Last few months have been... extra busy. I survived HDD crash, participated in Flare-On reversing contest (and finished 4th!), had quite fun projects at work - but all that is a matter of another story. Today I want to share with you a long-overdue update for unpackers.
Enigma Virtual Box unpacker
- Added support for Enigma Virtual Box v8.10, v8.20, v9.00 and v9.10.
- Unpacker now restores file attributes and date/time. Be careful, unpacked files might have attributes "read only", "hidden", etc.!
- Added validation of extracted folder/file names to prevent directory traversal attacks. It was on my todo list for a long time and all the media-craziness around Zip Slip finally forced me to do something about it.
- Fixed warning message about TLS directory. Mea culpa.
Molebox Virtualization Studio unpacker
- Fixed error "VFSDecrypt: failed to find STELPACK signature" on some data files;
- Fixed error "SPack catalog not found or invalid. vfsrootsize=00000000" on some EXE files;
- Fixed out-of-memory error when unpacking huge data files;
- Loads possible filenames from mole_dictionary.txt;
How to use mole_dictionary.txt
If you have a file which uses "hide files" feature of Molebox VS, it only stores hash of the filename - original filenames are not stored anywhere. But if you have a good idea what the filename might be, you can add it to mole_dictionary.txt and my unpacker will use that for intelligent guessing.
You must enter path relative to where the main executable is, for example: data\magic.dat. DO NOT enter full paths like C:\Program Files\My Program\data\magic.dat, they will not work.
You can also add comments for your convenience - any line starting with "//" is treated as a comment and ignored.
If your paths contain non-English characters, make sure you save mole_dictionary.txt in UTF-8 encoding with BOM.
Real-life example of mole_dictionary.txt
There are lots of different "editions" of Tantra Online game. They all need specific files like HTSound.dll, HTWeb.dll or system\MobInfo.tan to run properly. However, this specific version called Tantra Surya has packed all files inside HTLauncher.exe and .sps files
and enabled "hide files" feature:
My unpacker does the job but original filenames are lost:
To improve unpacking results, you can add list of files normally used by Tantra into mole_dictionary.txt. Let's start with something simple, files that normally are in Tantra root folder:
// from Tantra Atlas Online Oficial
After that, unpacker works much better. It has recovered most of the DLL names and just 5 filenames are unknown:
Of course, the more possibilities you add, the better are chances that the filename will be recovered. smile So, let's look into some subfolders..
Take, for example, this map folder:
Compare it to the same map folder in some different Tantra edition, in my case - Prime:
Now we know what filenames to add to mole_dictionary.txt:
Run the unpacker again on the packed HTLauncher.exe and the result is much better:
You can keep on building your dictionary until all the unknown filenames are resolved. But that's your task, I will not do that for you.. smile
Have fun and as always - please let me know if you notice any issues!