Exetools  

Go Back   Exetools > General > General Discussion

Notices

 
 
Thread Tools Display Modes
Prev Previous Post   Next Post Next
  #1  
Old 04-25-2021, 06:06
Reaper Reaper is offline
Friend
 
Join Date: Apr 2021
Posts: 3
Rept. Given: 0
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 3
Thanks Rcvd at 1 Time in 1 Post
Reaper Reputation: 0
Winlicense (Themida) 2.4.6 x64 Help for Bypass/Unpack

Hi guys!
Ask for your help as the most skillful reversing community that I know.  Long time I can't find any tools/tuts/help to unpack or even bypass HWID lock of the x64 version of winlicense (themida) packer.
I spent 4 months testing a lot of methods (from runpe dump to writing own hypervisor for full os hardware emulation) but still not defeat this protector - winlicense 2.4.6 x64
So when I found this community, decide to ask, maybe someone had similar experience and can help with unpack or give some advice, links, any info or tools. 
So - target is x64 c++ console application (and i also have working regkey), packed with winlicense 2.4.6 x64 (exeinfope, die 3 detection) and locked to HWID (all 4 options, CPU, HDD, BIOS, MAC). 
I can bypass anti vm and anti debug. Also I can see api calls via external tools (WinApiOveride, Deviare SpyStudio). Also i explore how themida geather HWID, all 4 parts (dwords) and methods (api calls) how it get this. And maybe I will just finish my hook app to bypass HWID but for CPU identification themida use CPUID which is asm mnemonic and cant be hooked from user space (only driver like own hypervisor).
I started searching for intel vt-x most simple working hypervisor, which implements CPUID spoofing, but there are tons of bugs and it's hard to debug and write.

So I still hopes that some had similar experience in the past with unpacking/bypassing x64 version of themida / winlicense and Ask for any help 
Reply With Quote
 

Tags
bypass, themida, unpack, winlicense, x64

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



All times are GMT +8. The time now is 02:08.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX
( 1998 - 2021 )