Starlinker, posted Mon Oct 26, 2015 6:23 pm (8963)

---

Ok, thank you

sadfaffel, posted Tue Nov 10, 2015 3:11 pm (9573)

---

I can?t unpack mine too.The application just crashes.
I sent it to your pm.
If you can, can you sent me your?s ollydbg folder and show me how?

Thx
Sadfaffel

zhatros, posted Thu Nov 19, 2015 6:18 pm (9909)

---

Hello Critical, when i try to unpack in step with i need to edit olly.ini and before that i resume, my olly crashes.

This is the two files i need to unpack.

https://www.sendspace.com/file/psu5rd

https://www.sendspace.com/file/qyl6k4

lelejau, posted Tue Dec 01, 2015 2:31 am (10224)

---

It says KernelMode doesnt work in 64 bit systems and my unpack process is not giving the exact screen shots after the changes in the ini file. can you help me ?

CriticalError, posted Tue Dec 01, 2015 3:28 am (10225)

---

you can't unpack themida in x64 with ollydbg, if you read carefuly OLLYDBG is a debugger for x32, so in this case you need try use xdbg from mrexodia, is a debugger in base a ollydbg but for x64, so well you can try.

lelejau, posted Tue Dec 01, 2015 4:23 pm (10236)

---

thanks for the answer. But where can I find those plugins for xdbg? Im total lost here.
I find there is already some script engine there, but it says duplicate label: FINAL_RESULT.

CriticalError, posted Tue Dec 01, 2015 8:24 pm (10238)

---

as far I know it won't exist, just try do it in SO of x86 arquitecture.

hinipek, posted Thu Dec 03, 2015 12:25 pm (10276)

---

What I can do?
I have x64 PC,is possible to found plugins for xDBG ,cause I have label duplicate FINAL_RESULT.

CriticalError, posted Thu Dec 03, 2015 7:01 pm (10288)

---

for unpack a target of x32 with SO of x64 you need use other plugins, thats the problem with Windows 7, 8,1,etc if you use XP is not a problem, the main problem is Themida don't work.

lelejau, posted Thu Dec 03, 2015 9:13 pm (10294)

---

all right, thanks for the information. Ill try it in a few days and I come back here if I find any problems.

atom0s, posted Sun Dec 06, 2015 7:32 am (10339)

---

Windows 7 32bit works fine for unpacking with this script.

If you have a 64bit OS you can download a virtual machine program like VirtualBox, VMWare, etc. to just run another 32bit os in a virtual machine instead of reinstalling your OS.

garfield028, posted Mon Dec 21, 2015 11:14 am (10527)

---

hi , i used the unpack script and don't work done..

the resposne message : [ when the i was running script ]

"If WL doesen't use a MessageBoxExA API to show you the HWID Nag
or other messages then it used a custom code.In this case just pause
the script if you see the message then pause Olly open call stack and
set a soft BP from where it was called from = after message loop.Now
remove BP again and set the script eip on the label......"

...

i want to know i bp where ? bp what time?

thank you very much...

hckhenrique, posted Tue Dec 22, 2015 3:05 pm (10536)

---

Can you try please with this file?
https://www.sendspace.com/file/ehrzot

I tried but I get different messages from Odbg, I am probably doing something wrong...

tb52525, posted Tue Dec 22, 2015 8:09 pm (10537)

---

Can you try to unpack this file for me?

I've been trying all week and no success.

https://www.sendspace.com/file/q9mkjo

Thank you in advance.

danjin21, posted Sun Jan 10, 2016 9:45 am (10791)

---

i did well until now!

BUT

when i check no at when asked to check NOPPER..

then nothing happen....

i could see Xbundler prepair sign not found! at log window...

windows7 or high blarblar... then should i use windows XP? Not Vista? (I'm Vista user)

and... it say.. " if Xbundler found in auto-modus , it will dump blarblar... then should i download Xblunder..?

do u know why?

if u want see my EXE, then i will upload.. plz answer!!

ps my computer is 32bit

and i did all and clear !

CriticalError, posted Sun Jan 10, 2016 2:51 pm (10792)

---

you need use Windows XP to unpack this targets as well, if you will use W7 need other plugins are not incluided in this topic.

danjin21, posted Tue Jan 12, 2016 8:07 am (10800)

---

CriticalError wrote:

you need use Windows XP to unpack this targets as well, if you will use W7 need other plugins are not incluided in this topic.

ok! but i do't have XP computer Now....T.T
i think it won't be long time to unpack this exe...

if u are XP user... then can u spend a little time for me to unpack this exe..? ( that's ok though say No, then i should find XP OS.. and Install..... )

i'll upload!

https://drive.google.com/file/d/0B0k8hf ... sp=sharing

aluigi, posted Wed Jan 13, 2016 4:11 pm (10810)

---

I think that CriticalError meant to use Windows XP in a virtual machine like VirtualBox: http://www.virtualbox.org

CriticalError, posted Wed Jan 13, 2016 4:39 pm (10812)

---

yes agree with aluigi, you don't need be user XP, you can try in a virtual machine like VirtualBox, VMWare,etc and install XP there, normally I forget mention from the begining the plugins are for XP only and no for WXP, really sorry for that issue, this make a lot mistakes in users, because nobody use XP in this times but well, for W7 is necessary another plugins and really many times I try and configure it, no lucky to unpacking it because I run x64 arquitecture so well is necessary a x86, the debugger is for x86 and no for x64, so this is most tedious problem in W7, sure it can be, but no familiar with olly plugins in W7 to unpack Themida protections.

cccroswhite, posted Sat Jan 16, 2016 4:20 pm (10831)

---

Hello CriticalError,

First at all, sorry for my bad english.

I get debug the executable with ollydbg, but i can't find (it's hard) the exactly jump to bypass the verification dongle key (HARDKey), because themida encript. But i found this foro with your instructions to unpack themida.

I did follow the steps to unpack themida, but after the step 10 i get the following error "Problem!WL Section not in stack to read - Wrong VirtualAlloc call from". I'm using VMWare Player 6.0.4 with Windows XP SP3.

The url with the executable that i can't unpack

https://drive.google.com/file/d/0ByeJr6CQUvcPVTFVNEI0Z2NveDg/view?usp=sharing

PS: I don't know if this executable is only protected by themida or other things. ProtectionId only show me themida.

Thanks in advance

rubens, posted Thu Jan 21, 2016 9:22 pm (10920)

---

HELP-ME !
http://i.imgur.com/DzikZfl.png

cccroswhite, posted Thu Jan 21, 2016 9:48 pm (10922)

---

rubens, el mensaje te esta indicando que tienes que aplicar otras herramientas para el caso de 64 bits. Por que no pruebas instalandote una Virtual Machine con XP de 32 bits.

rubens, posted Fri Jan 22, 2016 9:59 pm (10965)

---

with windows xp went up item 13, I do not know why not come more pop
HELPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPP-ME

CriticalError, posted Sat Jan 23, 2016 2:22 pm (10987)

---

you need provide full binaries, no only the file contain themida.

rubens, posted Sat Jan 23, 2016 5:41 pm (10990)

---

but o'que would be the full binaries, I can not generate the executable of the game folder, I took the game folder to give the unpack?

You are to take this protection?