Jump to content
Sign in to follow this  

Unpacking Virtual Machine

Recommended Posts


Hi i wanted some help or advice since i still dont fully understand how to unpack the files with this virtual machine i have gotten the main exe but guess what... It cant run cause it needs some dependencies on the virtual machine that i cant locate or register =S


So here is what i got:


1) i know the packer wraps all the dependencies dll ocx etc

2) it uses Aplib to decompress the files

3) decompresed it upload them on memory

4) It has a stub maybe a crypter / decrypter 


Im close to keygening this thing but i cant keygen without debugger (noob). The problem why i cant debug it is that the main exe is run from one of the threads and then the thread exits with code 0.


Also the unpacked exe got a lot of dependencies with some fancy dlls so im unable to debug it =( . 


Im facing to often this kinda protection of the virtual machines and i think that im not approaching the problem in the right angle.



Also i want to make a cool avatar for my forum profile =)


GifConverter.exe (vb5 - vb6)  <-------- here is the check for registered 

ActiveFFmpegControls.ocx     <-------- Some dll that wont work or its not correcly unpacked


Here is the setup link to target:




This is the unpacked exe and also the the ocx (1 of xxxx)





I also didnt know you can use word ptr[xxxxh ] on vb thats sure is new to me.








Any help is much appreciated =)

Edited by piranime

Share this post

Link to post
Share on other sites

I got it =)


ill make a tutorial of keygening with piranime cap 2 =) as soon as i finish keygening this.


Also if someone has a more elegant solution ill love to see it (wait for the tut .... ).

Share this post

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  


Important Information