Hello together,

today I show you a exsample how to unpack Themida / WinLicense

Unpack WinLicense_UnpackMe! v2.0.1.0
-----------------------------------------------------
- Find OEP / Near OEP / stolen code
-
- Find IAT / Magic Jump / Use GDI32 - API will not redirect in TM / WL
-
- Get Full IAT / Fix VM API callīs and jumpīs / Use Script
-
- Repair stolen code / find input and output / log results
-
- Delete useless sectionīs to reduce the target size
Letīs find the OEP
You can use ZwFreeVirtualMemory
or
GetProcessHeap
Here we break in a vm section.
Follow this instruction in dump and we see our whole IAT.The most are redirected to a other vm section but some APIīs are there.
So we set now a HWBP on write byte of one of this API to find later the place of the redirection or the magic jumpīs faster.
So the push dword [eax] instruction before pushīs a redirected API so we will see later which API it was.This UnpackMe was coded in MicrosoftVisual C++ 6.0.
If you have a little bit knowlegde about the program..languageīs and compilerīs then you will know what API it was now.

Here you can see a move of 4 bytes from address two to address one.
Move [00331FF8]=01 to [0041D10C]=00
=
[0041D10C]=00000001
Note this info
Here the next one.

05 to [0041D108]
=
[0041D108]=00000005

Note the info (address)
Here 501 to [0041D104]

Note too
And here A28 to [0041D100]
Note all 4 addresses.
?
0041D100  00000A28
0041D104  00000501
0041D108  00000005
0041D10C  00000001
Itīs standart / use

Result

MOV DWORD PTR DS:[0041D10C],EDX

MOV DWORD PTR DS:[0041D108],ECX

MOV DWORD PTR DS:[0041D104,ECX

MOV DWORD PTR DS:[0041D100],EAX
Here we break the first time in the codesection but it not looks like the OEP routine right!
Here we see also two times a 
call 02Bxxxxx
NOP
= 6 bytes

Jumpīs into a vm address.This are two RD API callīs
=
FF15 xxxxxxxx // API / 6 bytes
FF25 xxxxxxxx // API / 6 bytes
So we have a lot of this vm API jumpīs and callīs and we haveto fix this of course.
Now let run the UnpackMe to find the OEP routine.
Here we see the first two pushes from the begin of the OEP routine.Just follow.
So this target jumpīs from our normal codesection 00401000 to 00423000 so this is the TM / WL section where some code normal code will execute which is not there in our codesection.
Exsample:
PUSH 55493C6E
JMP 0083A699  
--
0083A699 PUSH 0
From here you can trace a lot till

JMP DWORD PTR DS:[EDI+378]
DS:[00370378]=003707D0
So we start from our codesection and trace into TM / WL section 00423000 and then we land in the 00370000 section and it execute some code.So if we want a running unpacked file then we need to dump and add this section 00370000 to our dump but there can be more sections to add.
Solution is:
-Dump all necessary section
or
-Repair our code
So the repair is a better solution.
Here I can also see some standart code.
00401F6B followed by 
cmp dword [xxxxxxxx],1
two times.

Study compilerīs etc.
Here we see a lot junk code till 00401E6E
and the code above looks fine.So what do you think now?
REP movs...

move a second part of code from a vm section to our codesection.If you want to see moving the first part to codesection then you can set a Memory BP on write on this vm section 029xxxxx first.Just a info.
Now step over this Rep.. and press F9 to break on the place where our GDI32 API will written.
Here we see the instruction pops the API...

0012FED0   77C41EFF  GDI32.SetBkMode
0012FED4   02B10010                               

to [EAX]
Now we just set a Memory BP on write on this esp address

0012FED0=GDI32.SetBkMode

and now you can press F9 then F7/F8
till we see the next GDI32...API on this address.
Here we are,the next in esp and EAX.Letīs scroll up to find what we need.
The first break on our Magic Jump and you see also the first API in EAX.
Set a Mem BP on write on the codesection to see whats happend with our first API.
pop dword :[edx]
=
mov 02B40000 to 004130A0
means
[esp] to [edx]

004130A0 is first API address / copy
mov byte :[edx], ch

Writes a jump / E9 to [edx] / one byte

00407526
Next stop again pop dword:[edx]
This time it writes and add the address
02738AD5 to 00407527

So it add the vm address to our jmp.
So the real one must be so..

JMP DWORD PTR DS:[004130A0]
004130A0=02B40000
to
004130A0=77E68A29
77E68A29=ASCII "NTDLL.RtlUnwind"

So with this you have fixed one API
There was just one VM API to fix.Now comes the next API in EAX.
Here we see a other instruction used to write a nop / 90
JMP / E9
Call / E8

So if the first time is a nop / 90 then the address will add one byte more where the VM API call / jump will written.
NOP
Call / JMP xxxxxxxx
without 90 the result is
Call / JMP xxxxxxxx
NOP

So itīs important to know for the script later or if you want to write a own script.So there can be a lot of instructions used to write this stuff and overwrite,double-check too.
Here the Stos dword writes the VM or direct API address.
I also wrote a script for fixing the IAT and VM APIīs.So I will also include just the (light) version of my script in this tutorial so that you get a fixed IAT / APIīs /FF15 /FF25

The (interactive) script is much bigger and itīs already a new unpacker and fixer but still not public at the moment.So I will give also a Instruction Logger Script so it loggs used instructions for written the IAT and VM stuff so if you see a new instruction you can add it into the (light) script if you have a bit knowledge of scripten.
Now restart the UnpackMe and run my script.Enter OEP and Magic Jump and run till itīs done.
The script loggs also all important infos for you.API,VM address and IAT address.

So if something goes wrong then you can copy the logged  data to a text file and save it.So maybe there is a address not fixed then you can search the address in the log data and you see which API must be there then you can fix this one also by hand.

Hint:Set the startup size of log buffer in olly of 8MB so then you can much more log if you have maybe a very large target to unpack.
So the script is finished and we break again on our sub routine.
Now we have one open olly with our fixed IAT / APIīs UnpackMe and now we open a second Olly also with this UnpackMe and letīs break at the sub routine.
Now we have to find the input and output and log all infos so we need the infoīs to repair our code.
1.We are in codesection
2.Set Mem BP on access on our TM / WL section to break on 
Push xxxxxxxx
JMP xxxxxxxx

Then Memory BP on access on codesection.
etc.
So we switch till we have all infos.
Just follow.
Now we can check the right API from before.
Do you remember?
Of course it was already the second API....
So we alredy break on the sub routine.
Now we have note all infoīs and now load a other target with the same program language and compiler in a other Olly.
So you need a app also used
Microsoft Visual C++ Linker 6.0
You can detect the right version with DIE
(detect it easy)
Now we are at the OEP of this new app HDTune and now watch.
We copy the whole first routine from HDTune to our UnpackMe.So you have seen the routines and bytes and itīs the same just other addresses.Now watch go on.
First to pushes itīs clear right?
Replace.
First API itīs also clear.It was also the first access to our IAT from the beginning before reaching the sub routine.
Now the next four DWORDīs.
Which addresses must we fill in?
Here we have the addresses but we find it already before.Do you remember?
Replace.
Now we can use our log infos.
Here you can also see just standart code.Just copy and paste and replace the API address.
Now we have fixed the whole code with the right addresses and now we are ready to dump and fix.
Now delete all useless sectionīs to reduce the target size and rebuild.
And thatīs it.We have unpacked this UnpackMe.
You can also write a script what can replace the whole routine also with the correct values and addresses so you see there is just standarts used.
So thats enough for the moment and I see this tutorial is now already 48 minutes long and I need a break now.So I hope you will have some fun with it and understand something too.Package list:
-----------------------------------------------------------------------
Unpack WinLicense / TheMida 2.0.1.0

WinLicense_UnPack Me!.exe

TheMida Iat  VM Fixer (light) v.01 
by LCF-AT.txt

Instruction Logger.txt

TheMida_Winlicense_Steps.txt

WinLicense_Unpack Me!_Unpacked.exe
-----------------------------------------------------------------------

LCF-AT
