search

ergrelet / unlicense

Dynamic unpacker and import fixer for Themida/WinLicense 2.x and 3.x.
GNU General Public License v3.0
945 stars 181 forks source link

Unable to find OEP of .NET WPF programs for a long time #52

Closed ghost closed 11 months ago

ghost commented 1 year ago

The program I need to unpack is a .NET WPF program, and it protects winlicense2.0-2.4.6 and uses Babel's confusion, but unlicense can't find the OEP of this program for a long time, even if the timeout is set. Log: PS C:\Users[Protected]\Desktop> .\unlicense_x32.exe "C:\Program Files (x86)\Netease\MCLauncher\WPFLauncher.exe" INFO - Detected packer version: 2.x frida-agent: Setting up OEP tracing for "WPFLauncher.exe" frida-agent: Exception handler registered ERROR - Original entry point wasn't reached before timeout WPFLauncher.zip

redxhawk commented 1 year ago

For the older versions of Themida/Winlicense just run and dump the exe through Extreme Dumper or any memory dumper.

ergrelet commented 1 year ago

Hi! I cannot reproduce the issue. The OEP is properly found with v0.3.0 on my side.