Breaking the world, one application at a time
Enigma Virtual Box authors made some changes in version 10.70 and broke my unpacker again. 🙁 To be able to support more and more versions, my unpacker requires some serious redesign.
That will take some thinking time and energy but I'll eventually get around to it.
In the meantime, here's a quick fix:
To start new year on a positive note, here's a new version of my Enigma Virtual Box unpacker.
Big thank you goes to everyone who reported issues with my tools. I really appreciate it!
Have a great year!
There are few minor fixes:
There are few minor fixes:
Few weeks ago I wrote an article about misunderstood security in Autoplay Media Studio plugins. Two days later, author of DCrypto plugin released an updated version of the plugin. And just recently, he started to sell his plugin by making some pretty bold claims:
I present to you DCrypto with an advanced encryption that allows you to obfuscate your LUA 1.5 code in 256 Bit encryption with one of the best encryptions on the market, in addition to optimizing your source code, it will be protected with super protection.
Let's see how super this protection really is! 🙂
Read More
Every once in a while I encounter a strange anti-reverse engineering protection. Protection authors are so focused on improving one specific aspect of the protection that completely overlook other, much easier ways how the system can be defeated.
Their logic is like this - someone stole my code, I better protect it. I've heard that cryptography is good, so I'll use that. Oh no, someone stole my code again! Let me add another layer of encryption over it! Few days/weeks/months later - Those bloody hackers won't stop! Let me protect my encryption code with another encryption!
Facepalm.
What the authors should do instead is stop and think. What do I want to protect? Against whom? For how long? What kind of loss is acceptable to me?
There are plenty of changes.
MemoryEx is a plugin released by Imagine Programming, allowing for more advanced operations from within the Lua environment you will find in Autoplay Media Studio 8.
While it's not a very common plugin, there are several niche programs which use this plugin. For example, most programs from dindroid.com use it.
When you unpack such file, please pay attention to the "Found protected file" messages:
As you can see, unpacker created some .luac files.
Next, you will need to find a LUA decompiler and decompile these files. I suggest you try unluac, luadec or whichever LUA decompiler you prefer.
Decompiler should produce .lua file which contains all the interesting stuff. For example, part of G-Nerator code looks like this:
return {
info = {
name = "Anderson M Santos",
author = "dindroid.com",
contact = "andersonnsantos36@gmail.com"
},
functions = {
Install = function()
function Stile_Sonbre_P()
sHandl = Application.GetWndHandle()
DLL.CallFunction(_SystemFolder .. "\\User32.dll", "SetClassLongA", sHandl .. ",-26," .. 131072, DLL_RETURN_TYPE_LONG, DLL_CALL_STDCALL)
if Label.GetText("local") == "C:\\" then
Label.SetText("local", _ProgramFilesFolder .. "\\Dindroid")
end
Image.Load("imico", _TempFolder .. "\\icon.tmp")
Image.Load("imc", _TempFolder .. "\\bts_01.tmp")
end
function Install()
Folder.Create(_ProgramFilesFolder .. "\\Dindroid" .. "\\G-Nerator")
File.Copy(_SourceFolder .. "\\Install\\*.*", _ProgramFilesFolder .. "\\Dindroid" .. "\\G-Nerator", true, true, false, true, nil)
sP = System.EnumerateProcesses()
for j, file_path in pairs(sP) do
file = String.SplitPath(file_path)
if file.Filename .. file.Extension == "GNerator.exe" then
File.Copy(file_path, _ProgramFilesFolder .. "\\Dindroid" .. "\\G-Nerator\\")
end
end
Shell.CreateShortcut(String.Replace(_WindowsFolder, "Windows", "") .. "\\Users\\Public\\Desktop", "G-Nerator", _ProgramFilesFolder .. "\\Dindroid" .. "\\G-Nerator\\GN.exe", "", "", _ProgramFilesFolder .. "\\Dindroid\\G-Nerator\\GN.exe", 0, SW_SHOWNORMAL, nil, "")
....
That's all folks, have fun using it!
As always - if you notice any bugs, please report them. And most importantly - Happy New Year everybody! 🙂
Thanks to szx, unpacker can now extract huge (2GB+) embedded files. 🙂
Also, some of the unpacker messages were removed and/or changed. If you're using de-mole-ition with automated scripts, you might want to double-check those.
I'm trying to get back into reversing. Slowly.
So, here's a long-promised update to Molebox unpacker. It fixes unpacking of very, VERY, VERY old Molebox versions. The only file I have ever seen packed with it, is SCWU role playing game.
This was done long time ago but I never posted it publicly. Support for Enigma Virtual Box 9.30/9.40. Should support 9.50 but it's not tested.