The Xenocode Solution v2.0

[LibX]

The Xenocode Solution is a unpacker that works for all Xenocode products since
the release of Xenocode 2005.

First of all its *ONLY* a unpacker and not a deobfuscation tool.

It can also unpack the Virutal Machine and x86 compilation options that came with
Xenocode PostBuild 2006.


Unpacker features:
---------------------------

Unpack Xenocode 2005 output compression

Unpack Xenocode PostBuild 2006 output compression

Unpack Xenocode PostBuild 2006 Virtual Machine

Unpack Xenocode PostBuild 2006 x86 Compilation

Unpack Xenocode PostBuild <= v5.1.x 2007 output compression

Unpack Xenocode PostBuild <= v5.1.x 2007 Virtual Machine

Unpack Xenocode PostBuild <= v5.1.x 2007 x86 Compilation

Unpack Xenocode PostBuild >= v5.2.x 2007 Virtual Machine

Unpack Xenocode PostBuild >= v5.2.x 2007 x86 Compilation

Unpack Xenocode Virtual Appliance Studio <= v5.1.x packages

Unpack Xenocode Virtual Appliance Studio >= v5.2.x packages


http://www.reteam.org/tools/ts32.gif

http://www.reteam.org/tools/tf32.zip

Regards,
LibX // RETeam

[foffa]

thanks admin
you say also unpack the Virutal Machine
what about vmprotect ??!!
is there is unpacker ?!

[LibX]

No sorry, this only unpacks virtual machine packages, a lot of files in on a virtual memory based filesystem.
Its not possible to unpack vmprotect since its realy converting ur code to a custom CPU virtual machine code.

Regards
LibX // RETeam

[foffa]

is this mean that we can't unpack vmprotect
aday in the future ??

[UFO-Pu55y]

Here's an additional string decoder for xenocode:
_http://www.filesend.net/download.php?f=9e82662ac802271e76c24922f4eddb9e

Greets

[UFO-Pu55y]

xenoDEcoder v0.2:
http://www.filesend.net/download.php?f=0b8b6dd6da483cd66c0eb9619e7d51e6
or
http://www.tuts4you.com/forum/act=attach&type=post&id=1832

- 0.2
Included M$ toys (ILdasm/ILasm):
Now fully reads/decodes .ILs and .EXEs
and assembles them back to executables...Over and out...

PS: Big thx, LibX... for always pushing the right infos ;)

[longdring]

Hi!

It seems The Xenocode Solution 2.0 don't work work for newest versions.
Getting the following output:


*Starting
*Reading file
*Searching for Xenocode section
*Detected Xenocode Virtual Applicance Studio >=5.2
*Or PostBuild 2007 >=5.2.x

*Error while procession file :(
*This file can not be unpacked :(

PM if you need a example application.

Would be very nice if you could fix this!!!

regards,
long

[longdring]

push!!
Any progress?

[codeX]

Hi LibX,

Facing the same issue as longdring mentioned. Not working on the new version.


*Starting
*Reading file
*Searching for Xenocode section
*Detected Xenocode Virtual Applicance Studio >=5.2
*Or PostBuild 2007 >=5.2.x

*Error while procession file
*This file can not be unpacked

I'm also happy to give the Target app. Please post if i can PM me the url.

Thank you

[longdring]

Anybody knows what happended to Libx?

[UFO-Pu55y]

What's the prob with manually dumping it ?
There are tuts..

[longdring]

Please provide some links!

Thx!

[UFO-Pu55y]

Tuts not directly about xenocode I mean, but reading some others will do the job:
http://forums.accessroot.com/showtopic=6461

[bb32]

Tuts not directly about xenocode I mean, but reading some others will do the job:
http://forums.accessroot.com/showtopic=6461

The tool talked about in that thread do not work with my target (NETDeProtector), it doesnt dump anything. Do anybody know about a document that describes how to unpack Xenocode manually?

[besoeso]

@Libx

Hi Libx, i have found a error in Xenocode Solution v2.0 tool with my target. Not working.

(unpack)

295

@UFO-Pu55y

I have tested your xenoDecode and find error too.

(decode strings)

297