TEAM Bobalkkagi

BOB11 project

Unpacking & Unwrapping & Devirtualization(Not yet) of Themida 3.1.3 packed program(Tiger red64)

API Hook

Hooking API based win10_v1903

How to

Install

pip install bobalkkagi

or

pip install git+https://github.com/hackerhoon/bobalkkagi.git

Notes

Need default Dll folder(win10_v1903) or you can give dll folder path

win10_v1903 folder is in https://github.com/hackerhoon/bobalkkagi

Use

NAME
    bobalkkagi

SYNOPSIS
    bobalkkagi PROTECTEDFILE <flags>

POSITIONAL ARGUMENTS
    PROTECTEDFILE
        Type: str

FLAGS
    --mode=MODE
        Type: str
        Default: 'f'
    --verbose=VERBOSE
        Type: str
        Default: 'f'
    --dllPath=DLLPATH
        Type: str
        Default: 'win10_v1903'
    --oep=OEP
        Type: str
        Default: 't'
    --debugger=DEBUGGER
        Type: str
        Default: 'f'

NOTES
    You can also use flags syntax for POSITIONAL ARGUMENTS

Option Description

---

Mode: f[fast], c[hook_code], b[hook_block]

---

Description: Mean emulating mode, we implement necessary api to unpack protected excutables by themida 3.1.3.

Running on fast mode compare rip with only hook API function area size 32(0x20), but hook_block mode and hook_code mode compare rip with all mapped DLL memory (min 0x1000000) to check functions. block mode emulate block size(call, jmp) code mode do it opcode by opcode.

verbose

---

verbose show Loaded DLL on memory, we will update it to turn on/off HOOKING API CALL info.

dllPath

---

dllPath is directory where DLLs to load on memory exists. DLLs are different for each window version. This tool may be not working with your window DLL path(C:\Windows\System32)

oep

---

oep is option to find original entry point. If you turn off this option, you can emulate program after oep**(fast mode can't do it, it works on hook_block and hook_code)**

debugger

---

If you want unpack another protector or different version of themida, you should add necessary hook_api functions(anti debugging, handle, syscall). you can analyze protected program hook_code mode or hook_block mode(more detail in https://github.com/unicorn-engine/unicorn) with debugger ** option(working only hook_code mode!)**