36 thoughts on “December update of unpackers”

    1. kao

      I can't help you without seeing the packed file first. Please upload it to mega.co.nz or mediafire.com and I'll take a look after the holidays.

      Reply
        1. kao

          My unpacker works fine and correctly removes Enigma Virtual Box. If you can't unpack next layers of protection (Agile.NET and something else), it's not a problem of my unpacker.

          Reply
          1. Frhd

            yes but i need help for next layers
            ProtectedBy("KITRO 1.0.8")
            how can i do remove this?
            tnx

  2. Rubén Martínez

    Hello;

    When I try to unpack a recent RPGMakerVM game like {hidden link} , this happens:

    EnigmaVBUnpacker v0.55, compiled on 18-12-2018 18:00
    Supports Enigma Virtual Box v4.10..9.20
    Latest version always on {hidden link}

    [+] Filename: C:\Users\*****\AppData\Roaming\itch\apps\tams-senpai-student-affairs\Student Affairs\Student Affairs.exe
    [i] Loading large file, it might take some time...
    [+] x86 executable
    [x] Expected file size = 183D5A00, real file size = 17770000. Damaged file?

    The file works properly, and when you force it to expand the packed file, it expands many to 0 size files. New Enigma variant or o

    Reply
    2. kao

      I just tried the file you posted and it works without any issues:

      EnigmaVBUnpacker v0.55, compiled on 18-12-2018 18:00
Supports Enigma Virtual Box v4.10..9.20
Latest version always on https://lifeinhex.com

[+] Filename: F:\Student Affairs\Student Affairs.exe
[i] Loading large file, it might take some time...
[+] x86 executable
[+] Embedded files are not compressed
[+] EnigmaVB version: 9.20
[+] File "F:\Student Affairs\%DEFAULT FOLDER%\credits.html", size=0x1EC4B4
[+] File "F:\Student Affairs\%DEFAULT FOLDER%\d3dcompiler_47.dll", size=0x37DD38
[+] File "F:\Student Affairs\%DEFAULT FOLDER%\ffmpeg.dll", size=0x1F6800
...
[+] File "F:\Student Affairs\%DEFAULT FOLDER%\www\package.json", size=0xEB
[+] Unpacked main file: F:\Student Affairs\Student Affairs_unpacked.exe
[+] Finished!

      When I downloaded the ZIP file from your link, ZIP has size=295'404'533 bytes and MD5 checksum=450872da3c83d08a70f6aa027654381e.
      After unpacking ZIP, file Student Affairs.exe has size 406'673'920 bytes and MD5 checksum=31e5190189a759bb887686c5a242c6d6.

      Could you please double-check your download and try again. 🙂

      Reply
  3. Ramon Ahman

    Can you spell correctly? What unpackers? Just one.

    Anyway, you are a true lame reverser if you call Virtual Box unpacker.

    Try it with WinLicense, Themida or VMProtect if you are so advanced, otherwise you're just a chinese prick with zero skills.

    Your knowledge is zero in unpacking and virtualization.

    Reply
    1. kao

      Thank you for stopping by and letting know your valuable opinion.

      This is my blog and I write about things what interest me personally. I have zero interest in making unpackers for Themida or VMProtect.

      Reply
    1. kao

      Can you give a me a good reason to make a special console version?

      There is a command-line support and a possibility to redirect output to a log file via (poorly documented) /nogui switch. It should be enough for most automation purposes.

      Reply
  5. Alex

    Good day to you, Kao.
    With this specific game, I've got the following error message: "[!] Warning: cannot fix PE Exception directory. Unpacked file may or may not work. Be careful!"
    And unfortunately, it does not work. I'm not sure it depends by the unpacker, but I want to let you know about it.

    The game: {hidden link}

    Beware: the game is an "adult game".

    Reply
    1. kao

      Your game unpacks just fine. For obvious reasons, I replaced name of the game with "xyz"..

      1) Run the unpacker. It will create file xyz_unpacked.exe and folder %DEFAULT FOLDER%.
      2) Copy file xyz_unpacked.exe to folder %DEFAULT FOLDER%.
      3) Copy the entire folder www from the RAR file to folder %DEFAULT FOLDER%.
      4) Run xyz_unpacked.exe from the %DEFAULT FOLDER%. It launches just fine:

      If it still doesn't work for you, please write a detailed description what you did and what exactly didn't work. Screenshots would be appreciated as well. 🙂 My email is at the bottom of the page.

      Reply
      1. Alex

        Thank you, Mr. Kao. You're right, I forgotten to try to put the "www" folder in the extracted one. Now it works, sorry for the waste of time and thanks for your patience. 🙂

        Reply
  6. Reader

    Hello, would you upload this file to mediafire.com or box?
    MEGA is not available from here so I can't download it.

    I got "EnigmaVBUnpacker_v0.35.zip" from mediafire.com (someone uploaded) but
    I'd like to use latest official version whenever possible.

    Reply
      1. Reader

        Thanks for uploading to mediafire. I've just downloaded it.

        So... I'm trying to unpack 1.34 GB exe file ("[RPG] [Lizard] Distorted Ver.1.00" from anime-sharing.com) and it failed like this:

        EnigmaVBUnpacker v0.55, compiled on 18-12-2018 18:00
        Supports Enigma Virtual Box v4.10..9.20
        Latest version always on {hidden link}

        [+] Filename: Z:\Work\VirusTestAgent\Tasks\[RPG] [Lizard] Distorted Ver.1.00\Distorted.exe
        [i] Loading large file, it might take some time...
        [+] x86 executable
        [x] Expected file size = 55FED000, real file size = 1F370000. Damaged file?

        My TMP and TEMP is RAMdisk(768MB), and it filled up by EnigmaVBUnpacker.
        Would you add an option to "change your working directory(TMP/TEMP) to other than system TMP/TEMP"?

        e.g.,
        EnigmaEXE: Z:\Work\VirusTestAgent\Tasks\[RPG] [Lizard] Distorted Ver.1.00\EnigmaVBUnpacker.exe
        target: Z:\Work\VirusTestAgent\Tasks\[RPG] [Lizard] Distorted Ver.1.00\Distorted.exe
        EnigmaTMP: Z:\Work\VirusTestAgent\Tasks\[RPG] [Lizard] Distorted Ver.1.00\EnigmaVBUnpacker_tmp\

        then, create 'EnigmaVBUnpacker_tmp' folder to 'EnigmaVBUnpacker.exe' folder path.

        Reply
      2. Reader

        I've also tried changing TMP/TEMP via cmd on-the-fly:

        Make a folder 'aaaa'.
        Open cmd and type

        Z:>set TEMP="Z:\......\[RPG] [Lizard] Distorted Ver.1.00\aaaa"
        Z:>set TMP="Z:\......\[RPG] [Lizard] Distorted Ver.1.00\aaaa"
        Z:>"Z:\......\[RPG] [Lizard] Distorted Ver.1.00\EnigmaVBUnpacker.exe"
        Z:>_

        EnigmaVBUnpacker was launched, and when I select a exe file and click unpack, "Enigma crashed silently".

        Reply
        1. kao

          1) If you don't have enough space in TMP folder, the unpacker will not work. Right now I can't think of a simple workaround that could be easily implemented. But I will add a warning, so that unpacker doesn't crash.

          2) Don't use quotes when setting environment variables, Windows don't like those. Simple

          set TMP=Z:\......\[RPG] [Lizard] Distorted Ver.1.00\aaaa

          will do nicely.

          Reply
          1. Anonymous

            > Don't use quotes when setting environment variables, Windows don't like those

            I've changed the folder name to "Distorted" (without space) and removed " when setting TMP/TEMP.
            It worked. Thanks for the tip.

    1. kao

      Your file is using a very old Molebox version that I have never seen before. During weekend I will update my unpacker to support it.

      Your unpacked files: {hidden link}
      Can you please test them and see if they are unpacked properly?

      Reply
      1. death

        It works very well. Looking forward to your new tool.
        But I want you to delete the link you sent.
        and this exe file，it look protected with Molebox2.x.Can you unpack ？
        {hidden link}
        Anyway, thank you very much！

        Reply
        1. kao

          This file was packed with Molebox and then with Safengine NetLicensor. So, first you need to remove Safengine - and then my unpacker should work just fine.

          Reply
          1. death

            I see. Thank you for your answer.
            Looking forward to your new unpacker tool！

    1. kao

      Not really. In my experience, DNGuard is used mostly on Chinese software and XBOX-related stuff. I don't care about either of those.. 🙂

      Reply
      1. Sneaks

        The program protected is not either one of those. It is a UK/US based program. Would really appreciate it for your help, if not could you point me in a direction of someone who may assist?

        Reply
        1. kao

          I really don't want to look at that program.

          There are unpackers for older versions of DNGuard by CodeCracker and HF-Death. You can find them on most reversing/hacking forums, including Tuts4you, Hackforums, Nulled.io and what not. It might need some fixing to support the latest version of DNGuard but that would be a good starting point.

          Also, in those forum threads you might find someone who wants to look at your file.

          Reply
  9. death

    hi,kao.
    When will your tools be updated?
    I'm looking forward to your new tools supporting old Molebox version .

    Reply
    1. kao

      Hi,
      it is updated and should support Enigma Virtual Box v9.90.

      If you have a file that can't be unpacked by my unpacker, please upload it to MEGA.NZ or mediafire.com and post the link.

      Reply

Leave a Reply

  • Be nice to me and everyone else.
  • If you are reporting a problem in my tool, please upload the file which causes the problem.
    I can`t help you without seeing the file.
  • Links in comments are visible only to me. Other visitors cannot see them.

 +  2  =  seven