keygenme, unpacked
==================

keygenme-unpacked.exe is the runtime-unpacked image, rebuilt into a PE so it
can be loaded statically. The sections were dumped out of a live process on
Windows after the packer had finished, so the bytes here are the real ones.

What it is good for
-------------------
Reading. Load it in IDA or x64dbg at image base 0x140000000 and every address
in the writeup lines up:

  0x140001010  main
  0x1400011C0  test eax,eax / je  (the outcome branch)
  0x140001260  validate(), a single jmp into the virtualised section
  0x140037646  name hash, per character multiply
  0x14003937E  serial transform, step 1
  0x140039410  serial transform, step 2
  0x14003963F  serial transform, step 3
  0x140039DD1  gate 1
  0x140039EC3  the decoy cmov
  0x14003ABAA  the second expected value, stored in the nested frame
  0x14003AD1C  gate 2
  0x14004765E  virtual machine exit, mov rax,[r13+0x178]

What it is not good for
-----------------------
Running. The original import table is resolved at runtime by the packer, by
hashing API names while walking the PEB, so a rebuilt image has no usable IAT
and the CRT dies before it reaches main. Use the packed original if you want a
live process.

Writeup: https://tejashwi.in/unpacking-a-self-defending-windows-crackme/
