Jump to content
Tuts 4 You

[unpackme]Themida 2.0.3.0 - UnpackME


Sp1d3rZ

Recommended Posts

  • Replies 65
  • Created
  • Last Reply

Top Posters In This Topic

  • Computer_Angel

    6

  • Loveless

    12

  • Sp1d3rZ

    5

  • ZenLoren

    6

Computer_Angel
Hi Computer_Angel & Loveless,

Thank you for all your clarifications. Just one more doubts to get cleared. Suppose in an Traget we find VM OEP we have to dump the target at VM OEP & we don't have to recover the stolen bytes ?

OR

We have to dump at OEP & then recover the stolen bytes ?

Cheers

Lorens!

It's depend on you. But in my opinion, we couldn't sure the VM OEP is correct or not.

Every VM part just start with a pair PUSH xxxx/JMP xxxx and maybe there're more asm instruction in that VM part, more than the orginal OEP.

I would recover the stolen bytes if .. I could (this is my best choice) but it's up to you ^.^

Link to comment

Hi Computer_Angel & Loveless,

Thanks for all the clarification. I agree with you Computer_Angel one should recover the stolen bytes if possible. Also the push / jmp things if we check in IDA is crossreferenced sooooo many times.

Thanks once again for your kind help :) You guys rocks !

Cheers

Lorens!

Link to comment
Hi Computer_Angel & Loveless,

Thanks for all the clarification. I agree with you Computer_Angel one should recover the stolen bytes if possible. Also the push / jmp things if we check in IDA is crossreferenced sooooo many times.

Thanks once again for your kind help :) You guys rocks !

Cheers

Lorens!

Only depends on your skill level.. Loveless can determine VM oeps with 100% certainty. Most people can't so for them it would be wise to rebuild..

For me it depends, I find a normal oep prettier but am often just lazy and use the VM oep..

Also some anitdump is occasionally used in the OEP then rebuilding is also required..

q,

Link to comment

@Computer_Angel

Ur Script Does Not Work At My Own Target = / Packed Themida 2.0.3.0

LCF-AT && Quesego Has Unpacked It Before,I Wont Say The Name Of The Program

= /

I Get Error On Line 87

Text : je stop

Care Help = ) Quesego or LCF-AT since you unpacked it before = )

please dont say name of program due company protection.

@ Pm Me Your MSN ; ) I Want Learn More = )

Edited by Guest
Link to comment

Detected as a virus with my McAfee... :D

Edit : i try it, but dunno can run or not in your pc..

http://www.zshare.net/download/205271505b90009e/
or
http://www.filefactory.com/file/a73590/n/Dumped1_zip
Edited by Apakekdah
Link to comment

ExtremeDevilz

i was talking about computer_angel not working on a program
I guess you should fix that by learning / digging more about themida.

Cheers, Lorens!

Link to comment

@ HSN.C3r

Ahhhhhh, :) now I can see the light (reason) why my unpacked file was not running on my system!

It needs to change the compatibility of the unpacked file to win98.It works.

So thanks for this good hint.

greetz

Link to comment

UnpackMe Working perfect. REALLY Apakekdah U R ROCK PERSON :P

UnpackMe solved. Again thnx Apakekdah

And thnx to HSN.C3r for Compatibility mode changing trick.

Edited by Sp1d3rZ
Link to comment

What and Ahmed18 from AT4RE made a great tuts about themida...

i was learing from him...

this link tuts about themida by What

http://www.tuts4you.com/download.php?view.1943

Ahmed18 tuts can be found in AT4RE forum..

LCF-AT tut it's not too fast, i think because he is using another trick...

maybe that's why his tuts is too fast going into the OEP/Section Code...

:wub:

Link to comment
  • 2 months later...

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

×
×
  • Create New...