Momoko-Ayase
9b8024b132
The packer demotes the four base-relocation entries covering the TLS directory's VA fields to IMAGE_REL_BASED_ABSOLUTE padding, because its own loader fixes TLS up by hand. Restored verbatim, a DLL mapped off its preferred base keeps stale VAs in its TLS directory and the OS loader faults in LdrpAllocateTlsEntry while writing the TLS slot index through the unrelocated AddressOfIndex (observed as a 0xc0000005 startup failure). Walk the restored BaseReloc blocks and promote those entries back to IMAGE_REL_BASED_HIGHLOW, gated on is_dll so EXE output stays byte-identical.
Senbei
A static unpacker for Crackproof-protected 64-bit and 32-bit PE files and protected Android AArch64 shared libraries. Point it at a file, an app package, or a folder and it writes decrypted copies without launching the protected program.
Senbei reads protected input bytes and replays the unpacking algorithm statically. The command-line tool adds filesystem scanning, progress reporting, and logs; senbei-wasm provides the browser binding.
Crates
The workspace contains eight crates: senbei-cli, senbei-crypto, senbei-io, senbei-metadata, senbei-pe, senbei-elf, senbei-engine, and senbei-wasm.
senbei-pe and senbei-elf contain validated format parsing, address mapping, and ELF dynamic-table helpers. Protection-specific code is in senbei-engine/src/windows/ and senbei-engine/src/android/. Platform-specific crypto is grouped under senbei-crypto/src/windows/ and senbei-crypto/src/android/; metadata code shared by both platforms stays at the senbei-metadata root, with seeded Android code under src/android/.
Supported Inputs
- Protected Windows
.exeand.dllfiles, including external<name>.exe._and<name>.dll._payloads. global-metadata.datfiles with supported method-token layouts.- Protected Android
.sofiles and Android.apk,.apks, and.xapkpackages.
Windows scanning probes only .exe, .dll, and global-metadata.dat; companion payloads are consumed through their matching stub and are not counted as skipped files. Android scanning probes only .so and global-metadata.dat. Android packages are inspected from their ZIP manifests and only matching .so and metadata entries are extracted.
Quick Start
cargo build --release
senbei protected.exe
senbei game.apk
senbei "C:\Games\MyGame"
Outputs are written below an unpack directory unless --out is supplied. Every restored PE or ELF image passes a structural validation step before it is reported as successful.
Tests
cargo test --release --workspace
cargo clippy --workspace --all-targets -- -D warnings
cargo fmt --all -- --check
The local test/ corpus can be passed to the CLI for real sample verification. The tracked samples/ corpus is optional and remains user-managed.
Web Build
cd senbei-wasm
wasm-pack build --target web --release --out-dir ../web/pkg
The generated package is written to the ignored web/pkg/ directory and can be served with any static HTTP server.
Legal Notice
Use Senbei only for software you own or are authorized to analyze. The project is intended for lawful reverse engineering, security research, preservation, and interoperability.
License
GNU Affero General Public License v3.0 (AGPL-3.0-only).