ergrelet / unlicense

Dynamic unpacker and import fixer for Themida/WinLicense 2.x and 3.x.
GNU General Public License v3.0
1.02k stars 188 forks source link

Failed to unpack: IAT unwrapping failed #106

Open greenozon opened 1 year ago

greenozon commented 1 year ago
c:\Temp>unlicense  GET1.exe --verbose
←[1;32mINFO←[0m - Detected packer version: 3.x
←[38;20mDEBUG - Probed .text section at (0x1000, 0x31c000)←[0m
←[1;36mfrida-agent←[0m: Setting up OEP tracing for "GET1.exe"
←[1;36mfrida-agent←[0m: Exception handler registered
←[1;36mfrida-agent←[0m: OEP found (thread #412): 0x12121b8
←[1;32mINFO←[0m - OEP reached: OEP=0x12121b8 BASE=0x1210000 DOTNET=False
←[1;32mINFO←[0m - Looking for the IAT...
←[38;20mDEBUG - Exports count: 12299←[0m
←[1;32mINFO←[0m - Performing linear scan in data sections...
←[38;20mDEBUG - Looking for the IAT at (0x1211000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 100←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x152d000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 50←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x155c000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 0←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x155d000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 4←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x155e000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x21c for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 0←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x1562000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 88←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x1563000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 53←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 2←[0m
←[38;20mDEBUG - Looking for the IAT at (0x1564000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 92←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x1579000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 100←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x15ba000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 53←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 2←[0m
←[38;20mDEBUG - Looking for the IAT at (0x15bb000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x34c for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 0←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x15bc000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 3←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x15bd000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 57←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x15cb000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 100←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x1bd9000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x3cc for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 0←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x1fa1000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 4←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x1210000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 23←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x1211000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 100←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x1212000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 100←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x1213000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 77←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 3←[0m
←[38;20mDEBUG - Looking for the IAT at (0x1214000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 94←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x153f000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 0←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x1540000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 0←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x1541000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 0←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x1542000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 0←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x155c000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 0←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x155d000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 4←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x155e000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x21c for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 0←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x155f000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 100←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 100←[0m
←[38;20mDEBUG - Looking for the IAT at (0x1560000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 0←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x1562000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 88←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x1563000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 53←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 2←[0m
←[38;20mDEBUG - Looking for the IAT at (0x1564000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 92←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x1565000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 72←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x1566000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x2c0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 0←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x15bb000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x34c for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 0←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x15bc000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 3←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x15bd000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 57←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x15be000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x118 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 30←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 2←[0m
←[38;20mDEBUG - Looking for the IAT at (0x15bf000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 100←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 1←[0m
←[38;20mDEBUG - Looking for the IAT at (0x15c0000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x158 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 14←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 1←[0m
←[38;20mDEBUG - Looking for the IAT at (0x15cb000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 100←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x15cc000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x110 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 32←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 1←[0m
←[38;20mDEBUG - Looking for the IAT at (0x15cd000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x20 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 92←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 4←[0m
←[38;20mDEBUG - Looking for the IAT at (0x15ce000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x58 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 77←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 4←[0m
←[38;20mDEBUG - Looking for the IAT at (0x1bd9000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x3cc for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 0←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x1bda000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x70 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 72←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 1←[0m
←[38;20mDEBUG - Looking for the IAT at (0x1bdb000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x10 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 96←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 2←[0m
←[38;20mDEBUG - Looking for the IAT at (0x1bdc000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 100←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[38;20mDEBUG - Looking for the IAT at (0x1fa1000, 0x1000)←[0m
←[38;20mDEBUG - Scanning 100 elements, pointer size is 4←[0m
←[38;20mDEBUG - Potential start offset 0x0 for the IAT←[0m
←[38;20mDEBUG - Non-null pointer count: 4←[0m
←[38;20mDEBUG - Valid APIs count: 0←[0m
←[38;20mDEBUG - R*X destination count: 0←[0m
←[1;32mINFO←[0m - Looking for wrapped imports in code sections...
←[1;32mINFO←[0m - Potential import wrappers found: 4
←[1;32mINFO←[0m - IAT found: 0x155e6a4-0x155e6a4
←[1;32mINFO←[0m - Resolving imports ...
←[31;20mERROR - IAT unwrapping failed←[0m

c:\Temp>

GET1.zip