Welcome to the new Woodmann RCE Messageboards Regroupment
Please be patient while the rest of the site is restored.

To all Members of the old RCE Forums:
In order to log in, it will be necessary to reset your forum login password ("I forgot my password") using the original email address you registered with. You will be sent an email with a link to reset your password for that member account.

The old vBulletin forum was converted to phpBB format, requiring the passwords to be reset. If this is a problem for some because of a forgotten email address, please feel free to re-register with a new username. We are happy to welcome old and new members back to the forums! Thanks.

All new accounts are manually activated before you can post. Any questions can be PM'ed to Kayaker.

{smartassembly} protection analysis + unpacker (with source)

This forum focuses on analyzing malware and any aspects of dealing with packer protections.
User avatar
arc_
Member
Posts: 90
Joined: Tue May 13, 2008 2:24 am

Post by arc_ »

0.5.7 release: http://www.mediafire.com/?mp2k257ipwyq88i

Contains a few more crashfixes.
Rastajan
Junior Member
Posts: 1
Joined: Thu Sep 08, 2011 4:18 pm

Post by Rastajan »

arc_ wrote:0.5.7 release: http://www.mediafire.com/?mp2k257ipwyq88i

Contains a few more crashfixes.

Well done bro, very useful Tool! Keep it up dude ;)

Greatz, Rastajan.
User avatar
arc_
Member
Posts: 90
Joined: Tue May 13, 2008 2:24 am

Post by arc_ »

Another update (happy new year), 0.5.8: http://www.mediafire.com/?lunow30hx22wao1 (CRCETL updated as well)

This version counteracts updates in SmartAssembly 6.5.1, featuring improved locating of the methods responsible for handling string and import obfuscation.

In addition, it sets NumberOfRvasAndSizes to 16 in the unpacked file. Some packed files have it set to a lower number, causing the .NET data directory entry to become invalid in theory. This results in some tools not recognizing the file as a .NET binary.
user2

Post by user2 »

Awesome tool, man!!
dadaji
Junior Member
Posts: 1
Joined: Mon Jun 25, 2012 11:43 pm

Post by dadaji »

Just amazing! :)
wrunning
Junior Member
Posts: 1
Joined: Sun Nov 11, 2012 12:02 pm

Post by wrunning »

Hello! First of all, thank you for writing this tool.
Secondly, I'd like to ask if you could have a look at the latest SmartAssembly version and, if you got the time, maybe you can update dumbassembly for it.
I'm not 100% sure it's SmartAssembly's work, but I have come across a .net assembly packed with SmartAssembly 6.7.0.239 and if I unpack it with dumbassembly, the unpacked executable does not work well.
In case you need a link for the assembly in question, it is publicly available here: http://updates.buddyauth.com/?dev=yerp .
Thank you in advance!
Silkut
Senior Member
Posts: 579
Joined: Fri Mar 31, 2006 11:29 am

Post by Silkut »

wrunning > can you develop your problem and tell us what is wrong with the dump, and what did you tried to solve your problem ?
Please consider donating to help Woodmann.com staying online (here is why).
Any amount greatly appreciated. Thank you.
timeerror
Junior Member
Posts: 1
Joined: Tue Jul 30, 2013 5:42 am

Post by timeerror »

please help me dumbassembly soft protec with version 6.7.2.44
Locked