How to dump the VM in Enigma 5.X protected files?

For english speakers or readers.
If you don't know Romanian post here.

How to dump the VM in Enigma 5.X protected files?

Post Number:#1  Postby markunlocker » 10 Nov 2016 05:40

Hello friends , i need some help -

I need to dump the VM in some Enigma Protected targets , recently i was using LCF-AT Script to do this , but in some targets it doesnt work ( Application Crashes)

Anyone would give me some Advise?

Thanks In advanced .

PD: In the Attachment i will let you the script from LCF-AT .
Attachments
Simple script which dumps the VM.txt
(1.37 KiB) Downloaded 113 times
User avatar
markunlocker
Amator
Amator
Progress to next rank:
13.3%
 
Status: Offline
Posts: 2
Joined: 06 Nov 2016 14:06

Invitations sent: 0
Referrals: 0
Local time: 23 Sep 2017 05:07
Has thanked: 2 times
Been thanked: 0 time

Re: How to dump the VM in Enigma 5.X protected files?

Post Number:#2  Postby giv » 10 Nov 2016 11:15

First you have to disable the high memory allocation of the VM then ADD to the dump, else if the VM is allocated to highest memory area the unpacked file will crash.
Just bp on VirtualAlloc and watch the parameters (MEM_TOP_DOWN).
https://msdn.microsoft.com/en-us/librar ... 87(v=vs.85).aspx
Best regards!
GIV
User avatar
giv
Admin
Admin
 
Status: Offline
Posts: 844
Age: 35
Joined: 02 Nov 2012 15:33
Location: Romania

Invitations sent: 3
Referrals: 25
National Flag:
Romania
Local time: 23 Sep 2017 05:07
Has thanked: 287 times
Been thanked: 325 times

Re: How to dump the VM in Enigma 5.X protected files?

Post Number:#3  Postby markunlocker » 10 Nov 2016 16:19

Hello @Giv , thanks for reply.

I mean The application Crashes when the script is dumping the Vm.
I was adding the VM in some targets using Lorpe , i make the VM dump with that script From LCF-AT , just Changing Some parameters (Oep and VIrtual Alloc ) and It works Just fine , even In targets protected With Enigma 5.x , But in anothers It Just Fails. The app Crashes when the script is trying to dump it .


Can You give me some help here ?

Take a Look at the script . By the way , Thanks For your help
User avatar
markunlocker
Amator
Amator
Progress to next rank:
13.3%
 
Status: Offline
Posts: 2
Joined: 06 Nov 2016 14:06

Invitations sent: 0
Referrals: 0
Local time: 23 Sep 2017 05:07
Has thanked: 2 times
Been thanked: 0 time


Return to English area

Who is online

Users browsing this forum: No registered users and 1 guest

cron