About the long silence

kao

Hello all!

It's been almost a year since my last post. I guess some explanation is in order. And it's actually very simple.

I got burned out.

I took on too much at once. My daily job. Personal life. This blog. Paid side projects. It was all fun until it wasn't. One night I finished my side project at 3AM, sent the finished code to the guy and went to sleep. Next day I just couldn't wake up and get to work. So, I said to myself, "It's alright, weekend is coming, I'll get some more sleep and everything will be fine again!"

It wasn't.

My brain still refused to work and I could barely function. I stopped answering my emails. Stopped managing the blog. Stopped pretty much everything. Whatever I did, it wasn't fun. And that's how I spent last year or so.

It's slowly getting better. Reversing stuff feels fun again. I might even write a proper blogpost or two in the near future. Who knows..

Now you know it. Take care and try not to end up like me!

Some articles that seemed useful to me:
https://piechowski.io/post/how-to-get-over-burnout/
https://www.mindtools.com/pages/article/recovering-from-burnout.htm
https://kierantie.com/a/burnout

Unity3D protection in โ€œAU2โ€ dance games, part 2

kao

Last December I wrote a blog post explaining how some of the AU2 dance games were protected. Apparently, the protection author read the blog post and updated his protection. ๐Ÿ™‚ This blog post will explain how the protection was changed and suggest several ways of dealing with the new features.

This analysis covers:

Read More →

April update of unpackers

kao

Molebox VS unpacker

This is a quite big update for Molebox VS unpacker. It fixes most of the bugs I'm aware of:

  • Supports Molebox GPL version
  • Removes "anti-hacking" protection
  • Supports BOX files in sub-directories
  • Shows embedded command-line
  • Main executable will be named {yourfile}_unpacked.exe
  • Fix calculation of SizeOfImage in edge cases
  • Fix decryption in edge cases

It's still not perfect and will fail in some situations - but I didn't want to postpone the release any longer. Please let me know if it crashes for you and I'll try to fix the problem. ๐Ÿ™‚
Read More →

March update of unpackers

kao

Enigma VirtualBox unpacker

  • Unpacker will refuse to run if there is not enough space in TMP folder and/or in working directory
  • PE header size was calculated incorrectly in some cases
  • TLS directory was not detected correctly for some files

Setting TMP folder to a RAM drive was a good idea in 1990s. Now it's year 2019 and you can't manage virtual memory better than Windows already do. But some people apparently still try, so I added checks to stop them from shooting themselves in the foot.

Molebox VS unpacker

  • Added support for a very old version on Molebox VS, as reported by death

The fix was actually implemented a long time ago, I just didn't make the announcement.

uBlock silently enables Acceptable Ads for everyone

kao

Few days ago I started seeing ads on ebay. Weird.. ๐Ÿ˜• I blocked the ad manually and forgot about it. The next time I visited ebay, the ad was showing again. I blocked it again. Third time.. Yes, you guessed right, the ad was back. So, I started to investigate why my filter rule was not working.

Few minutes later, the culprit was found:

This rule disables all cosmetic filters for eBay. But where does it come from?

I went to examine my filter lists. And then I went into full WTF mode:

Why the fuck I have "Acceptable Ads" list enabled?
Read More →

Unity3D protection in Moonton games, part 2

kao

I wrote about Moonton game protection in November 2018. It was a pretty boring protection, so I quickly forgot about that. In January 2019 Moonton devs decided to change their protection. I'm not sure if it's a coincidence or not - but here's the update anyway.

This analysis covers:

specifically versions from 1.3.37 upto 1.3.47 (latest at the time of writing). All other games that I mentioned in my previous post haven't been updated, or are still using the old protection mechanism.

Read More →

Unity3D protection in “AU2” dance games

kao

Today's story is about dancing games. Specifically, about

These games employ some tricks in the APK file structure as well as modified libmono.so. I will go through each of the protection mechanisms step-by-step and explain how it works. In the end, you will have all the necessary information to implement your own decryption tool that can decrypt AU2 protected DLL files.

Read More →