Wow, pain in the @$$, and there is no protections enabled. I got a working dump for A, really dont think i can do the rest of them. But still trying. LOL :rolleyes:

Yeah, almost all the protection features rely on the VM, so it takes a loooong time to restore them all, unless you just dump the VM, but thats unneat :/

Link to comment
  • 4 weeks later...

Hehe, you go ahead and try that, and then come back and tell me why it didn't work :) Anyways, dumping is not hard once all the tricks it looks for are provided with ones dump.

Edited by rendari
Link to comment

@rendari: It isn't hard at all T_T

UnPackMe_Themida 1.9.1.0.a.exe - unpacked:

http://www.speedyshare.com/158518276.html
Edited by sunbeam
Link to comment

a is easy to unpack. Try unpacking the one with Virtual API's or with Stolen Code :) The VM will initate some sneaky silent checks and crash you. So you have to find and fix them :)

Edited by rendari
Link to comment

Working on Themida. Was analyzing code at the crash of ollydbg at start up. The problem is fld tbyte ptr [0046a037]. During analysis i Noticed this was completely useless code so i filled it with 0s and now themida lodes fine. I geuss it could be like the %s%s crash but when showing disassembled view, I say this because you can see it in the dump windows in hex view but when you click disassemble view it crashes. I want to try and patch Ollydbg to ignore it. Ill report back if I get anything. ;) Just for themida so its before code. It probably says something like if shows fld tbyte ptr [0046a037] then crash. Well its got to be Ollys code because when debugging in win32dasm no crash, can see the byte fine.

Edit In: After more searching it seems to be the FFFF right after so just fill those 2 bytes with 0s. Causing the Problem. Still havent found a fix though.

Edited by What
Link to comment

If other companies start to use it, I'll patch. But only ones so far who do that are Themida and SKVP 2. Neither bother me. So, I won't patch because I am so lazy :P

Link to comment

There's a patch for any targets using the "invalid floating point" bug. Look it up. As for the unpackmes, I'll start up on every variant ;) Let's see what this bugger can do :D

Link to comment

thanks for telling me there was a solution SunBeam. I tracked it down, a half a byte patch. @ 004AA2f2 to DB38. It was DF38. :thumbsup:

No More crash on start up.

I created a quick Search N Replace Patch for it. Works for all those people with SND version just direct to SND.exe. Search N replace a bunch of different ollydbgs. Tested on SND, Defixed, Modified Re-Paired.

Edited by What
Link to comment
I found this bug along time ago now and posted it in the SND olly beta thread...

@ Fungus Sorry, didnt see it. my fix is a little different, albeit, same area. LOL

Anyway working on themida, all done but all protections :D , with all protections enabled it over 10 MB dump.

Edited by What
Link to comment
  • 1 year later...

Ok, so I've done them starting from .c and worked my way up to g, didn't notice the difference between .c to .f, except I think for one of them and for G, ImportRec sometimes can't read process memory and I need to use UIF, anyways, for .g, I'm having trouble and was wondering how to progress to the next step.

I was wondering how to deal with 'Code Replace' or could anyone provide a basis for what it does and how to counter it, as far as from my searching, I understand that it isn't hard or difficult as Code Virtualization, but as I'm rather new to this, I really wouldn't know, of course, I don't want step by step answers, but more of a general sense as to what is going on.

I've unpacked this and fixed the IAT, though sometimes, I see 9-11 thunks while most of the time ImpRec only finds 5, for some odd reason, I'm going to look deeper into that, I've manually stepping through my unpacked file as it crashes everytime I run and I have found this so far:


PUSH 457440
MOV ECX,45C6E4
CALL 0043C191
...
JMP 007B7C1C
...

After that section, it jumps to an empty section:


0000 ADD BYTE PTR DS:[EAX],AL
0000 ADD BYTE PTR DS:[EAX],AL
0000 ADD BYTE PTR DS:[EAX],AL
0000 ADD BYTE PTR DS:[EAX],AL

I went back to the unpack me and started tracing through and found code there but it isn't in my dumped file:


PUSH 0C61434
JMP 007B373E ; UnPackMe.007B373E
...
6A 00 PUSH 0
9C PUSHFD
...
BB 01000000 MOV EBX,1
8D86 00040000 LEA EAX,DWORD PTR DS:[ESI+400]
F0:8618 LOCK XCHG BYTE PTR DS:[EAX],BL ; LOCK prefix
0ADB OR BL,BL
...
60 PUSHAD

If I binary copy this over, it doesn't allow me to write to executable.

Also one more thing, in my dumped file, when I was manually tracing through, the code would transfer automatically (If I binary copy, I wanted to dump it later) at this command


8D86 00040000 LEA EAX,DWORD PTR DS:[ESI+400]
F0:8618 LOCK XCHG BYTE PTR DS:[EAX],BL ; LOCK prefix

I understand this to be a semaphore or something akin to that, where 2 or more threads are waiting and making each other finish etc.

BUT in the unpackme version, it does not jump control but continues execution...

Any advice/help would be appreciated

File NAME: UnPackMe_Themida 1.9.1.0.g

Link to comment
  • 8 months later...

Can anybody explain why after this instruction (UnPackMe_Themida 1.9.1.0.c.exe)

00706393 C785 7D181B07 00000000 MOV DWORD PTR SS:[EBP+71B187D],0

we binary search for 39 85 ?? ?? ?? 0? 0F

Exist any logic there ? :)

Link to comment

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...