WinLicense v3.1.3.0 x86 (All Protection Options)

[boot]

View File

WinLicense v3.1.3.0 x86 (All Protection Options)

---

UnpackMe - WinLicense 3.1.3.0 x86 Full Protect

HWID Lock + Entry Point Virtualization + Etc...

HWID:
1111-2222-3333-4444-5555-6666-7777-8888

Author:boot
From:Tuts4you
Time:2023.04.02

---

• Submitter
  boot
• Submitted
  04/02/2023
• Category
  UnPackMe

 

[TRISTAN Pro]

Tell me if it doesn't work .

Nice unpackme for this challenge but still unpacked.

 

Edited April 19, 2023 by TRISTAN Pro
Give up

[kao]

@TRISTAN Pro: The point of the forums is to enable other people to learn about the protections and unpacking. When you post just an unpacked file, nobody learns anything.

Would you please be so kind and write also a few sentences on HOW you did it?

 

[TRISTAN Pro]

Hello sir I will do a tutorial about it don't worry but It will not threat the themida protector?

And I will do a paper or a video?

I don't know verywell  english but I do all that by learning from script by @LCF-AT without someone.

And I was looking for a tutorial for enigma constant encryption.

Please ask for admin @Teddy Rogers or @LCF-AT or @boot if I can post video tutorial about it because I fear It makes problem for orean team.

I will do tutorial for this unpackme full protected by Winlicence here.

Edited April 3, 2023 by TRISTAN Pro

[Teddy Rogers]

4 hours ago, TRISTAN Pro said:

Please ask for admin

If someone posts an unpackme (or other challenge) the intention is always to write something up on your solution. This site wouldn't be here if people never shared their knowledge...

Ted.

[TRISTAN Pro]

Tutorial for winlicence(This target):

This tutorial work only for themida latest version,learn from @quosego and @LCF-AT .

Load the target in ollydbg(I have made tutorial Here  for configuration),now let the run app and when it appear pause and make search all séquences with those command "mov r32,[r32];cmp [r32],r32;pushfd" ,make all breakpoint on all Result and let it run again and click ok so the first compare is on 00556b26  cmp ecx and edi and make it the same after that the second compare is on 005B3719 cmp esi,edx and make it the same too and make inline to make the same process to automate the target.

Now click all nag and let it run till all nag pass and decrypt section code to break on oep.

Hope it will works for yuo Good luck.

For those want video,I have old tutorial video unpackme by @converse for bypassing HWID contact me via Telegram +012345678912 or Name:Tristan Prosper MIARANA  I will share via Telegram  and hope someone have the tutorial video share to another.I don't have enough data internet to share it here cause I using phone.

 

Edited December 22, 2023 by Teddy Rogers
Removed telephone number...

[ra1n]

1 hour ago, TRISTAN Pro said:

Tutorial for winlicence(This target):

This tutorial work only for themida latest version,learn from @quosego and @LCF-AT .

Load the target in ollydbg(I have made tutorial Here  for configuration),now let the run app and when it appear pause and make search all séquences with those command "mov r32,[r32];cmp [r32],r32;pushfd" ,make all breakpoint on all Result and let it run again and click ok so the first compare is on 00556b26  cmp ecx and edi and make it the same after that the second compare is on 005B3719 cmp esi,edx and make it the same too and make inline to make the same process to automate the target.

Now click all nag and let it run till all nag pass and decrypt section code to break on oep.

Hope it will works for yuo Good luck.

For those want video,I have old tutorial video unpackme by @converse for bypassing HWID contact me via Telegram +261325068532 or Name:Tristan Prosper MIARANA  I will share via Telegram  and hope someone have the tutorial video share to another.I don't have enough data internet to share it here cause I using phone.

 

I understand that you most likely followed steps from a tutorial, and thus don't know yourself, but how is this useful to anyone? Although time consuming, people should actually start writing documents, explaining how they arrived at their solution, and not just "breakpoint here, do this, do that, ta-dah we're done". Sure the steps above may work, but what happens when Themida changes ever so slightly? Everyone that once had a solution is now at square one and has no idea what to do.

[InvizCustos]

16 minutes ago, ra1n said:

but what happens when Themida changes ever so slightly?

Already a bit of a change)

v3.1.4.0

"[+] Added internal option for extra entry point obfuscation"

[TRISTAN Pro]

43 minutes ago, ra1n said:

I understand that you most likely followed steps from a tutorial, and thus don't know yourself, but how is this useful to anyone? Although time consuming, people should actually start writing documents, explaining how they arrived at their solution, and not just "breakpoint here, do this, do that, ta-dah we're done". Sure the steps above may work, but what happens when Themida changes ever so slightly? Everyone that once had a solution is now at square one and has no idea what to do.

I don't get that yuo have said but what should I do posting video with explain or what steps?

I spend much time on it before understanding the process like enigma and vmprotect but If newbie want to understand it never they understand how does it works?

Means make practice with the target and understand the process of unpacking and tips how does it works.I see many people here using script by master @LCF-AT without knowing how does it work then should use and create yuor own script to automate the process.

Finally,teach yuorself is good before asking someone.after that yuo will understand how does it work.

So try make challenge with upx and asprotect them attack the advanced protector.

[ra1n]

45 minutes ago, TRISTAN Pro said:

I don't get that yuo have said but what should I do posting video with explain or what steps?

I spend much time on it before understanding the process like enigma and vmprotect but If newbie want to understand it never they understand how does it works?

Means make practice with the target and understand the process of unpacking and tips how does it works.I see many people here using script by master @LCF-AT without knowing how does it work then should use and create yuor own script to automate the process.

Finally,teach yuorself is good before asking someone.after that yuo will understand how does it work.

So try make challenge with upx and asprotect them attack the advanced protector.

Not sure what you're suggesting, but what I mean is you should explain how you arrived at your solution as opposed to just telling people the steps. Also, I'm not asking you to create a better tutorial so I can understand, I can already see what you've done, but for other people, who have virtually no idea what's going on, can not. For example, if you got these steps from a script that you reversed then that's all well and good until Themida changes, then what? Do you just wait for someone else to upload another script? Same logic will apply for those reading the proposed solution right now.

1 hour ago, InvizCustos said:

Already a bit of a change)

v3.1.4.0

"[+] Added internal option for extra entry point obfuscation"

I'm referring to the checks themselves, from what I can tell, his steps are probably intercepting the VM's handlers that compare virtual registers. If Themida changes the handlers or their mutation slightly then chances are that these patterns will not work.

[BlackHat]

10 hours ago, TRISTAN Pro said:

Hello sir I will do a tutorial about it don't worry but It will not threat the themida protector?

And I will do a paper or a video?

I don't know verywell  english but I do all that by learning from script by @LCF-AT without someone.

And I was looking for a tutorial for enigma constant encryption.

Please ask for admin @Teddy Rogers or @LCF-AT or @boot if I can post video tutorial about it because I fear It makes problem for orean team.

I will do tutorial for this unpackme full protected by Winlicence here.

1. You can post a Video Tutorial. You can see my profile as I have done that in the past. (Upload Video just like image in the comment or simply drag and drop.)

2. No, Oreans Team won't create any problem for you. I have uploaded a video to unpack Vmprotect and detailed steps for many of the C# protections. (You are not cracking or unpacking the official installer files of Winlicense but you are unpacking a sample unpackme file which was made for the sole purpose to get unpacked so It is not a problem at all. No ToS or Privacy Policy of Oreans stops you to do this.)

3. You can see NoVMP or unlicense project on GitHub and both are available. If they were illegal then they wouldn't exist. You are absolutely free to do anything with this Unpackme.

4. You can upload a Video or Guide with Image by Image (for example ElektroKill posted for Agile.NET) or a document with all the steps involved in this unpacking process. You are allowed to do.

P.S. - As you unpacked the unpackme by yourself and you are comfortable to share your knowledge with the community then you can post your steps. It will be helpful for others. Not everyone here is looking for ready-made scripts or unpackers. We all here to gain more knowledge. Hope I clarified all your doubts. 

[TRISTAN Pro]

On 4/3/2023 at 8:41 PM, BlackHat said:

1. You can post a Video Tutorial. You can see my profile as I have done that in the past. (Upload Video just like image in the comment or simply drag and drop.)

2. No, Oreans Team won't create any problem for you. I have uploaded a video to unpack Vmprotect and detailed steps for many of the C# protections. (You are not cracking or unpacking the official installer files of Winlicense but you are unpacking a sample unpackme file which was made for the sole purpose to get unpacked so It is not a problem at all. No ToS or Privacy Policy of Oreans stops you to do this.)

3. You can see NoVMP or unlicense project on GitHub and both are available. If they were illegal then they wouldn't exist. You are absolutely free to do anything with this Unpackme.

4. You can upload a Video or Guide with Image by Image (for example ElektroKill posted for Agile.NET) or a document with all the steps involved in this unpacking process. You are allowed to do.

P.S. - As you unpacked the unpackme by yourself and you are comfortable to share your knowledge with the community then you can post your steps. It will be helpful for others. Not everyone here is looking for ready-made scripts or unpackers. We all here to gain more knowledge. Hope I clarified all your doubts. 

Thank yuo bro 

I need time to create a video then I already share some video to another personne but I will do it with this full unpackme about hwid bypassing I want everybody know about it and let the Orean technology see how does it work(SHARING KNOWLEDGE) and change a bit  them protection.😁

Here the video bypassing hwid winlicence for latest version of themida only include masm for inline patching the unpackme.

hope it help someone and make understand Orean technology team change them protection and make newer challenge don't forget like it and share.

Good luck.

 

Edited April 19, 2023 by TRISTAN Pro
Give up

[InvizCustos]

@TRISTAN Pro, you might be interested in trying unpacking version 3.1.4

Archive password: 123
(It should have been KeygenMe, but I don't have the rights to create a thread.)

KeygenMe.zip

KeygenMe_x32.zip

Edited April 6, 2023 by InvizCustos

[TRISTAN Pro]

3 hours ago, InvizCustos said:

@TRISTAN Pro, you might be interested in trying unpacking version 3.1.4

Archive password: 123
(It should have been KeygenMe, but I don't have the rights to create a thread.)

KeygenMe.zip 7.23 MB · 1 download

KeygenMe_x32.zip 5.59 MB · 2 downloads

Since I have upload the tutorial I don't touch any Pc.so may be someone help yuo and note that I'm just newbie not professional with RE just love RE nothing else and like challenge with unpacking.

So pm me with my telegram if yuo want to talk I don't understand very much that yuo have said then I don't have time due by my study even though I will finished my study this year and may be this year I leave about Reserving engineering may be another one can provide a tutorial.

Good luck.

[InvizCustos]

These are just test samples of the newest version of WinLicense.
Someone might want to try unpacking them.

[TRISTAN Pro]

Pm me and send me the real Themida full licensed app protector. 

I will make search about the newer version seems there are some changes and some check with code like  CRC and hwid check or just send me the original app in pm.

[Teddy Rogers]

9 hours ago, InvizCustos said:

It should have been KeygenMe, but I don't have the rights to create a thread.

Read the description at the top of the forum...

Quote

Create new KeygenMe's in: Downloads > Challenge of Reverse Engineering > KeygenMe

https://forum.tuts4you.com/files/category/43-keygenme/

Ted.

[InvizCustos]

1 hour ago, Teddy Rogers said:

https://forum.tuts4you.com/files/category/43-keygenme/

Thank you

[w00she]

On 4/3/2023 at 3:33 PM, ra1n said:

I understand that you most likely followed steps from a tutorial, and thus don't know yourself, but how is this useful to anyone? Although time consuming, people should actually start writing documents, explaining how they arrived at their solution, and not just "breakpoint here, do this, do that, ta-dah we're done". Sure the steps above may work, but what happens when Themida changes ever so slightly? Everyone that once had a solution is now at square one and has no idea what to do.

I remember a previous conversation where CodeCracker asked for something related to Eazfuscator, but I can't recall the specific question. However, I do remember that you provided a solution but I'm surprised that you didn't share your tool, as most beginners nowadays use CodeCracker's tools. He's a humble person who sets a good example for the community. What have you contributed so far? The previous generation loved to share knowledge, but now the well-known reversers keep things private. I understand that some people still copy-paste for profit, but there are also genuine individuals who want to dive deep into the field. Unfortunately, many people have quit, because it's a struggle to learn more without a master. It's hard to find one these days. Ra1n, I know you're skilled, and I'm sorry for what I said, but it's the truth. The reversing community is dying. I miss the good old days when the best were humble and shared their knowledge.

[ra1n]

13 hours ago, w00she said:

I remember a previous conversation where CodeCracker asked for something related to Eazfuscator, but I can't recall the specific question. However, I do remember that you provided a solution but I'm surprised that you didn't share your tool, as most beginners nowadays use CodeCracker's tools. He's a humble person who sets a good example for the community. What have you contributed so far? The previous generation loved to share knowledge, but now the well-known reversers keep things private. I understand that some people still copy-paste for profit, but there are also genuine individuals who want to dive deep into the field. Unfortunately, many people have quit, because it's a struggle to learn more without a master. It's hard to find one these days. Ra1n, I know you're skilled, and I'm sorry for what I said, but it's the truth. The reversing community is dying. I miss the good old days when the best were humble and shared their knowledge.

I don't recall providing "CodeCracker" with any solution for Eazfuscator. Also, I try to contribute wherever I can with some examples being the write-ups I wrote and posted. I won't be responding to this thread anymore as its no longer relevant to the topic.

[boot]

According to the tutorial attachments provided by the answerer above. In addition to unpack this target, we can make a hijack DLL to achieve the purposes... The ideas come from the .asm attachment of the answerer's tutorial above.
DLL_This_target.rar

 

 

[X0rby]

Boot challenge unpacked by X0rby.7z

Unpacked

[jackyjask]

@X0rby  how about this unpackme, buddy?

unpack_me_them_314_protected-v1.zip

used following options:

[X0rby]

  

Quote

@X0rby  how about this unpackme, buddy?

Doesn't work for me, but what's the difference between it and boot challenge? he uses all options also.

Edited April 26, 2023 by X0rby

[jackyjask]

sorry, I forget about those MS redist dlls... my fault

the difference is that this is newer (latest) version of Themida, namely 3.1.4.xunpack_me_them_314_protected-v2.zip

Now in imort it has only kernel32.dll