The Enigma Protector v7.70 (x32 & x64)

[lengyue]

View File

The Enigma Protector v7.70 (x32 & x64)

---

This is an example program I used to shell The Enigma 7.7. You can shell it, bypass it, PatchHWID, KeyGen to make it run normally. Of course, it would be best if the shell could be peeled off.Have fun!

https://workupload.com/file/EGgppWamMA6

Cracked:

---

• Submitter
  lengyue
• Submitted
  11/24/2024
• Category
  UnPackMe

 

[TeRcO]

[collins]

2 hours ago, TeRcO said:

Nice.   How to do?

[TeRcO]

(x86) RVA: 0000369E : 75 =>EB

[collins]

13 hours ago, TeRcO said:

（x86）RVA：0000369E : 75 =>EB

well done.  What about x64？

[azufo]

1 hour ago, collins said:

well done.  What about x64？

Read here about debbug , about x64 rva adress: 3AEE

 

[collins]

26 minutes ago, azufo said:

Read here about debbug , about x64 rva adress: 3AEE

 

azufo :  thanks man.

 

[lengyue]

In fact, 7.6 and 7.7 both have a fatal BUG, I do not use constants. Recently I made a scheme to use constants. The bypass is impossible.If anyone wants to try it, please follow the post and I will upload it here.

[TeRcO]

56 minutes ago, lengyue said:

In fact, 7.6 and 7.7 both have a fatal BUG, I do not use constants. Recently I made a scheme to use constants. The bypass is impossible.If anyone wants to try it, please follow the post and I will upload it here.

let's give a try

[lengyue]

11 hours ago, TeRcO said:

let's give a try

Ok,I will makeing it.

 

11 hours ago, TeRcO said:

let's give a try

 

Edited Monday at 08:50 AM by lengyue

[lengyue]

On 12/2/2024 at 4:52 AM, TeRcO said:

let's give a try

https://workupload.com/file/DeUhukmzC66The Enigma Protector_7.7.rarThis is a new shell example

Edited yesterday at 04:20 PM by lengyue

[TRISTAN Pro]

4 hours ago, lengyue said:

https://workupload.com/file/DeUhukmzC66 The Enigma Protector_7.7.rar 10.56 MB · 5 downloads

After having some free Times, I do some steps and don't find anything new.

As always there are no change from it.

Attach key and name to decrypt the section may be I will send a full tutorial for unpacking and patching enigma.

May be the Author will know how their protection works and how to deal wit it.

Have nice day

 

[azufo]

On 12/1/2024 at 9:55 PM, lengyue said:

In fact, 7.6 and 7.7 both have a fatal BUG, I do not use constants. Recently I made a scheme to use constants. The bypass is impossible.If anyone wants to try it, please follow the post and I will upload it here.

LOL are u sure ? again enigma defeated....

Enigma again pached hwid.rar

[lengyue]

55 minutes ago, azufo said:

LOL are u sure ? again enigma defeated....

Enigma again pached hwid.rar 6.08 MB · 0 downloads

PatchHWID cannot be prevented, and I haven't come up with an effective way to prevent it yet, but bypass is not feasible. Because the constant cannot be found

Edited 23 hours ago by lengyue
You are wonderful. Next time, I will add another method to publish the challenge.

[TRISTAN Pro]

37 minutes ago, lengyue said:

PatchHWID cannot be prevented, and I haven't come up with an effective way to prevent it yet, but bypass is not feasible. Because the constant cannot be found

Send valid registration name and key otherwise just replace hash with valid and it will work for all pc.

00A20D7F RVA replace esp which valid hash.

00CEA7DA RVa patched the registration manually to nop. 

Edited 23 hours ago by TRISTAN Pro
I don't like comment much

[lengyue]

1 hour ago, TRISTAN Pro said:

After having some free Times, I do some steps and don't find anything new.

As always there are no change from it.

Attach key and name to decrypt the section may be I will send a full tutorial for unpacking and patching enigma.

May be the Author will know how their protection works and how to deal wit it.

Have nice day

 

Come on, you can definitely write the patch

Edited 23 hours ago by lengyue
I only added a few methods to prevent PatchHWID. This is a myth, if I expose the bottom of it, it should be meaningless. What's your opinion?

[TeRcO]

[lengyue]

34 minutes ago, TeRcO said:

The pop-up window of successful registration may not necessarily be a true success, but Mr. @azufo  has successfully found a way. He already knows the bottom line.

Edited 23 hours ago by lengyue
Thank you for participating.

[Sean Park - Lovejoy]

59 minutes ago, azufo said:

LOL are u sure ? again enigma defeated....

Enigma again pached hwid.rar 6.08 MB · 14 downloads

@azufo Please teach us how to patch hwid.

Best Regards.

sean.

 

[lengyue]

By the way, I introduced anti-debugging of vmp in the file.   @azufo  

Edited 22 hours ago by lengyue

[azufo]

Just now, TRISTAN Pro said:

Send valid registration name and key otherwise just replace hash with valid and it will work for all pc.

00A20D7F RVA replace esp which valid hash.

00CEA7DA RVa patched the registration manually to nop. 

Why delete every time your comment mr.Pro ?

You need valid name and key for enigma target  @lengyue

here........

name: tuts4you

key: 88B7TQYHHHNRKMFFAMXJAS6PW84A9W7PYY8UVS8DYN7PHAMCADQYG797BAPW8P2B9YDZADQAKJBYJMRTJURJ2NEYRXBJSAWUBCL384YD

 

Just now, lengyue said:

PatchHWID cannot be prevented, and I haven't come up with an effective way to prevent it yet, but bypass is not feasible. Because the constant cannot be found

I found rsa key and all info, this is not hard on this new  enigma  

[Sean Park - Lovejoy]

14 minutes ago, azufo said:

Why delete every time your comment mr.Pro ?

You need valid name and key for enigma target  @lengyue

here........

name: tuts4you

key: 88B7TQYHHHNRKMFFAMXJAS6PW84A9W7PYY8UVS8DYN7PHAMCADQYG797BAPW8P2B9YDZADQAKJBYJMRTJURJ2NEYRXBJSAWUBCL384YD

 

I found rsa key and all info, this is not hard on this new  enigma  

@azufo Please teach us something useful.

For example, how to patch hwid and be able to do something as you do.

Regards.

sean.  

[lengyue]

2 hours ago, azufo said:

Why delete every time your comment mr.Pro ?

You need valid name and key for enigma target  @lengyue

here........

name: tuts4you

key: 88B7TQYHHHNRKMFFAMXJAS6PW84A9W7PYY8UVS8DYN7PHAMCADQYG797BAPW8P2B9YDZADQAKJBYJMRTJURJ2NEYRXBJSAWUBCL384YD

 

I found rsa key and all info, this is not hard on this new  enigma  

Then you can KeyGen it!But constants are still needed。The new version of constants is not easy to find. There is no fixed method, it's not easy for me to find it myself.

x32 RSA:0207D41FA1B8B9F272E46844B2BDC07A40019ADLTLFZ4LLGSS3QNUMVWGSR3J4KR8J8C3N2V78RYYGWMBXKTZZXL6JG5N5D7U8VBKGV8ZRPV2UY7CY48LEVUKAXHSYFRXZMLW438RQBGAZ4RTKUD48ENL88MJNM57N7NJ4T679DSVTK9SESH886DJF5VR925RPZR6NEUY2PRYZYSQ5FX3NJ8ZRQ6XA9S3PRN2FBEZ7CGZKQ6SA2JUZBW5HX63DQWH642CFDN397THZUCZFHVTMT326TSBEXRSH2KY3BQSZQGDTB847Z3HHCTEL3P4EBG8VSU8PQC2BKQUDHJU2GKSNCXRLJFXCUJX73WDPGTPHZAR9QDAWKYRKRLS879H8AQE35L8KWDVXVAJXJZX5E4JHL6NGQQ8DFR7BJFVR568ZQKJA84PCPS2A6KRKJF8U319AEC55ZUV4NTGZ4J5D8ZNCNNWDL2GV7H4Y6VYVTZ5HN63SK7XVSUV3PGKATY35UYVYHRRYC5XPWNJKMLVFZU3S3JFKV7BY5S2MQ2M7TZSWH88SPMUD7DF49LGCQF3X7LCDSJEZ34AD2AC9YUHJVPGY9SY4ZZ3KMXHFT8YRB8DFXTC65VUSM5TM37P7JCQ874LUWXMNMK7MMEKFKSEEH99GAMFE2FMSQVL5QJ6NUCT6LU2YHH99EG9NN6HJ4W6E4FR7GM3F8VU2QSEHB6TURG59LFRYXMQLSMTPUP6KYHHWRMT56C7PSV6WLG2PGTGYYWYACQ5WGVKYCL95KFMSKRGHXQSH467ZW9B4KL4BDSVCB4GACRR4M8NG96ZMF4YJLK9QN3EPXC2V3VH36N3CQN2XPCDPFS19AEZ4TKPQ8E6LWE3UVVSD9BXLVLTNDDKV7HB5DMPRMXSRZM29KZ2XMJR2J9WV3UR2EJ76SCJ5GYE48R78FJC4K8QTU6BTRS4848ZKSZEQWNJSCSSSMNH6JUE5E7SBVE7GFVTLWPDL6ZGBE36NKYB6ANR9DYL3ENGQHQH96Q8KGXRHZR539BCYQ4MXAEXPVWSKW52QSLCVEBTZR2AQDUHWN3UM6FUYK9DMQSNSH299MN9LBZYTJ3GKA2DTMSV76VW8KD9F2SXKLMER7Q5NR8GPYBPRBVT7KKKCKJNLR4BMD47WBHJZUT7DNQ7SJG5FJJSAU8Q5WW44LZ6ENWMZ3S6BJGNG3RCLQV6R6X8LT972EG2X7S9PVF7XUP5VJPVE98WFP3G6LDQVG8Y4RVEMBP5QNR63HC3

x64RSA：020F7ADF029DED21C2F609E165015CF7FBF0CDPUWN3FKC4K3F8P45LCEZ7YDEUSPXFDJL8SYXW22QLDPM3RN5R5HP4E5R7PFUYT6JPCXA9BYBNH3M8B9JG2D4UXQWV3YMRQE927FMKA6GTWFBERBCWH4J8RVW29Y2UH95JNXXFB5W7X5L4REKB6258UU3KF4W3YK85W9BPMYZR2WQNJFS9KXKYJK9TJSAQ2USK5Z3WZBX6SA8H0CDP9RZZ3BWDLXNZXJQWSABRAJ8CJ6YYJ3LZD9HZH49SCP63XXH8LRPEJFUNVNZWD7YJPEZLDY2B3XM9RY2YX7NSPZ77RSG85UV95AE4AHU2TXFVEEMMX4FT7ZTB2NZ4Q3KRNJ65G59TV296DDHQP66UHGAKF7W6KV4SGTRT9FZ8CK3N87Y3CG3LEMJ642AETH68TRCB9CJCYRKK0CDREM2AXD85QEVFPTTLVZ656TYNDVUSKXTWEQ5947CTSRNA5FQLPRHA6WXW6BUT3TYFXBXHKPCWHXKFAEP7SHAGVGRH9BJPYYSH9UX236FYU33Q5DS8BAAXWGW7T7U4MP3XDS3XA9SNEPE8WBRVCQU7R7ETM8HFXAL66S84RPSFLY8KMZ63QJJD2W4HNPT9AMQ9ACRJR6QD2BL9

Edited 18 hours ago by lengyue

[TRISTAN Pro]

19 hours ago, azufo said:

Why delete every time your comment mr.Pro ?

I don't have free times but after check it's the same as always(old).

@lengyue the Constant encryption is 91893BCD.

 

Edited 1 hour ago by TRISTAN Pro
Same as old