Themida v2.4.6.30

[despy3]

View File

Themida v2.4.6.30

---

This is a .NET executable with a Goland DLL packed with Themida.

Try to unpack the executable, dump the bundled DLL then fix the DLL to make it work.

Once completed detail the methods used and how you fixed the DLL.

---

• Submitter
  despy3
• Submitted
  12/17/2020
• Category
  UnPackMe (.NET)

 

[0x59]

Just use the themida unpacker 

Link : https://github.com/NotPrab/.NET-Deobfuscator

[despy3]

dump the bundled DLL then fix the DLL to make it work.

[despy3]

On 12/18/2020 at 3:16 AM, 0x59 said:

 

Just use the themida unpacker 

Link : https://github.com/NotPrab/.NET-Deobfuscator

@0x59  try  dump the bundled DLL then fix the DLL to make it work.

 

 

anyone get an idea?
Anything will be great,

[0x59]

dll is written in go-lang and im a .NET reverser 😕 

[Josman]

Tutorial:

Spoiler

1. Dump the executable with extreme dumper or dnspy

2. Dump the bunded dll with MegaDumper, the vdump one should be test.dll if you not sure just check the export function with cff explorer or ida.

3. No need of fixing the dll(at least for me) just rename it to test.dll and launch the dumped executable.

PoC: https://streamable.com/khmzo6

 

unpacked.rar