Collaborative RCE Tool Library - .NET Unpackers

Tool Updated: DotNet Sniffer Win32

Mon, 26 Jan 2009 14:39:45 GMT

Listed in categories: .NET Tools, .NET Unpackers

Most recent version:
2.0

Most recent release date:
November 8, 2008

Description:
dotNet Sniffer 2 uses the .NET profiler API to save assemblies loaded from memory. Once a module is handled by the .NET Framework, dotNet Sniffer saves it to disc if it was loaded from memory. Some tools are changing the module (decrypt methods ...) after loading; dotNet Sniffer allows you to save the module again during the execution of the first method (JIT). The profiler will be active only for the process to start; installing dotNet Sniffer will not affect the performance of other .NET programs. dotNet Sniffer 2 is available for 32-bit and 64-bit processors. 64-bit versions also install the 32-bit profiler and can save indifferently 32-bit and 64-bit processes. If you use 64-bit Windows, install only the 64-bit version suitable for your processor.

Tool Updated: PvLog LicenseManagerKiller Win32

Mon, 26 Jan 2009 14:37:27 GMT

Listed in categories: .NET Tools, .NET Unpackers

Most recent version:
1.0

Most recent release date:
November 8, 2008

Description:
The purpose of PvLog LicenseManagerKiller is to warn against the inefficiency of managing licenses in 100% managed code. LicenseManagerKiller is a tool that removes LicenseProvider attributes in the assembly. This tool is rudimentary and releases only most naive protections, but you can imagine that PvLog DeObfuscator and Reflector would allow a determined attacker to remove more sophisticated license controls.

Tool Updated: DotNetTools Win32

Mon, 26 Jan 2009 14:36:10 GMT

Listed in categories: .NET Deobfuscation Tools, .NET Tools, .NET Unpackers

Most recent version:
1.0

Most recent release date:
November 8. 2008

Description:
dotNet Tools is a freeware suite that includes dotNet Sniffer, PvLog DeObfuscator and PvLog LicenseManagerKiller. dotNet Sniffer uses the .NET profiler API to save assemblies loaded from memory. PvLog Deobfuscator is a MSIL code optimizer that makes more readable obfuscated code. LicenseManagerKiller is a tool that removes LicenseProvider attributes in the assembly.

Tool Updated: .NET Generic Unpacker

Sun, 06 Apr 2008 11:11:42 GMT

Listed in categories: .NET Unpackers, Automated Unpackers

Most recent version:
1.0.0.1

Most recent release date:

Description:
This is a program to dump .NET packed applications. Of course no serious .NET protection relies on packing. In fact, this software shows how easily you can unpack a protected assemly. This .NET Generic Unpacker was written in a couple of hours and despite of the fact that it's very simple, it might turn useful having it: otherwise you have to unpack manually, which is also very easy.

Tool Updated: REZiriz

Fri, 19 Oct 2007 21:19:57 GMT

Listed in categories: .NET Unpackers, Automated Unpackers

Most recent version:
2.0

Most recent release date:
August 28, 2007

Description:
REZiriz is a unpacker for Eziriz .NET Reactor > v3.1.x.x

Also added support to remove NecroBits protection that prevents
the decompilation of unpacked assemblys
And support to unpack v3.3.1.1 of Eziriz .NET Reactor

Unpacker features:
---------------------------
[*] Unpacking Eziriz .NET Reactor v3.3.1.1
[*] Unpacking Eziriz .NET Reactor v3.3.0.1
[*] Unpacking Eziriz .NET Reactor v3.2.4.6
[*] Unpacking Eziriz .NET Reactor v3.2.0.6
[*] Unpacking Eziriz .NET Reactor v3.2.0.0
[*] Unpacking Eziriz .NET Reactor v3.1.0.0

[*] Versions < v3.1.0.0 are not supported

[*] Added NecroBit Protection Remover