ergrelet / unlicense

Dynamic unpacker and import fixer for Themida/WinLicense 2.x and 3.x.
GNU General Public License v3.0
1.02k stars 188 forks source link

[New] UC_ERR_FETCH_UNMAPPED and A resolved API wasn't an export, it's been replaced with 'kernel32.ExitProcess' from Release 0.4.0 #132

Open TheMu19099 opened 1 month ago

TheMu19099 commented 1 month ago

Log of the console, i'm getting two warnings that saying "A resolved API wasn't an export, it's been replaced with 'kernel32.ExitProcess'." Last i got DEBUG - ERROR: DEBUG - ERROR: Invalid memory fetch (UC_ERR_FETCH_UNMAPPED)

I don't know what to do in this case, can you help me? Thank you by the tool, is very useful!

INFO - Detected packer version: 3.x
DEBUG - Probed .text section at (0x1000, 0x32014d)
frida-agent: Setting up OEP tracing for "fileblablabla.exe"
frida-agent: Exception handler registered
frida-agent: OEP found (thread #6156): 0x670387
INFO - OEP reached: OEP=0x670387 BASE=0x400000 DOTNET=False
INFO - Looking for the IAT...
DEBUG - Exports count: 22187
INFO - Performing linear scan in data sections...
DEBUG - Looking for the IAT at (0x401000, 0x1000)
DEBUG - Scanning 100 elements, pointer size is 4
DEBUG - Potential start offset 0x8 for the IAT
DEBUG - Non-null pointer count: 97
DEBUG - Valid APIs count: 0
DEBUG - R*X destination count: 4
DEBUG - Looking for the IAT at (0x722000, 0x1000)
DEBUG - Scanning 100 elements, pointer size is 4
DEBUG - Potential start offset 0x0 for the IAT
DEBUG - Non-null pointer count: 92
DEBUG - Valid APIs count: 13
DEBUG - R*X destination count: 92
INFO - IAT found: 0x722000-0x76867e
INFO - Resolving imports ...
DEBUG - Unmapped memory at 0x359e4ca
DEBUG - Mapped 4096 bytes at 0x359e000
DEBUG - Unmapped memory at 0x3798f0f
DEBUG - Mapped 4096 bytes at 0x3798000
DEBUG - Unmapped memory at 0x33d1122
DEBUG - Mapped 4096 bytes at 0x33d1000
DEBUG - Unmapped memory at 0x33daa15
DEBUG - Mapped 4096 bytes at 0x33da000
DEBUG - Unmapped memory at 0x3799000
DEBUG - Mapped 4096 bytes at 0x3799000
DEBUG - Unmapped memory at 0x35a0d50
DEBUG - Mapped 4096 bytes at 0x35a0000
DEBUG - Unmapped memory at 0x359adf6
DEBUG - Mapped 4096 bytes at 0x359a000
DEBUG - Unmapped memory at 0x3793d7d
DEBUG - Mapped 4096 bytes at 0x3793000
DEBUG - Unmapped memory at 0x379406f
DEBUG - Mapped 4096 bytes at 0x3794000
DEBUG - Unmapped memory at 0x756c003c
DEBUG - Mapped 4096 bytes at 0x756c003c
DEBUG - Mapped 4096 bytes at 0x678000
DEBUG - Unmapped memory at 0x33813b4
DEBUG - Mapped 4096 bytes at 0x3381000
DEBUG - Unmapped memory at 0xbb40e64e
WARNING - A resolved API wasn't an export, it's been replaced with 'kernel32.ExitProcess'.
WARNING - A resolved API wasn't an export, it's been replaced with 'kernel32.ExitProcess'.
#and more other unmapped memory that i'll repeat the above because they are so big text to put here.
DEBUG - Unmapped memory at 0x359e4ca
DEBUG - Mapped 4096 bytes at 0x359e000
DEBUG - Unmapped memory at 0x3798f0f
DEBUG - Mapped 4096 bytes at 0x3798000
DEBUG - Unmapped memory at 0x33d1122
DEBUG - Mapped 4096 bytes at 0x33d1000
DEBUG - Unmapped memory at 0x33daa15
DEBUG - Mapped 4096 bytes at 0x33da000
DEBUG - Unmapped memory at 0x3799000
DEBUG - Mapped 4096 bytes at 0x3799000
DEBUG - Unmapped memory at 0x35a0d50
DEBUG - Mapped 4096 bytes at 0x35a0000
DEBUG - Unmapped memory at 0x359adf6
DEBUG - Mapped 4096 bytes at 0x359a000
DEBUG - Unmapped memory at 0x3793d7d
DEBUG - Mapped 4096 bytes at 0x3793000
DEBUG - Unmapped memory at 0x379406f
DEBUG - Mapped 4096 bytes at 0x3794000
DEBUG - Unmapped memory at 0x756c003c
DEBUG - Mapped 4096 bytes at 0x756c003c
DEBUG - Mapped 4096 bytes at 0x678000
DEBUG - Unmapped memory at 0x33813b4
DEBUG - Mapped 4096 bytes at 0x3381000
DEBUG - Unmapped memory at 0xbb40e64e
DEBUG - ERROR:
DEBUG - ERROR: Invalid memory fetch (UC_ERR_FETCH_UNMAPPED)
DEBUG - PC=0xbb40e64e
DEBUG - SP=0xff001d44
DEBUG - BP=0xff001d58
INFO - Imports resolved: 481
INFO - Fixed IAT at 0x722000, size=0x7dd
INFO - Dumping PE with OEP=0x670387 ...
INFO - Fixing dump ...
INFO - Rebuilding PE ...
DEBUG - .rsrc section found (RVA=0x2fc7000)
DEBUG - .text section found (RVA=0x1000)
INFO - Output file has been saved at 'fileblablabla.exe'
martinjechkov commented 1 month ago

+1 there is already an opened issue like this, hopefully ergrelet sees this soon