evbunpack
Enigma Virtual Box unpacker
Features
- Executable unpacking
- TLS, Exceptions, Import Tables and Relocs are recovered
- Executables with Overlays can be restored as well
- Enigma loader DLLs and extra data added by the packer is stripped
- Virtual Box Files unpacking
- Supports both built-in files and external packages
- Supports compressed mode
Tested Versions
- This applies to PE unpacking. If the chosen PE unpack variant does not work, please try out the other ones with
-pe [variant]
| Packer Version | Notes | Unpack with Flags |
|---|---|---|
| 11.00 | Automatically tested in CI for x86/x64 binaries. | -pe 10_70 |
| 10.70 | Automatically tested in CI for x86/x64 binaries. | -pe 10_70 |
| 9.70 | Automatically tested in CI for x86/x64 binaries. | -pe 9_70 |
| 7.80 | Automatically tested in CI for x86/x64 binaries | -pe 7_80 --legacy-fs |
Installation
For Windows Users : Builds are available here
Or get the latest version from PyPi:
pip install evbunpack
Usage
usage: evbunpack [-h] [--log-level {DEBUG,INFO,WARNING,ERROR,CRITICAL}] [-l] [--ignore-fs] [--ignore-pe] [--legacy-fs] [-pe {10_70,9_70,7_80}] [--out-pe OUT_PE] file output
Enigma Virtual Box Unpacker
options:
-h, --help show this help message and exit
--log-level {DEBUG,INFO,WARNING,ERROR,CRITICAL}
Set log level
Flags:
-l, --list Don't extract the files and print the table of content to stderr only
--ignore-fs Don't extract virtual filesystem
--ignore-pe Don't restore the executable
--legacy-fs Use legacy mode for filesystem extraction
-pe {10_70,9_70,7_80}, --pe-variant {10_70,9_70,7_80}
Unpacker variant to use when unpacking EXEs. default=9_70
Overrides:
--out-pe OUT_PE (If the executable is to be recovered) Where the unpacked EXE is saved. Leave as-is to save it in the output folder.
Input:
file File to be unpacked
output Output folder
Example Usage (test file available here)
Input:
evbunpack x64_PackerTestApp_packed_20240522.exe output
Output:
INFO: Enigma Virtual Box Unpacker v0.2.1
INFO: Extracting virtual filesystem
Filesystem:
└─── output
└─── output/README.txt
Writing File [size=0x11, offset=0x3465]: total= 11h read= 0h
INFO: Extraction complete
INFO: Restoring executable
INFO: Using default executable save path: output\x64_PackerTestApp_packed_20240522.exe
Saving PE: total= 3211h read= 0h
INFO: Unpacked PE saved: output\x64_PackerTestApp_packed_20240522.exe
TODO
- Automatically detect packer version
Credits
License
Apache 2.0 License
1 maintainer
Metadata
1 maintainer
Release files for evbunpack 0.2.6
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| evbunpack-0.2.6.tar.gz | 14.5 kB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| evbunpack-0.2.6-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 28.8 kB
Release files / evbunpack-0.2.6.tar.gz
| Download URL | evbunpack-0.2.6.tar.gz |
|---|---|
| Size | 14.5 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
fb02b84050799eae78dfdfd3f371e84effb36505c043c8dccfe52bf58031bbec
|
|
BLAKE2b-256 checksum How to use checksums |
929c358fdb14942b6c581982e23759ad48651d880c97507fb787056ac5515d79
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/6.2.0 CPython/3.10.11
|
Release files / evbunpack-0.2.6-py3-none-any.whl
| Download URL | evbunpack-0.2.6-py3-none-any.whl |
|---|---|
| Size | 14.3 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
d68cd017d10960ff41e7ee1dc1140b13516522ed7dfbfed8ce70a4107afb726e
|
|
BLAKE2b-256 checksum How to use checksums |
a9b6d65ecd87e52cbef3b1bdf1b94dab5459c1cd07b04e528b3e0b9076eba149
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/6.2.0 CPython/3.10.11
|
