unlicense icon indicating copy to clipboard operation
unlicense copied to clipboard

Unable to find OEP of .NET WPF programs for a long time

Open x1362 opened this issue 2 years ago • 1 comments

The program I need to unpack is a .NET WPF program, and it protects winlicense2.0-2.4.6 and uses Babel's confusion, but unlicense can't find the OEP of this program for a long time, even if the timeout is set. Log: PS C:\Users[Protected]\Desktop> .\unlicense_x32.exe "C:\Program Files (x86)\Netease\MCLauncher\WPFLauncher.exe" INFO - Detected packer version: 2.x frida-agent: Setting up OEP tracing for "WPFLauncher.exe" frida-agent: Exception handler registered ERROR - Original entry point wasn't reached before timeout WPFLauncher.zip

x1362 avatar Sep 13 '22 12:09 x1362

For the older versions of Themida/Winlicense just run and dump the exe through Extreme Dumper or any memory dumper.

redxhawk avatar Sep 22 '22 00:09 redxhawk

Hi! I cannot reproduce the issue. The OEP is properly found with v0.3.0 on my side.

ergrelet avatar Oct 11 '22 21:10 ergrelet