Themida v2.4.6.30

[despy3]

View File

Themida v2.4.6.30

---

This is a .NET executable with a Goland DLL packed with Themida.

Try to unpack the executable, dump the bundled DLL then fix the DLL to make it work.

Once completed detail the methods used and how you fixed the DLL.

---

• Submitter
  despy3
• Submitted
  12/17/2020
• Category
  UnPackMe (.NET)

 

[0x59]

Just use the themida unpacker 

Link : https://github.com/NotPrab/.NET-Deobfuscator

[despy3]

dump the bundled DLL then fix the DLL to make it work.

[despy3]

  On 12/17/2020 at 7:16 PM, 0x59 said:

 

Just use the themida unpacker 

Link : https://github.com/NotPrab/.NET-Deobfuscator

Expand  

@0x59  try  dump the bundled DLL then fix the DLL to make it work.

 

 

anyone get an idea?
Anything will be great,

[0x59]

dll is written in go-lang and im a .NET reverser 😕 

[Josman]

Tutorial:

  Reveal hidden contents

1. Dump the executable with extreme dumper or dnspy

2. Dump the bunded dll with MegaDumper, the vdump one should be test.dll if you not sure just check the export function with cff explorer or ida.

3. No need of fixing the dll(at least for me) just rename it to test.dll and launch the dumped executable.

PoC: https://streamable.com/khmzo6

 

unpacked.rarFetching info...

[boot]

EXE:

• Just need to dump it by using dumper, such as DotnetDumper
• Using CFF to fix it and remove the strong signature
• Using De4dot to clean it up

DLL:

• Because it's a .Net program, you can dump the DLL at the same time, but if it's a not .Net program, write own tool extract...

dumpMe - bak.rarFetching info...

[fhisar34]

can you open themida c++
https://www.dosya.tc/server42/k1b4p3/soacsx.zip.html

[BlackHat]

Use Extreme Dumper to Dump.

When the code is on-fly, save the DLL from Memory.

 

Can You confirm the size I got is valid or not ? because I see the file size posted by boot is comparatively smaller to mine.

callGo.exeFetching info... test.dllFetching info...

[fhisar34]

I made a dump but it doesn't work, the size is correct

[ArtZero]

1. Dump dumpMe.exe file using ExtremeDumper, and save callGo.exe. It has unpacked.

2. Dump dumpMe.exe file using MegaDumper, you'll got rawdump_6BEC0000.dll file. Just rename to test.dll (it is a native language).

3. Place to same folder callGo.exe file and test.dll, it's work..

 

Unpacked.rarFetching info...