Jump to content
Tuts 4 You

WinLicense v3.1.3.0 x86 (All Protection Options)

boot

By boot
in UnPackMe

 Share
Go to solution Solved by TRISTAN Pro,

Recommended Posts

lovejoy226

lovejoy226

Posted
Posted
3 hours ago, TRISTAN Pro said:

So may be someone send it to me and I will attach it or check my tutorial in text Here just ask to someone upload asm.txt and yuo will get it.

anyone has asm.txt ? 

sean.

  • Like 1
  • Replies 110
  • Created
  • Last Reply

Top Posters In This Topic

  • lovejoy226

    39

  • boot

    14

  • TRISTAN Pro

    11

  • X0rby

    8

Popular Days

Top Posters In This Topic

Popular Days

Popular Posts

kao
kao

@TRISTAN Pro: The point of the forums is to enable other people to learn about the protections and unpacking. When you post just an unpacked file, nobody learns anything. Would you please be so k

TRISTAN Pro
TRISTAN Pro

Tutorial for winlicence(This target): This tutorial work only for themida latest version,learn from @quosego and @LCF-AT . Load the target in ollydbg(I have made tutorial Here  for configura

lovejoy226
lovejoy226

I did it too. View this youtube video for the solution.   Regards. sean.

Posted Images

lovejoy226

lovejoy226

Posted
Posted 
add ecx,ebp
mov ecx,dword ptr ds:[ecx]
cmp dword ptr ds:[ecx],edi
pushfd 
mov edx,ebp
mov ebx,0

how should I inline codes in here ?

  • Like 1
lovejoy226

lovejoy226

Posted
Posted (edited)
On 4/3/2023 at 9:50 PM, TRISTAN Pro said:

Tutorial for winlicence(This target):

make inline to make the same process to automate the target.

@TRISTAN Prohow to inline ?

Edited by windowbase
  • Like 1
NEW-RE

NEW-RE

Posted
Posted (edited)
On 6/16/2023 at 11:10 AM, boot said:

The tutorial link has been removed, you need to re-contact the uploader to get the backup of the tutorial...

 Deleted Tutorial

Edited by NEW-RE
  • Like 2
  • Haha 1
lovejoy226

lovejoy226

Posted
Posted (edited)
On 6/19/2023 at 5:42 AM, NEW-RE said:

 PM Me , I need your help regarding Engima HWID 

@NEW-RE I finally saw boot's main form. exactly same way in the tutorial video, it'd be shown.

many thanks for the video tutorial upload. @NEW-RE

sean.

Edited by windowbase
  • Like 2
lovejoy226

lovejoy226

Posted
Posted (edited)

Try this UnpackMe. this is protected of 3 virtualized code blocks.  my intention is whether you can devirtualize them and unpack it.

Protection info.

Themida v3.1.4.18

1. 3 virtual machines used.

2. no api wrapping.

3. no anti-debug.

4. no compression.

5. no entry point virtualized.

ThemidaUnpackMe_protected.exe

sean.

Edited by windowbase
Editting words.
  • Like 1
  • 1 month later...
xxx22xxx

xxx22xxx

Posted
Posted

hello, can someone share with me the asm.txt for bypass HWID ?

Thanks & Regards

net21u

net21u

Posted
Posted
On 7/22/2023 at 7:47 AM, xxx22xxx said:

hello, can someone share with me the asm.txt for bypass HWID ?

Thanks & Regards

Your telegram ID?

Dino

Dino

Posted
Posted
On 4/3/2023 at 8:01 PM, TRISTAN Pro said:

Thank yuo bro 

I need time to create a video then I already share some video to another personne but I will do it with this full unpackme about hwid bypassing I want everybody know about it and let the Orean technology see how does it work(SHARING KNOWLEDGE) and change a bit  them protection.😁

Here the video bypassing hwid winlicence for latest version of themida only include masm for inline patching the unpackme.

hope it help someone and make understand Orean technology team change them protection and make newer challenge don't forget like it and share.

Good luck.

 

Hi TP,

Please upload again the video,

Thank's in advance

Dino

  • Like 1
  • 5 months later...
X0rby

X0rby

Posted
Posted

Dunno, check your system - works well here in a freshly installed Windows 10.

image.png.12ae6d6a1add14029acc4b1ea755d457.png

lovejoy226

lovejoy226

Posted
Posted (edited)
On 7/25/2023 at 6:49 AM, Dino said:

Hi TP,

Please upload again the video,

Thank's in advance

Dino

Refer to this thread.

Regards.

sean.

Edited by windowbase
editing some words.
  • Like 1
  • 1 month later...
replican

replican

Posted
Posted
On 4/3/2023 at 7:50 PM, TRISTAN Pro said:

Tutorial for winlicence(This target):

This tutorial work only for themida latest version,learn from @quosego and @LCF-AT .

Load the target in ollydbg(I have made tutorial Here  for configuration),now let the run app and when it appear pause and make search all séquences with those command "mov r32,[r32];cmp [r32],r32;pushfd" ,make all breakpoint on all Result and let it run again and click ok so the first compare is on 00556b26  cmp ecx and edi and make it the same after that the second compare is on 005B3719 cmp esi,edx and make it the same too and make inline to make the same process to automate the target.

Now click all nag and let it run till all nag pass and decrypt section code to break on oep.

Hope it will works for yuo Good luck.

For those want video,I have old tutorial video unpackme by @converse for bypassing HWID contact me via Telegram +012345678912 or Name:Tristan Prosper MIARANA  I will share via Telegram  and hope someone have the tutorial video share to another.I don't have enough data internet to share it here cause I using phone.

 

How i can get  the tutorial vidio?

 

  • Like 2
  • 2 months later...
lovejoy226

lovejoy226

Posted
Posted

Can anyone bypass this HWID protected application with a fake license key file? It is the WinLicense v.3.1.3.0 x64.

Winlicense Test.zip

Regards.

sean.

  • Like 2
lovejoy226

lovejoy226

Posted
Posted
On 1/18/2024 at 11:34 PM, X0rby said:

Dunno, check your system - works well here in a freshly installed Windows 10.

image.png.12ae6d6a1add14029acc4b1ea755d457.png

@X0rby Your unpacked one is not unvirtualized of the original entry point of the @boot's protected application. so, can you devirtualize the entry point? I guess that you just dumped at the entry point and fixed the IAT. @boot already uploaded the original one.

And you are so long these days. you said that you have been in holidays though. coming back then, check this out again.

Regards.

sean.

  • Like 1
boot

boot

Posted
  • Author
Posted
14 minutes ago, Sean Park - Lovejoy said:

devirtualize the entry point.

If the target is a program compiled by VC 6.0, it is possible to quickly restore OEP.

  • Thanks 1
lovejoy226

lovejoy226

Posted
Posted
4 hours ago, boot said:

If the target is a program compiled by VC 6.0, it is possible to quickly restore OEP.

@boot I think that your sample target is compiled with Visual C++ 6.0.

Many thanks for your reply.

Regards.

sean.

  • Like 1
lovejoy226

lovejoy226

Posted
Posted

@boot Is it feasible to bypass this below with a fake license key file?

Regards.

sean.

  • Like 1
X0rby

X0rby

Posted
Posted
17 hours ago, Sean Park - Lovejoy said:

@X0rby Your unpacked one is not unvirtualized of the original entry point of the @boot's protected application. so, can you devirtualize the entry point? 

Heeh digging a more than 1-year post - the challenge was to unpack it, not to de-virtualise it.

Anyways, here is the full fu_cked one....WinLicense completely removed 100%

un.exe

  • Like 2
lovejoy226

lovejoy226

Posted
Posted (edited)
11 minutes ago, X0rby said:

Heeh digging a more than 1-year post - the challenge was to unpack it, not to de-virtualise it.

Anyways, here is the full fu_cked one....WinLicense completely removed 100%

un.exe 659 kB · 0 downloads

@X0rby Really fantastic.

I need your help. Is this feasible to bypass the HWID lock with a fake license key file?

Regards.

sean.

Edited by Sean Park - Lovejoy
  • Like 1
lovejoy226

lovejoy226

Posted
Posted
4 hours ago, X0rby said:

Heeh digging a more than 1-year post - the challenge was to unpack it, not to de-virtualise it.

Anyways, here is the full fu_cked one....WinLicense completely removed 100%

un.exe 659 kB · 4 downloads

@X0rby  ".winlice" section is consist of virtual machine instructions of the WinLicense?

Regards.

sean.

  • Like 1
lovejoy226

lovejoy226

Posted
Posted
On 6/5/2024 at 5:56 PM, Sean Park - Lovejoy said:

Can anyone bypass this HWID protected application with a fake license key file? It is the WinLicense v.3.1.3.0 x64.

Winlicense Test.zip 4.8 MB · 4 downloads

Regards.

sean.

@boot Is this feasible to bypass without the valid key file?

Regards.

sean.

  • Like 1
boot

boot

Posted
  • Author
Posted
3 hours ago, Sean Park - Lovejoy said:

Is this feasible to bypass without the valid key file?

I'm afraid not. This depends on the options you have selected when protecting the application. :)

  • Like 1
lovejoy226

lovejoy226

Posted
Posted
2 minutes ago, boot said:

I'm afraid not. This depends on the options you have selected when protecting the application. :)

@boot Can you test this for me?

If it is possible to bypass or not?

Regards.

sean.

  • Like 2

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share
Go to topic listing
×
×
  • Create New...