Page 2 of 2 FirstFirst 12
Results 16 to 18 of 18

Thread: .NET unpackme

  1. #16
    Or why dont use M$ own tool ILDASM , commonly found in sdk directory

  2. #17
    Quote Originally Posted by _InSaNe_ View Post
    Or why dont use M$ own tool ILDASM , commonly found in sdk directory
    Well Dotfuscator does it like that and thats one of the best obfuscators at the moment
    Not real code protection though
    Regards,
    LibX // RETeam

  3. #18
    How to unpack pure .NET Packer with Reflexil:

    1)I found the function which calls EntryPoint.Invoke: in this case


    public void c()
    {
    Assembly.Load(this.d).EntryPoint.Invoke(null, null);
    }



    2) At this point I used the new plugin:
    Into reflexil window: right click and select "Replece all with code".
    Into the c# source I added using System.IO; and into the c() function this:


    FileStream fs = new FileStream(@"C:\dump.exe",FileMode.Create,FileAccess.Write);
    fs.Close();


    Now click on "Preview IL" and if all is ok click on "OK"

    3)Manual insertion of IL code:
    now insert after the first stloc.0 these IL codes, in this way, we can use local variables and functions:

    ldloc.0
    ldarg.0
    ldfld uint8[] a:biggrin.gif
    ldc.i4.0
    ldc.i4 0x927c1
    callvirt instance void [mscorlib]System.IO.FileStream::Write(uint8[], int32, int32)



    aka stream.Write(this.d, 0, 0x927c1);
    For more info about doing it view the UFO-Pu55y video tutorial.

    4)Save the file, and run it: a running dump will create at c:\

    The patched file: http://www.megaupload.com/?d=633TI0BN

Similar Threads

  1. 2nd .NET unpackme
    By rendari in forum Mini Project Area
    Replies: 22
    Last Post: April 25th, 2008, 14:53
  2. .NET unpackme
    By rendari in forum Blogs Forum
    Replies: 3
    Last Post: January 29th, 2008, 12:40

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •