Enigma Virtual Box Unpacker / 解包、脱壳工具

Python 88.1%
C 11.9%

Find a file

greats3an 2913980189 Version 0.1.7 misc : Testing CIs		2022-08-29 00:01:14 +08:00
.github/workflows	Version 0.1.7	2022-08-29 00:01:14 +08:00
evbunpack	Version 0.1.7	2022-08-28 23:42:48 +08:00
example/PackerTestApp	misc : added `PackerTestApp`	2022-07-30 11:00:01 +08:00
.gitignore	misc : added Github Actions config	2022-08-28 23:44:14 +08:00
LICENSE	Reinitialized repo	2022-04-17 14:55:02 +08:00
README.md	Version 0.1.7	2022-08-28 23:42:48 +08:00
setup.py	Version 0.1.7	2022-08-28 23:42:48 +08:00

README.md

evbunpack

Enigma Virtual Box unpacker

Features

Unpacks PE / external external packages made with Enigma Vitrual Box

Supports compressed archives and basically every recent version of EVB (tested 6.x & 9.x)

Can also restore the original executable for easier reverse engineering

Installation

pip install evbunpack

Usage

usage: __main__.py [-h] [--ignore-fs] [--ignore-pe IGNORE_PE] [--legacy] [--list] file output

Enigma Virtual Box Unpacker

positional arguments:
  file                  File to be unpacked
  output                Extract destination directory

options:
  -h, --help            show this help message and exit
  --ignore-fs           Don't extract virtual filesystem. Useful if you want the PE only
  --ignore-pe IGNORE_PE
                        Treat PE files like external packages and thereby does not recover the original executable (for usage without pefile)
  --legacy              Enable compatibility mode to work with older (6.x) EVB packages
  --list                Don't extract the files and print the TOC only (surpresses other output)

Examples

python -m evbunpack Lycoris_radiata.mys ../biman5_chs_moe
python -m evbunpack biman2.exe ./extract --legacy

TODO

~~Restore original PEs~~
Registery configuration extraction

Credits

evb-extractor

aplib

License

Apache 2.0 License