I'm happy to present you a static unpacker for Enigma Virtual Box, versions 4.10-7.10 (latest at the moment). It can extract both virtualized files and registry keys. It will also "unpack" main executable.
EnigmaVBUnpacker takes very conservative approach. If something doesn't look right, it will stop with an error message. Your file is probably modified to prevent unpacking and there isn't much I can do about it.
Known issues that I am planning to look at:
Cannot detect EnigmaVB version for some files. Extraction will still work.
x64 (PE32+) files are not supported;
Known issues I am NOT planning to fix:
External packages are not supported;
Files larger than 2GB are not supported;
Really old versions of Enigma Virtual Box are not supported;
Alternative tools and their problems:
https://github.com/EVBExtractor - supports only Enigma VB v6.60+, fails on compressed files larger than 64kb, doesn't support registry, doesn't fix main EXE, doesn't support virtual drives, requires Python. https://forum.tuts4you.com/topic ... pendancy-extractor/ - dynamic unpacker, doesn't fix main EXE, doesn't support registry. http://nexenteam.net/index.php?o ... d=12&Itemid=125 - Enigma Virtual Box Dumper by Predator. Doesn't dump embedded files or registry. Some of the unpacked files were invalid in my tests. Requires .NET 4.0.
Version history:
v0.11
Fixes issue with unpacked .NET files showing "not a valid Win32 application" (reported by Extreme Coders);
Fixes issue with overlay missing from unpacked main EXE (reported by Extreme Coders). Unpacked program may or may not work as expected, depends on what data are in overlay and how program accesses them.
v0.1
initial version.
Reporting bugs:
If you found a bug and want me to fix it, the only way is to make a proper bug report in this thread. Please follow these simple steps:
Make sure you are using the latest version of EnigmaVBUnpacker. It's possible that the bug is already fixed.
Make sure this is not a known limitation mentioned above.
OK, you really found a bug. Please make a post in this thread, and:
describe what is wrong. Is some extracted file broken? Is some file missing? Does EnigmaVBUnpacker crash?
provide full and complete output from EnigmaVBUnpacker. Copy the text and use [code=auto:0] tags, DO NOT post screenshots.
provide link to your executable. Please upload it via multiupload.nl, DO NOT post it attachment (see board rules).
I will look at your bug report as soon as I have time. Please do not send me PMs or emails, and do not bump your posts up. :)
EDIT: added link to Enigma Virtual Box Dumper by Predator, thanks xSonoro!
EDIT2: Attached v0.11, fixes bugs reported by Extreme Coders. Thank you!
发表于 2014-5-23 14:09
|
发表于 2014-5-23 14:11
