x64 Themida/Winlicense Unpacking
 

Hello friends,

I successfully unpacked a x64 game binary protected by Winlicense. However there is one problem. If I restart my system or send the file to another, it stops working (crashes on the same address).

It has been some time since I have work with Themida... could some one kindly nudge me in the right direction?

Edit: I forgot to mention, I am doing this under Windows 10 x64 10.0.18363.535 with x64dbg

Ever so grateful,

-Fyyre

if I remember correct in unpacked VMP was such a problem with CPUID related, if I m correct about that.

Well he says it also happens after a reboot...
But similarly, it's probably Imports are not properly reconstructed. Meaning the address of imported APIs is hardcoded to a specific address in your dump and not in the IAT. This address changes with each reboot thanks to ASLR.


To verify if this is your problem you can turn off ASLR, unpack your file again, and see if it works after a reboot then. Backtracing from the crashsite is probably hard because you dont know what the addresses pointed to back when you first unpacked it.

Themida and vmp applies artifact based detection. consider searching for themida antidump documents about the details

Hi deepzero,

I agree ASLR is the only reasonable answer here. The IAT is fine, it is not loading at a different address... the trouble I am seeing is arrising from the combined code+data section of Theminda/WL. In this situation, our crash location is like..

or something like this. I will focus on ASLR, as the exe as /TSAWARE set, which controls ASLR, afaik.

This has nothing to do with my situation.

I can help with that. Perhaps we are trying the same file both. https://prnt.sc/qczcbs

keep an eye on rbp(v2) and rdi(v3) before it goes into themida section.
themida try to use static constant which called align number by someone to loacate its data.

Your screenshot shows far too little information to be useful.

Nor am I interested in anything from you or your son of a bitch friend.

P.S.

And if you are inside of NCSoft? Congratulations, and do not attempt to contact me again.