38 thoughts on “Updated Enigma Virtual Box unpacker (again)”

  1. Alen -

    Hi master Kao!
    I've used this version of EVB tool:
    EnigmaVBUnpacker v0.61, compiled on 05-03-2023 22:59 Supports Enigma Virtual Box v4.10..10.30
    but the exe it recovered has got wrong EP as well as missed Import table, see below

    some pieces from log:
    ...
    [+] x64 executable
    [+] Embedded files are compressed
    [+] EnigmaVB version: 10.30
    ...
    [!] Warning: cannot fix PE Exception directory. Unpacked file may or may not work. Be careful!

    [+] Finished!

    so the question is - what does it mean the last warning?

    also when I opened up unpacked .exe in exeinfope 0077 it says this:
    File is corrupted ---> Entry Point over the file! ***
    example screen from the tool -
    {hidden link}

    general question - are there any reasons that the tool might not unpack exe(s) from EVB successfully?

    • kao -

      Hi Alen,
      I can't solve your specific issue without seeing the actual file. Please upload it to mega.nz or mediafire.com and send me a link.

      I've tried to make the unpacker work reasonably well on most files. However, there are some corner cases which are either not implemented or not well tested because I didn't have enough sample files to work with. Judging from the screenshot, your file is 64-bit .NET executable and it might be one of those cases.

      • f -

        "Newbee" in Chinese homonym refers to "niubi" which means very awesome
        I don't think he meant any harm, thanks for the file

        • kao -

          Thanks for the explanation! :) You must admit, it looks more like an insult to people who don't speak Chinese.

  3. Bidasci -

    I am trying to unpack an exe that is packed with Enigma Virtual Box but when unpacking I get this:
    EnigmaVBUnpacker v0.61, compiled on 05-03-2023 22:59
    Supports Enigma Virtual Box v4.10..10.30
    Latest version always on {hidden link}

    [+] Filename: Luxify 4 - Copy.exe
    [+] MD5: cef5723e032181cf5db529d07b4b8c29
    [+] x64 executable
    [x] Expected section name ".enigma2", found ".rsrc"
    [x] This file is not protected with Enigma Virtual Box or is hacked.

    Looking at the sections, I see 2 sections with the name .enigma1 and .enigma2
    I uploaded the exe if you want to look at it, which can be viewed here: {hidden link}

    Thank you!

    • kao -

      Hi,
      your file is protected using Enigma Protector and/or Themida. That's not what my unpacker is for.

  4. Liska -

    The tool overestimates the space needed to unpack an enigma file. Extracting a file that needs ~1GB of space, the program requested me to prepare well over 6GB of harddisk space.

    • kao -

      Yes, that's intentional because there is no efficient way to do it properly. I had to choose between reading the entire file twice, running out of disk space during unpacking, or overestimating the free space requirements. I chose to overestimate.

      If you feel adventurous, you can always use the "/nodiskspace" switch to disable the check.

  5. Roberto -

    Hi kao , can you check this out , it is packed and i'm not sure if this pack by enigma ..

    Thanks

    Here is the link : {hidden link}

    • kao -

      That appears to be a custom loader used only by imperio-online.com. In addition to standard Tantra client+anticheat, it very likely contains an additional malware file.

      I'm not going to do anything with it.

  6. Quite Frankly -

    Kao I appreciate your work, I use it regularly to translate anime games and just wanted to say thank you for making it easy to understand content made by people in other languages.

  8. taio -

    Hi I'm using your 0.61 unpacker, and i tried to unpack mz game.

    [i] Loading large file, it might take some time...
    [+] x64 executable
    [x] Expected section name ".enigma2", found ""
    [x] This file is not protected with Enigma Virtual Box or is hacked.

    I can see this notice. That's literally blank. And i can't see www folder or anything else.
    What should i do about this?

    • kao -

      Hi, I can't download your file:

      You need access
      Request access, or switch to an account with access.

      You're signed in as: {my_email_here}

      In general - most often this unpacker message indicates that your file is really not packed by Enigma Virtual Box and there is nothing my unpacker can help you with.

  10. happk -

    Hi,
    I successfully unpacked the RPG-Maker MV game using your program.
    However, when I run Game.exe in the %DEFAULT FOLDER%, the window is blank. On the other hand, running *._unpacked.exe shows no response. _:(´□`」 ∠):_
    Is there any specific process I need to follow to launch the game after unpacking?

    • kao -

      Hi,
      I can't answer your question without seeing the actual game. Could you please upload it to MEGA.nz or MediaFire and post a link?

      • happk -

        I want to change the font, so I need to play it after unpacking. Would appreciate your help.(・A・´)ゞ
        {hidden link}
        (btw, NSFW game ´ω`)

        • kao -

          Could you please rename %DEFAULT FOLDER% to something else and then try running game.exe? Any name without "%" sign should work just fine.

          Cheers, kao.

          • happk -

            It works! Turns out it was just a path issue (╯°O°)╯┻━┻
            Anyway, thanks again for your help!

  11. SomeoneElse -

    I seem to vaguely recall posting here quite awhile back asking about differences in V9 format. I don't quite recall if you answered or not.

    Anyway, I've run into an odd thing - it's game on Steam (2007980).

    The interesting part is that while it's FileSystemV9 packaging, it's offset by 0x20 bytes, that is the header starts at 0x20 bytes later in the .enigma1 section.

    That obviously breaks things a bit...

    • kao -

      Hi,
      sorry, I don't recall that question/answer either.. :)

      But from what I can see, my unpacker has no problems with it:

      Happy New Year!

  12. kaka -

    It doesn’t work anymore. Please update to a new version.

    EnigmaVBUnpacker v0.61, compiled on 05-03-2023 22:59
    Supports Enigma Virtual Box v4.10..10.30
    Latest version always on {hidden link}

    [+] Filename: Y:\BaiduNetdiskDownload\Last Stand Delivery\gamer520.com.exe
    [i] Loading large file, it might take some time...
    [+] x64 executable
    [x] Expected section name ".enigma2", found ""
    [x] This file is not protected with Enigma Virtual Box or is hacked.

  13. kaka -

    L ] evb14CA.tmp
    0字节
    TMP文件
    2024/1/4 17:27
    De
    evb15C5.tmp
    1.50 KB
    TMP文件
    2024/1/4 17:27
    [ ] evb1681.tmp
    1.50 KB
    TMP文件
    2024/1/4 17:27
    C ] evb16B2.tmp
    1.50 KB
    TMP文件
    2024/1/4 17:27
    evb16BE.tmp
    0字节
    TMP文件
    2024/1/4 17:27
    evb1B09.tmp
    1.50 KB
    TMP文件
    2024/1/4 17:27
    evb273F.tmp
    1.50 KB
    TMP文件
    2024/1/4 17:27

  14. xiexiaosheng -

    EnigmaVBUnpacker v0.61, compiled on 05-03-2023 22:59
    Supports Enigma Virtual Box v4.10..10.30
    This is the download link {hidden link}

    [+] Filename: G:\1\gamer520.exe
    [i] Loading large file, it might take some time...
    [+] x64 executable
    [x] Expected section name ".enigma2", found ""
    [x] This file is not protected with Enigma Virtual Box or is hacked.

    • kao -

      Hi, your file is protected with Enigma Protector v6.80. It is a totally different protection and my unpacker does not support it.

  15. jams lin -

    Thank you for the programme, it's very useful, but unfortunately the latest version of EVB is no longer available for unpacking... I hope very much that it will continue to be updated, thank you very much.

  16. anon -

    tried unpacking this {hidden link} but getting an error
    [+] x86 executable
    [x] Didn't find "EVB" signature.
    [x] This file is not protected with Enigma Virtual Box or is hacked.

    it have .enigma2 section

    • kao -

      Hi, it's protected with the latest Enigma Virtual Box v10.60. Unfortunately my unpacker does not support it yet but I'll be releasing a new version soon.

Comments are closed.