Jump to content
Tuts 4 You

[UnpackMe] Themida with XBundler files


Recommended Posts

  1. WinLicense - Professional Software Protection and Licensing Management [Version]


Protection Options for Software: WL-TM.



Macros Information


VM Macros: 0

CodeReplace Macros: 0

ENCRYPT Macros: 0

CLEAR Macros: 0

MUTATE Macros: 0


RegisteredVM Macros: 0







Protection Options


Anti-Debugger: ADVANCE

Anti-Dumpers: ENABLED

Entry Point Obfuscation: ENABLED

Resource Encryption: ENABLED

VMWare compatible: ENABLED

API-Wrapping Level: Level 2

Anti-Patching: NONE

Metamorph Security: ENABLED

Memory Guard: ENABLED

When Debugger Found: Display Message

Application compression: ENABLED

Resources compression: ENABLED

SecureEngine compression: ENABLED

Anti-File Monitor: ENABLED

Anti-Registry Monitor: ENABLED

Delphi/BCB form protection: DISABLED

Ring-0 Protection: DISABLED



Virtual Machine Settings


Number of Virtual APIs wrapped: 1

API Virtualization Level: 3

Entry Point Virtualization: 0 instructions

Multi Branch Technology: DISABLED

Virtual Machine Processor: Mutable CISC processor

Number of CPUs: 1

Opcode Type: Metamorphic - Level 2

Dynamic Opcode: 20%



Advanced Protection Options


Encrypt Application: ENABLED


Export Generators: ENABLED

Keep Trial Running: DISABLED

Hide from PE scanners: Standard

.NET assemblies: ENABLED

Active Context: DISABLED

Custom Event:

Add Manifest: Don't add manifest

Launch Application:



XBundler files


1 bundled dll


I hope someone have an idea how to extract (unpack)  bundled dll in case when it is not used (loaded or for example you can not get easily to the point in the main exectuable that external bundled dll would be loaded) directly from main executable when you run it. 


I don't want only main executable to be extracted.


Edited by morfej
  • Like 1
Link to comment
Share on other sites

@ morfej

Why using a NetFrameWork file?If you can then create the same UnpackMe again as nomral PE32 file if possbile.


Link to comment
Share on other sites

@atom0s, @GIV : My intention is to find a method to get XBundled DLL (especially when you can't get to the point where dll is loaded inside main executable  or not even used at all), not to unpack main executable.


Both of you didn't unpack the XBundled DLL file. 



@LCF-AT: I wan't to find a way for .net.  Can your script for unpacking normal PE32 themida executable with XBunlded files help for .net executable?

Edited by morfej
Link to comment
Share on other sites

Ok than predict that you can't not get to the point inside main executable where the dll is called.... which is technically the same thing.


In case if I need that bundled DLL.


My idea is to inject code to the unpackme.exe, for example to the button click event in a way that injected code would couse loading of that external dll (Xbundled dll) so than the dll would be unpacked as well, when you try to unpack it. (I know what probbably include Bootstrap DLL).

Edited by morfej
Link to comment
Share on other sites

Quick tutorial


The main idea is to make a dummy call to the dll so that we can trick the packer to load the dll and decrypt it since it is not accessed


Stop here

004902AB    60              PUSHAD

EAX = encrypted string of ExternalLib.dll followed by encrypted file


let execute this procedure will decrypt this string


go to this procedure where it extracts stuff

004837F3    55              PUSH EBP

Stop here

0048384C    E8 E4F1FFFF     CALL UnPackMe.00482A35

on stack you can replace whatever dll is in

$ ==>    > 003533F8  |Arg1 = 003533F8 ASCII "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll"

with the string from externallib.dll

0048E924  = ExternalLib.dll

execute this call after you have replaced the dll pointer


after you executed this call you will have in eax this

EAX = pointer to dll info [EAX+4] = DWORD to encrypted bundled file

follow [EAX+4] in dump window


0048E938 here you should be which is the start of encrypted bundled file


now just execute till here

0048389E    59              POP ECX

There you can see the Dll decrypted and you can dump it.


Here is the dumped dll.


Edited by Lostin
  • Like 5
Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Create New...