mirrors/evbunpack
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
Enigma Virtual Box Unpacker / 解包、脱壳工具
49 commits 1 branch 19 tags 3.3 MiB
  • Python 88.1%
  • C 11.9%
Find a file
Exact
mos9527 378c9eb217 Version 0.2.0 
Added support for the latest Enigma Virtual Box (10.70 Build 20240522)
Added various error checks and handling
Major code refactoring and cleanup
CI : Added tests for the unpacker
CI : Implemented TLS, FS, Overlay checks in the packer test app
...Also, thanks, GitHub Actions.
2024-06-07 13:11:49 +08:00
.github/workflows Version 0.2.0 2024-06-07 13:11:49 +08:00
evbunpack Version 0.2.0 2024-06-07 09:17:34 +08:00
example/PackerTestApp Support for EVB 10.70 and major refactor 2024-06-07 00:13:22 +08:00
tests Support for EVB 10.70 and major refactor 2024-06-07 00:13:22 +08:00
.gitignore Support for EVB 10.70 and major refactor 2024-06-07 00:13:22 +08:00
LICENSE Reinitialized repo 2022-04-17 14:55:02 +08:00
README.md Version 0.2.0 2024-06-07 09:17:34 +08:00
setup.py Version 0.1.9 2022-09-04 23:05:19 +08:00
test_unpack_pe.py Version 0.2.0 2024-06-07 09:17:34 +08:00

README.md

evbunpack

Enigma Virtual Box unpacker

Features

  • Executable unpacking
    • TLS, Exceptions, Import Tables and Relocs are recovered
    • Executables with Overlays can be restored as well
    • Enigma loader DLLs and extra data added by the packer is stripped
  • Virtual Box Files unpacking
    • Supports both built-in files and external packages
    • Supports compressed mode

Tested Versions

Packer Version Notes Unpack with Flags
10.70 Automatically tested in CI for x86/x64 binaries. None
9.60 Limited testing. --legacy-pe
7.80 Automatically tested in CI for x86/x64 binaries --legacy-fs --legacy-pe

Installation

For Windows Users : Builds are available here

Or get the latest version from PyPi:

    pip install evbunpack

Usage

usage: evbunpack [-h] [--log-level {DEBUG,INFO,WARNING,ERROR,CRITICAL}] [-l] [--ignore-fs] [--ignore-pe] [--legacy-fs] [--legacy-pe]  [--out-dir OUT_DIR] [--out-pe OUT_PE] file

Enigma Virtual Box Unpacker

options:
  -h, --help            show this help message and exit
  --log-level {DEBUG,INFO,WARNING,ERROR,CRITICAL}
                        Set log level

Flags:
  -l, --list            Don't extract the files and print the table of content to stderr only
  --ignore-fs           Don't extract virtual filesystem
  --ignore-pe           Don't restore the executable
  --legacy-fs           Use legacy mode for filesystem extraction
  --legacy-pe           Use legacy mode for PE restoration

Output:
  --out-dir OUT_DIR     Output folder
  --out-pe OUT_PE       (If the executable is to be recovered) Where the unpacked EXE is saved. Leave as-is to save it in the output folder.   

Input:
  file                  File to be unpacked

Credits

License

Apache 2.0 License