Jump to content
View in the app

A better way to browse. Learn more.

Tuts 4 You

A full-screen app on your home screen with push notifications, badges and more.

To install this app on iOS and iPadOS
  1. Tap the Share icon in Safari
  2. Scroll the menu and tap Add to Home Screen.
  3. Tap Add in the top-right corner.
To install this app on Android
  1. Tap the 3-dot menu (⋮) in the top-right corner of the browser.
  2. Tap Add to Home screen or Install app.
  3. Confirm by tapping Install.

Featured Replies

3 hours ago, TRISTAN Pro said:

So may be someone send it to me and I will attach it or check my tutorial in text Here just ask to someone upload asm.txt and yuo will get it.

anyone has asm.txt ? 

sean.

  • Replies 110
  • Views 57.4k
  • Created
  • Last Reply

Top Posters In This Topic

Most Popular Posts

  • @TRISTAN Pro: The point of the forums is to enable other people to learn about the protections and unpacking. When you post just an unpacked file, nobody learns anything. Would you please be so k

  • TRISTAN Pro
    TRISTAN Pro

    Tutorial for winlicence(This target): This tutorial work only for themida latest version,learn from @quosego and @LCF-AT . Load the target in ollydbg(I have made tutorial Here  for configura

  • lovejoy226
    lovejoy226

    I did it too. View this youtube video for the solution.   Regards. sean.

Posted Images

add ecx,ebp
mov ecx,dword ptr ds:[ecx]
cmp dword ptr ds:[ecx],edi
pushfd 
mov edx,ebp
mov ebx,0

how should I inline codes in here ?

On 4/3/2023 at 9:50 PM, TRISTAN Pro said:

Tutorial for winlicence(This target):

make inline to make the same process to automate the target.

@TRISTAN Prohow to inline ?

Edited by windowbase

Chill out bro

On 6/16/2023 at 11:10 AM, boot said:

The tutorial link has been removed, you need to re-contact the uploader to get the backup of the tutorial...

 Deleted Tutorial

Edited by NEW-RE

On 6/19/2023 at 5:42 AM, NEW-RE said:

 PM Me , I need your help regarding Engima HWID 

@NEW-RE I finally saw boot's main form. exactly same way in the tutorial video, it'd be shown.

many thanks for the video tutorial upload. @NEW-RE

sean.

Edited by windowbase

Try this UnpackMe. this is protected of 3 virtualized code blocks.  my intention is whether you can devirtualize them and unpack it.

Protection info.

Themida v3.1.4.18

1. 3 virtual machines used.

2. no api wrapping.

3. no anti-debug.

4. no compression.

5. no entry point virtualized.

ThemidaUnpackMe_protected.exe

sean.

Edited by windowbase
Editting words.

  • 1 month later...

hello, can someone share with me the asm.txt for bypass HWID ?

Thanks & Regards

On 7/22/2023 at 7:47 AM, xxx22xxx said:

hello, can someone share with me the asm.txt for bypass HWID ?

Thanks & Regards

Your telegram ID?

On 4/3/2023 at 8:01 PM, TRISTAN Pro said:

Thank yuo bro 

I need time to create a video then I already share some video to another personne but I will do it with this full unpackme about hwid bypassing I want everybody know about it and let the Orean technology see how does it work(SHARING KNOWLEDGE) and change a bit  them protection.😁

Here the video bypassing hwid winlicence for latest version of themida only include masm for inline patching the unpackme.

hope it help someone and make understand Orean technology team change them protection and make newer challenge don't forget like it and share.

Good luck.

 

Hi TP,

Please upload again the video,

Thank's in advance

Dino

  • 5 months later...
On 4/26/2023 at 12:48 AM, X0rby said:

screenshot_12.png.bb2cb3b3c28286255d13d5e8d8e1ad63.png

Edition    Windows 10 Enterprise
Version    22H2
Installed on    ‎31/‎05/‎2023
OS build    19045.3693
Experience    Windows Feature Experience Pack 1000.19053.1000.0
X64 OS

What's wrong? @X0rby

Regards.

sean.

Dunno, check your system - works well here in a freshly installed Windows 10.

image.png.12ae6d6a1add14029acc4b1ea755d457.png

On 7/25/2023 at 6:49 AM, Dino said:

Hi TP,

Please upload again the video,

Thank's in advance

Dino

Refer to this thread.

Regards.

sean.

Edited by windowbase
editing some words.

  • 1 month later...
On 4/3/2023 at 7:50 PM, TRISTAN Pro said:

Tutorial for winlicence(This target):

This tutorial work only for themida latest version,learn from @quosego and @LCF-AT .

Load the target in ollydbg(I have made tutorial Here  for configuration),now let the run app and when it appear pause and make search all séquences with those command "mov r32,[r32];cmp [r32],r32;pushfd" ,make all breakpoint on all Result and let it run again and click ok so the first compare is on 00556b26  cmp ecx and edi and make it the same after that the second compare is on 005B3719 cmp esi,edx and make it the same too and make inline to make the same process to automate the target.

Now click all nag and let it run till all nag pass and decrypt section code to break on oep.

Hope it will works for yuo Good luck.

For those want video,I have old tutorial video unpackme by @converse for bypassing HWID contact me via Telegram +012345678912 or Name:Tristan Prosper MIARANA  I will share via Telegram  and hope someone have the tutorial video share to another.I don't have enough data internet to share it here cause I using phone.

 

How i can get  the tutorial vidio?

 

  • 2 months later...

Can anyone bypass this HWID protected application with a fake license key file? It is the WinLicense v.3.1.3.0 x64.

Winlicense Test.zip

Regards.

sean.

On 1/18/2024 at 11:34 PM, X0rby said:

Dunno, check your system - works well here in a freshly installed Windows 10.

image.png.12ae6d6a1add14029acc4b1ea755d457.png

@X0rby Your unpacked one is not unvirtualized of the original entry point of the @boot's protected application. so, can you devirtualize the entry point? I guess that you just dumped at the entry point and fixed the IAT. @boot already uploaded the original one.

And you are so long these days. you said that you have been in holidays though. coming back then, check this out again.

Regards.

sean.

  • Author
14 minutes ago, Sean Park - Lovejoy said:

devirtualize the entry point.

If the target is a program compiled by VC 6.0, it is possible to quickly restore OEP.

4 hours ago, boot said:

If the target is a program compiled by VC 6.0, it is possible to quickly restore OEP.

@boot I think that your sample target is compiled with Visual C++ 6.0.

Many thanks for your reply.

Regards.

sean.

@boot Is it feasible to bypass this below with a fake license key file?

Regards.

sean.

17 hours ago, Sean Park - Lovejoy said:

@X0rby Your unpacked one is not unvirtualized of the original entry point of the @boot's protected application. so, can you devirtualize the entry point

Heeh digging a more than 1-year post - the challenge was to unpack it, not to de-virtualise it.

Anyways, here is the full fu_cked one....WinLicense completely removed 100%

un.exe

11 minutes ago, X0rby said:

Heeh digging a more than 1-year post - the challenge was to unpack it, not to de-virtualise it.

Anyways, here is the full fu_cked one....WinLicense completely removed 100%

un.exe 659 kB · 0 downloads

@X0rby Really fantastic.

I need your help. Is this feasible to bypass the HWID lock with a fake license key file?

Regards.

sean.

Edited by Sean Park - Lovejoy

4 hours ago, X0rby said:

Heeh digging a more than 1-year post - the challenge was to unpack it, not to de-virtualise it.

Anyways, here is the full fu_cked one....WinLicense completely removed 100%

un.exe 659 kB · 4 downloads

@X0rby  ".winlice" section is consist of virtual machine instructions of the WinLicense?

Regards.

sean.

On 6/5/2024 at 5:56 PM, Sean Park - Lovejoy said:

Can anyone bypass this HWID protected application with a fake license key file? It is the WinLicense v.3.1.3.0 x64.

Winlicense Test.zip 4.8 MB · 4 downloads

Regards.

sean.

@boot Is this feasible to bypass without the valid key file?

Regards.

sean.

  • Author
3 hours ago, Sean Park - Lovejoy said:

Is this feasible to bypass without the valid key file?

I'm afraid not. This depends on the options you have selected when protecting the application. :)

2 minutes ago, boot said:

I'm afraid not. This depends on the options you have selected when protecting the application. :)

@boot Can you test this for me?

If it is possible to bypass or not?

Regards.

sean.

Create an account or sign in to comment

Configure browser push notifications

Chrome (Android)
  1. Tap the lock icon next to the address bar.
  2. Tap Permissions → Notifications.
  3. Adjust your preference.
Chrome (Desktop)
  1. Click the padlock icon in the address bar.
  2. Select Site settings.
  3. Find Notifications and adjust your preference.