13 thoughts on “Updated Enigma Virtual Box unpacker (again)”

1. Alen - 2023-03-14 at 08:14

   Hi master Kao!
   I've used this version of EVB tool:
   EnigmaVBUnpacker v0.61, compiled on 05-03-2023 22:59 Supports Enigma Virtual Box v4.10..10.30
   but the exe it recovered has got wrong EP as well as missed Import table, see below

   some pieces from log:
   ...
   [+] x64 executable
   [+] Embedded files are compressed
   [+] EnigmaVB version: 10.30
   ...
   [!] Warning: cannot fix PE Exception directory. Unpacked file may or may not work. Be careful!

   [+] Finished!

   so the question is - what does it mean the last warning?

   also when I opened up unpacked .exe in exeinfope 0077 it says this:
   File is corrupted ---> Entry Point over the file! ***
   example screen from the tool -
   {hidden link}

   general question - are there any reasons that the tool might not unpack exe(s) from EVB successfully?

   Reply
   • kao - 2023-03-14 at 08:58

     Hi Alen,
     I can't solve your specific issue without seeing the actual file. Please upload it to mega.nz or mediafire.com and send me a link.

     I've tried to make the unpacker work reasonably well on most files. However, there are some corner cases which are either not implemented or not well tested because I didn't have enough sample files to work with. Judging from the screenshot, your file is 64-bit .NET executable and it might be one of those cases.

     Reply
2. 52pojie - 2023-03-17 at 11:18

   newbee!

   Reply
   • kao - 2023-03-17 at 11:47

     And what exactly have you accomplished? :)

     Reply
     • f - 2023-06-04 at 12:07

       "Newbee" in Chinese homonym refers to "niubi" which means very awesome
       I don't think he meant any harm, thanks for the file

       Reply
       • kao - 2023-06-04 at 13:39

         Thanks for the explanation! :) You must admit, it looks more like an insult to people who don't speak Chinese.

         Reply
3. Bidasci - 2023-04-17 at 21:43

   I am trying to unpack an exe that is packed with Enigma Virtual Box but when unpacking I get this:
   EnigmaVBUnpacker v0.61, compiled on 05-03-2023 22:59
   Supports Enigma Virtual Box v4.10..10.30
   Latest version always on {hidden link}

   [+] Filename: Luxify 4 - Copy.exe
   [+] MD5: cef5723e032181cf5db529d07b4b8c29
   [+] x64 executable
   [x] Expected section name ".enigma2", found ".rsrc"
   [x] This file is not protected with Enigma Virtual Box or is hacked.

   Looking at the sections, I see 2 sections with the name .enigma1 and .enigma2
   I uploaded the exe if you want to look at it, which can be viewed here: {hidden link}

   Thank you!

   Reply
   • kao - 2023-04-17 at 23:54

     Hi,
     your file is protected using Enigma Protector and/or Themida. That's not what my unpacker is for.

     Reply
4. Liska - 2023-06-22 at 20:44

   The tool overestimates the space needed to unpack an enigma file. Extracting a file that needs ~1GB of space, the program requested me to prepare well over 6GB of harddisk space.

   Reply
   • kao - 2023-06-22 at 21:41

     Yes, that's intentional because there is no efficient way to do it properly. I had to choose between reading the entire file twice, running out of disk space during unpacking, or overestimating the free space requirements. I chose to overestimate.

     If you feel adventurous, you can always use the "/nodiskspace" switch to disable the check.

     Reply
5. Roberto - 2023-08-15 at 06:42

   Hi kao , can you check this out , it is packed and i'm not sure if this pack by enigma ..

   Thanks

   Here is the link : {hidden link}

   Reply
   • kao - 2023-08-15 at 22:37

     That appears to be a custom loader used only by imperio-online.com. In addition to standard Tantra client+anticheat, it very likely contains an additional malware file.

     I'm not going to do anything with it.

     Reply
     • Roberto - 2023-08-16 at 16:04

       Okay I understand

       Reply