Reverse Engineering b10g | REM

Themida+WL1.1.0.0-2.1.0.0Dumper+IAT Repair+CodeEncryptRepair_v2.6.0

By [SND]quosego

Hi all,

It’s time to make a final stand. Oreans it’s your turn now.
This package includes the following;

WL.&.TM.VM.dumper.&.IAT.CodeEnc.Fixer.v2.6.0-SnD
A script to unpack all known versions of Winlicense and Themida using any options.

The script will unpack all known Themida and Winlicense applications
using virtual machine antidump on Windows XP. (v1.8x – 2.1.0.0)

Known issues;
-Version retrieving can error, switch it off when neccesary.
-VM oeps are not always retrieved you must rebuild or find them yourself.
-Memory loaded dll’s are not dumped.
-The script stops after asking for the new antidump locations, just resume the script when it does.

Usage;
Step 1: Unpack an application using this script.
(Start at system entrypoint, EP break must be available,
no other breakpoints)
Step 2: When neccesary attach the dumped VM. Fix VM oep.
Step 3: Dump and Imprec.

Always read the log it holds vital information. Also there are several options that can be modified in the first few lines of this script.
Tinker with it if it doesn’t unpack your app.

The.Oreans.(Themida&Winlicense).VM.antidumps-Q
An article covering all antidumps, including more newer ones.

Running.Winlicense.Protected.Applications.Without.Licenses-SND
An article on how to run Winlicense protected apps without licenses.

I owe my gratitude to the whole of the webscene for support,
inspiration , ideas and the supply of information/executables.

Especially;

-A lot of suppliers.
-ARteam for being rumored to be the first to have found the first antidumps.
-An unnamed American.
-Lena for showing so many people the way.
-Teddy, for supplying us tuts4you.
-Team SND old and new members.

And most of all just have fun with this all. Use it for knowledge, the challenge and fun.
Monetary gain is never to be aspired.

regards,

http://letitbit.net/download/2216.28c286be4bac9432d2fd791f9/tmd.rar.html

http://letitbit.net/download/0229.0ec181aaf5ad1e8a17e074379/Unpacker_ExeCryptor_RC2.rar.html

by tPORt
http://letitbit.net/download/0314.0278e133219167ad3bddefe1f/Quick_Unpack_2.2.Tool.tPORt.rar.html

What’s new:

v1.0 release candidate 2
————————
* Fixed bug in import rebuilding
* Added dynamic OEP search method
* Added manifest and file version information
* Added support for unpacking dll files with stripped relocations
* Fixed other minor bugs
http://vip-file.com/download/6ac381781913/Unpacker-ExeCryptor-2.x.x-v1.0-RC2.zip.html

Bugfix: A couple of bug reports filtered in over the years, all pertaining to the Nanomite loader. Two fairly important fixes were made, so I thought I’d publish them

http://vip-file.com/download/c4c4ab235065/Armadillo-ArmInline-0.96ff.zip.html

GUnPacker.V0.4 generick unpacker & helper
ACProtect 1.09、1.32、1.41、2.0
AHPack 0.1
ASPack 102b、105b、1061、107b、1082、1083、1084、2000、2001、21、211c、211d、211r、212、212b212r
ASProtect 1.1,1.2,1.23RC1,1.33,1.35,1.40,SKE.2.11,SKE.2.1,SKE.2.2,2.3.04.26,2.4.09.11
Alloy 4.1、4.3
alexprot 1.0b2
Beria 0.07
Bero 1
BJFNT 1.2、1.3
Cexe 10a、10b
DragonArmor 1
DBpe 2.33
EPPort 0.3
eXe32Pack 1.42
EXECrypt 1
eXeStealth 2.75a、2.76、2.64、2.73、2.76、3.16(支持,但效果不是很好)
ExeSax 0.9.1(支持,但效果不是很好)
eXPressor 1.4.5.1、1.3(支持,但效果不是很好)
FengYue’Dll unknow
FSG 1.33、2.0、fsg2.0bart、fsg2.0dulek
GHF Protector v1.0(支持,但效果不是很好)
Krypton 0.2、0.3、0.4、0.5(For ALL 支持,但效果不是很好)
Hmimys Packer UnKown
JDProtect 0.9、1.01、2.0
KByS unknow
MaskPE 1.6、1.7、2.0
MEW 11 1.0/1.2、mew10、mew11_1.2、mew11_1.2_2、mew5
molebox 2.61、2.65
morphine 2.7(支持,但效果不是很好)
MKFpack 1
Mpress UnKown
Mucki 1
neolite 2
NCPH 1
nsapck 2.3、2.4、3.1
Obsidium 1.0.0.69、1.1.1.4(For ALL 支持,但效果不是很好)
Packman UnKown
PCShrink 0.71
PC-Guard v5.0、4.06c
PE Cryptor 1.5
PEBundle 2.3、2.44、3.0、3.2
PE-Armor 0.46、0.49、0.75、0.765
PECompact 1.x
PEDiminisher 0.1
PELock 1.06
PEncrypt 4
pepack 0.99、1.0
PELockNt 2.01、2.03、2.04
PEtite 1.2、1.3、1.4、2.2、2.3
PKlite32 1.1
PolyCryptA UnKown
peshield 0.2b2(支持,但效果不是很好)
PESpin 0.3(支持,但效果不是很好)、0.7、1.1、1.3
PEX 0.99
PolyCrypt PE 1.42
PUNiSHER 1.5(支持,但效果不是很好)
RLPack 1.1、1.6、1.7、1.8
Rubbish 2
ShrinkWrap 1.4
SDProtector 1.12、1.16
SLVc0deprotector 0.61(支持,但效果不是很好)、1.12
SimplePack 1.0、1.1、1.2
SoftSentry 3.0(支持,但效果不是很好)
Stealth PE 1.01、2.1
Stone’s PE Encryptor 1.13
SVKP 1.11、1.32、1.43
ThemidaDemo 1.0.0.5
teLock 0.42、0.51、0.60、0.70、0.71、0.80、0.85、0.90、0.92、0.95、0.96、0.98、0.99
Upc All
Upack “0.1、0.11、0.12、0.20、0.21、0.22、0.23、0.24、0.25、0.26、0.27、0.29、
0.30、0.31、0.32、0.33、0.34、0.35、0.36、0.37、0.38、0.39、0.399″
UPolyX 0.2、0.5
UPX “0.51、0.60、0.61、0.62、0.71、0.72、0.80、0.81、0.82、0.83、0.84、0.896、
1.0w、1.03、1.04、1.25w、2.0w、2.02、2.03、3.03、UPX-Scrambler RC1.x”
V2Packer 0.02
VisualProtect 2.57
Vprotector 1.2
WindCrypt 1.0
wwpack32 v1.20、v1.11、v1.12
WinKript 1
yoda’s cryptor v1.1、v1.2
YZPACK 2.0
yoda’s Protector v1.02、v1.03.2、v1.03.3、v1.0b

original & unpacked:BY PAVKA
http://letitbit.net/download/e26a01440450/GUnPacker.V0.4.By.rar.html

http://letitbit.net/download/3ff267103447/stripper-v2.13b9.rar.html
http://letitbit.net/download/4fecc3897007/stripper-v2.07f.zip.html
http://letitbit.net/download/079257596467/stripper-v2.11rc2.zip.html
http://letitbit.net/download/3110cd452204/CASPR-v1.0.12.rar.html
http://letitbit.net/download/25129e80979/ASProtect.zip.html
http://letitbit.net/download/615199657920/Aspr-v2.XX-unpacker-v1.0E.rar.html
http://letitbit.net/download/fcf976186402/ASPriNF-v1.6-beta.rar.html
http://letitbit.net/download/e8ace655459/stripper-v2-1-.11rc2.zip.html

ArmaG3ddon V1.5.1
the installer has been removed, it was asking for .net framework, even if the program is pure c++.

Anyone that used the *.msi package should uninstall the program using Control Panel >> remove program, Then they can use the new package (which doesn’t use the installer).
http://arteam.accessroot.com/releases.html

http://letitbit.net/download/7f1c2e751233/ArmaG3ddon-v151-by-CondZero.rar.html

asprotect unpacking tools
=========================

Aspr v2.XX unpacker v1.0E
ASPriNF v1.6 beta
Aspr2.XX unpacker v1.14aSC
CASPR v1.0.12
stripper v2.07f
stripper v2.11rc2
stripper v2.13b9

http://letitbit.net/download/3ff267103447/stripper-v2.13b9.rar.html
http://letitbit.net/download/4fecc3897007/stripper-v2.07f.zip.html
http://letitbit.net/download/079257596467/stripper-v2.11rc2.zip.html
http://letitbit.net/download/3110cd452204/CASPR-v1.0.12.rar.html
http://letitbit.net/download/25129e80979/ASProtect.zip.html
http://letitbit.net/download/615199657920/Aspr-v2.XX-unpacker-v1.0E.rar.html
http://letitbit.net/download/fcf976186402/ASPriNF-v1.6-beta.rar.html
http://letitbit.net/download/e8ace655459/stripper-v2-1-.11rc2.zip.html

or

http://letitbit.net/download/dc3f76794511/asprotect-unpacking-tools.rar.html

hi

http://letitbit.net/download/8e9866263606/UnArmadillo-v1.4.rar.html
http://letitbit.net/download/ab3d52856509/Armadillo-Reducer-1.7.1-RC2.rar.html
http://letitbit.net/download/26c435634333/HWID-Changer-v.0.2-by-TrueLies.rar.html
http://letitbit.net/download/76619c869597/Armag3ddon-v14-by-CondZero.rar.html
http://letitbit.net/download/a471f8351581/Armadillo-Find-Protected.rar.html
http://letitbit.net/download/8e9866606350/UnArmadillo-v1.4.rar.html
http://letitbit.net/download/a0686e156083/Demaradillo-v0.4.rar.html
http://letitbit.net/download/0313be248144/dilloDIE-v1.6.rar.html
http://letitbit.net/download/4b9041385874/ArmadilloKiller-v2.6.rar.html
http://letitbit.net/download/9bb5c2571613/ArmadilloFindProtected-v1-.4.rar.html
http://letitbit.net/download/d71b0951038/Armadillo-Killer.v1.3.CopyMem.Edition.rar.html
http://letitbit.net/download/5c0106355004/Armadillo.Killer.2.6.build.5.rar.html
http://letitbit.net/download/cab631504194/Armadillo.DLL-OCX-Stripper.v1.6.rar.html
http://letitbit.net/download/f20e13542732/Armadillo.Goblin.v1.0.rar.html

or
Armadillo Find Protected
Armadillo Killer.v1.3.CopyMem.Edition
Armadillo Reducer 1.7.1 RC2
Armadillo.DLL-OCX Stripper.v1.6
Armadillo.Goblin.v1.0
Armadillo.Killer.2.6.build.5
Armadillo.Password.Patcher
Armadillo_Find_Protected_V1.8
ArmadilloFindProtected v1.4
ArmadilloKiller v2.6
ArmaFP_bypassAV
Armag3ddon v14 by CondZero
arminline 0.6
ArmKiller v1. 2 1 Tool by TLG_XQuader
Demaradillo v0.4
dilloDIE v1.6
HWID Changer v.0.2 by TrueLies
Un Armadillo v1.4

http://letitbit.net/download/bf46fc393054/Armadillo-Unpacking-Tools-serie-2.rar.html

“I am releasing the latest public version v1.4 for Armageddon tool from CondZero. Thanks a lot to CondZero and Nacho for their efforts especially supporting latest Armadillo.

One note: now the tool is called ArmaG3ddon due to blacklisting of previous name in new armadillo.

Current Release: v1.4 August 2008

+ fix some minor bugs
+ improve import redirection functionality
+ update Arteam Import Reconstructor v1.2 (Nacho_dj)
+ add support for Armadillo v6.0.0/v6.0.4 custom builds
+ new log internal EP/OEP (nanomites) option
+ add refresh option for processing multiple targets”

by CondZero

http://arteam.accessroot.com/releases.html?fid=35

http://letitbit.net/download/76619c869597/Armag3ddon-v14-by-CondZero.rar.html

http://letitbit.net/download/a04cb3680016/unkk.zip.html

VM Unpacker 1.5
DownloadLink: http://rapidshare.com/files/133785241/VM_Unpacker_1.5.rar

its rus tool

WinUpack_KiLLeR 0.1 by flashback
_wWw.Fba2008.land.ru
_http://letitbit.net/download/48fd57784448/WinUpack-KiLLeR.7z.html

June 2008 – v1.3.3
+ hotfix to resolve strategic code splicing issue
for last inactive MOV EDI,EDI instructions and
issue a warning message
(340.91 KB)

direct link:
http://arteam.accessroot.com/releases/dl.php?id=35

or

http://letitbit.net/download/e98a84284105/Armageddon-v133-by-CondZero.rar.html

v1.4.1 [05/07/08]

May 2008 – v1.3
+ resolve relocations for dll files (Nacho_dj)
+ added new option to minimize the size of a dumped file (Nacho_dj)
Particulary useful for Shockwave Flash + applications that make use of an overlay. Of course this will also rebuild a normal target’s PE structure.
+ improved import rebuilder v1.1.2 (Nacho_dj)
+ added new option to “Resolve” nanomite INT3 instructions with their original
jmp instructions and patch directly to the dumped target. Requires use of the nanomite “Analyze” + “Log” options. Note: you can also elect to resolve nanomites directly to a target process’s memory if you elect to detach!!
+ integrated Admiral’s Strategic Code Splicing removal engine into the tool.
This is now the (default) behaviour and can be overridden with new option to
redirect CS (code splices) instead
+ new option to dump / decrypt / decompress the .pdata section to a binary file
+ new option to detach from a process (choose: DebugBlocker or CopyMemII)
+ resolve problem for ArmAccess dll function:Installkey missing error msg
+ add support for UPX compressed single process targets
+ new option to change your Standard / Enhanced Hardware Fingerprint ID
+ resolve some minor bugs
===========================================
March 2008 – v1.2g [gabor edition]
+ add warning message for OEP call return VA not from Armadillo VM
Note: Informational, not usually relevant for dll’s or exe’s with copymem2,
but may be useful for troubleshooting invalid OEP’s resulting
from custom implementations and/or packing / compressing of a file
prior to being protected by Armadillo
+ fix problem with copymem2 search string error
+ fix problem with createdump on error
===========================================
March 2008 – v1.2
+ improved PE section name resolution for internal use (thank’s Ghandi)
+ improved ARTeam Import Reconstructor v1.2
===========================================
February 2008 – v1.1
+ added dll support (dll loader.exe)
+ added option “Use OpenMutext trick” to force a single process. Use only if normal “debug blocker” processing fails. This would occur when a parent process launches the child process, but doesn’t debug the child process (i.e. use the WaitForDebugEvent API)
+ improve IAT elimination functionality
+ includes updated ARTeam Import Reconstructor
===========================================
February 2008 – v1.0 (initial release)
Born – 11/13/2007

http://letitbit.net/download/4fa2c3821802/Armageddon-v13-by-CondZero.rar.html

bug fixed

http://letitbit.net/download/e93da153238/ASPRUnpacker-v1.14aE.rar.html

AoRE Unpacker is for unpacking simple packers, so far it supports the following:

!EP (EXE_Pack) 1.2
ASPack v2.12
AverCryptor 1.0
DexCrypt 2.0
eXPressor 1.2.0/1.3.0.1
MEW_1.1
Molebox 2.2.4
NsPack 2.9/3.0/3.3/3.4/3.6/3.7
PeCompact 1.30/1.50/1.84
UPX 1.25/1.91/2.00/2.01/2.02/2.90/3.00/3.01
and much more

http://letitbit.net/download/e65c6755738/AoRE-Unpacker-0.3.rar.html

http://letitbit.net/download/21f49a561171/tmdunpacker.rar.html