LCF-AT Posted February 4, 2011 Share Posted February 4, 2011 Hello, so I have created & protected a new UnpackMe for you. I added also some detect stuff [medium level]. Just start the exe file and press the splash. Have fun again. ENIGMA 2.33 UnpackMe.rar 1 Link to comment Share on other sites More sharing options...
quosego Posted February 4, 2011 Share Posted February 4, 2011 (edited) Never did any new enigma, let's see if they got any better at protecting. 0050A341 ED IN EAX,DX0050A342 81FB 68584D56 CMP EBX,564D58680050A348 75 04 JNZ SHORT 0050A34E So much for the VMware protection. no onto unpacking. EDIT1: Spyware tool detected?? Can you be any vaguer. EDIT2: 0012FF04 01302F2C ASCII "fengyue0" So bypassed all debugger checks and the VMware checks. Let's see. -Some VM -memory loaded IAT redirs. -VM iat redirs. will continue tomorrow. Edited February 4, 2011 by quosego Link to comment Share on other sites More sharing options...
LCF-AT Posted February 5, 2011 Author Share Posted February 5, 2011 Hi quosego, vaguer? Whats this?Sorry the translate mashine can not hanle this word.Or you do mean voyeur? Yes,so I added some detect features also the VMWare / Box check etc.But no problem so you can run the UnpackMe also on your main PC so it's a clean small target. So if you get the Spyware tool message then you need to disable something what is runing on your system.Enabled also some basic stuff + drivernames etc.Is not much just some offten used names. -Some VM // Yes but this time I have not VMed the whole code [just 62 code peaces this time] -memory loaded IAT redirs. // Yes -VM iat redirs // YES "fengyue0" <-- One name check Basic of course Yes keep working on it. greetz Link to comment Share on other sites More sharing options...
deepzero Posted February 5, 2011 Share Posted February 5, 2011 @LCF-AT vague == undeutlich,unbestimmt,unprezise (->vage) vaguer -> steigerungsform i think the comparative form of vague is still vague, not vaguer. not sure, though good night... Link to comment Share on other sites More sharing options...
quosego Posted February 5, 2011 Share Posted February 5, 2011 Oh I just meant the message was weird, since the strongod driver etc are hardly spyware tools. Link to comment Share on other sites More sharing options...
BoRoV Posted February 5, 2011 Share Posted February 5, 2011 Also, you enabled watermarks, but did not added them. Link to comment Share on other sites More sharing options...
Ronar22 Posted February 11, 2011 Share Posted February 11, 2011 Nothing new in this version (at least from my point of view) Didn't Rebuild the vm (maybe another time ) UnPacked.rar Link to comment Share on other sites More sharing options...
Killboy Posted February 11, 2011 Share Posted February 11, 2011 I remember just catching the v-DLL entrypoint and searching for "VMWare", doesn't work now anymore :sThe VM is pretty straight forward from a quick glance at it, with enough time not much of a problem Link to comment Share on other sites More sharing options...
pseudonym Posted February 12, 2011 Share Posted February 12, 2011 Anyone notice anything new/unusual in anti-debug?. Something is catching me in that unpackme and I haven't managed to track it down. I have protected my own example with e233 with anti enabled and had no problem. Oh btw, I can't/don't use strongOD. Link to comment Share on other sites More sharing options...
Killboy Posted February 12, 2011 Share Posted February 12, 2011 I saw it uses CloseHandle anti-debug when I traced around the loader a bit. Phantom should fix that though.What I did was just put a HWBP on read on PEB.BeingDebugged, after a few breaks in ntdll this gets you into the VM. From there just wait for the VM call to return (call stack), next VM entries should be antidebug Link to comment Share on other sites More sharing options...
pseudonym Posted February 14, 2011 Share Posted February 14, 2011 Thanks for your input Killboy. I don't have much time to work on it, have made a little progress but still detected. Will keep plugging away at it when I can.cheers Link to comment Share on other sites More sharing options...
DizzY_D Posted June 12, 2011 Share Posted June 12, 2011 Sorry for digging out this older Thread but I think its worth it. For about 1 year (with huge breaks) now I'm working on an Enigma 2.x full unpacker + devirtualizer. Today I can show the first bigger success on this Unpackme. My devirtualizer successfully devirtualized this one and now it runs completely independent. I think the first release of my unpacker will be in the next few weeks so stay tuned. Unpacked file tested on Win7 x64 and XP SP3 x32 VM. Does it run on your machines? BTW: Sorry for the file size but i had to append the VM bytecode section because the devirtualizer doesn't support a direct copy to the code section. Of course this will be added soon. Kind regards, DizzY_D ENIGMA 2.33 UnpackMe_Full_Unpacked.rar Link to comment Share on other sites More sharing options...
metr0 Posted June 12, 2011 Share Posted June 12, 2011 Yes, it does on mine. 7 x64 SP0. Link to comment Share on other sites More sharing options...
LCF-AT Posted June 12, 2011 Author Share Posted June 12, 2011 @ DizzY_D Very good work so far. Looks almost the same like my devirtualized enigma files. If you really want to release a full Unpacker | devirtualizer then test your tool also with the older enigma versions [1.70 +| 1.90 +| 1.93 +| 1.96 til now] so til now there are together four diffrent VM structures [differ slightly].So keep going and I am also curious of your tool. PS: XP SP2 works with your unpacked file.Let me know if you need some xy version test files to test your tool. greetz Link to comment Share on other sites More sharing options...
mamipara Posted May 23, 2021 Share Posted May 23, 2021 @LCF-AT Validating on my test app, Watch the video and setup all required tools as mention txt. But both script give different error with (Enigma 2.33) >>>Enigma Alternativ Unpacker 1.1 Sorry,NetFrameWork targets are not supported! I have upto 2.0 net framework, also validate with win 7, win 10 64 bit mov PRE_CHECKER_PATCH, 01 mov DUMP_OUTER_VM, 01 >>>Enigma 1.x - 3.x VM Unpacker 1.0 mov BYPASS_REGSHEME, 01 mov FIX_OUTER_VM_INSIDE, 01 -HWID,Name,Key regshe appear and press "Register" -It gives "successful registration" message -Resume script -This error occur --------------------------- Can't find normal API JMP and Call commands! Check your target for direct APIs and fix them with UIF! INFO: Maybe your target used a another protecting layer! ---------------------------- --Press OK --It pause at address 0019FEE0 00616832 Test.00616832 --Script finished Any input here? -mami Link to comment Share on other sites More sharing options...
LCF-AT Posted May 23, 2021 Author Share Posted May 23, 2021 Hi, so you do see that this topic is more than 10 years old already right. The NetFrameWork infos should be wrong because the file is not NFW.Problem should be the Windows OS you are running and the arch.. (x64) where you can get diffrent results by using the script because the unpacking conditions are not same as you would try to unpack the target on XP x86 system.What you can try it running the script under VM & XP SP2 OS.Otherwise you need to debug the script itself and analyze the Error messages and trying to fix / bypass it manually. greetz 3 Link to comment Share on other sites More sharing options...
mamipara Posted June 4, 2021 Share Posted June 4, 2021 @LCF-AT mov DUMP_OUTER_VM, 01 mov PRE_CHECKER_PATCH, 01 VM with XP SP3 32 bit. Again it give error for same error(Sorry,NetFrameWork targets are not supported....). -Above error fixed after change PE file alignment value cmp [eax+104], FILEALIG jne NO_NET cmp [eax+104], 1000 >>>2000 -Enter valid Key and name and get message "registration success". -It stop after below message Found no valid API call or Jump commands! Maybe your file used a double protection! Or you need some valid bypass datas! while debugging it seems to above error due to file alignment only. Any quick hint which are other place need to change this 1000>>>2000? -mami Link to comment Share on other sites More sharing options...
LCF-AT Posted June 4, 2021 Author Share Posted June 4, 2021 Hi, if your file is a NET target then script does fail to unpack your target because its a NET one.If you can bypass the RegNag successfully and your target does run (press run in Olly after you get "Found no valid API call or Jump commands") like it should then you can start to do some NET dump & fixing by using NET tools.Just try this.Dont remember anymore about that NET stuff. PS: Script does check the first section RVA address for 1000.In case of NET the first section start at 2000.But as I said, script isnt a NET Enigma unpacker. greetz 1 1 Link to comment Share on other sites More sharing options...
GIV Posted July 30, 2021 Share Posted July 30, 2021 Hi all. If is a .NET target once you reach the OEP (if i recall correct even my memory is not that long) just dump with MegaDumper then fix. Search...i have a script for that.....you can see there all you need. Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now