Exetools (https://forum.exetools.com/index.php)
-   General Discussion (https://forum.exetools.com/forumdisplay.php?f=2)
-   -   Winlicense (Themida) 2.4.6 x64 Help for Bypass/Unpack (https://forum.exetools.com/showthread.php?t=19844)

Reaper 04-25-2021 06:06

Winlicense (Themida) 2.4.6 x64 Help for Bypass/Unpack
Hi guys!
Ask for your help as the most skillful reversing community that I know.  Long time I can't find any tools/tuts/help to unpack or even bypass HWID lock of the x64 version of winlicense (themida) packer.
I spent 4 months testing a lot of methods (from runpe dump to writing own hypervisor for full os hardware emulation) but still not defeat this protector - winlicense 2.4.6 x64
So when I found this community, decide to ask, maybe someone had similar experience and can help with unpack or give some advice, links, any info or tools. 
So - target is x64 c++ console application (and i also have working regkey), packed with winlicense 2.4.6 x64 (exeinfope, die 3 detection) and locked to HWID (all 4 options, CPU, HDD, BIOS, MAC). 
I can bypass anti vm and anti debug. Also I can see api calls via external tools (WinApiOveride, Deviare SpyStudio). Also i explore how themida geather HWID, all 4 parts (dwords) and methods (api calls) how it get this. And maybe I will just finish my hook app to bypass HWID but for CPU identification themida use CPUID which is asm mnemonic and cant be hooked from user space (only driver like own hypervisor).
I started searching for intel vt-x most simple working hypervisor, which implements CPUID spoofing, but there are tons of bugs and it's hard to debug and write.

So I still hopes that some had similar experience in the past with unpacking/bypassing x64 version of themida / winlicense and Ask for any help  :confused:

user1 04-29-2021 23:13

I m curios about Hwid emulation

can share code?

Reaper 04-30-2021 18:37


Originally Posted by user1 (Post 122978)
I m curios about Hwid emulation

can share code?

What code exactly ? I still not write own hypervisor , only hook MAC, and NtQueryinformation api , also have projects for disk spoofing, and sm bios,
But the last part of hwid - cpuid , still not intercepted because it need hypervisor and vmexit handling.

Also i find few projects on github for Themida devirtualization and built but it not work for my binary.

All times are GMT +8. The time now is 15:35.

Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2021, vBulletin Solutions, Inc.
Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX