UnPackMe (.NET)

About File: .NET Framework 4.8, 32-bit preferred
Used Obfuscator: Rika .NET Obfuscator Latest
Used Features: Code Virtualization & Anti Tamper
Difficulty: 6/10
Goal: Deobfuscate & Devirtualize it competely.

File protected by eazfuscator v2025.01 having Code Virtualization enabled. Find registration combination and reply it with the success message!

File protected by .NET Reactor v7.3 having Code Virtualization enabled. By nature the application using Dependency Injection (this time heavily developed), the 3rd party files embedded to main exe (see shot2), in addition System.Data.SQLite.dll lying near application. Find registration combination and reply it with the success message!
Custom antidebugger

File protected by Eazfuscator.NET v2025.1 having Code Virtualization enabled. By nature the application using Dependency Injection, the 3rd party files embedded to main exe. Find registration combination and reply it with the success message!
Codebase improved a little bit versus reactor73 target.

File protected by .NET Reactor v7.3 having /Code Virtualization/ enabled. By nature the application using /Dependency Injection/, the 3rd party files embedded to main exe (see shot2). Find registration combination and reply it with the success message!

ByUndefined Protector V3
Anti Debugger
Anti Dump
Anti Tamper
Anti Memory
Anti Dll Inject
Anti ILDasm
Resources Compress
String Encrypt
ControlFlow
Virtualization
Renamer

 
Virtualization Updated
Task: Unpack

 
 

ByUndefined Protector
Anti Debugger
Anti Dump
Anti Tamper
Anti Memory
Anti Dll Inject
Anti ILDasm
Resources Compress
String Encrypt
ControlFlow
Virtualization
Renamer
Merge Dll Add

Task: Unpack
 
 
 

ByUndefined Protector
Anti Debugger
Anti Dump
Anti Tamper
Anti Memory
Anti ILDasm
Resources Compress
String Encrypt
ControlFlow
Virtualization

ByUndefined Protector + Enigma
Anti Debugger
Anti Dump
Anti Tamper
Anti ILDasm
Resources Compress
String Encrypt
ControlFlow
Virtualization

Purpose: You need to patch or unpack the correct key.

This methods protected with Ultra setting (mutation+virtualization) and complexity none ( for example if complexity setted 22% the output goes 1mb ). Either unpack it, either provide a valid license file.
 
 

Assemblies are obfuscated, then method bodies are replaced by corrupted code; de-compilation and disassembly tools like ILDASM can no more unassemble methods.
Components Protection, this feature enables not only exe protection, but dll as well. ASP.Net is supported by dotNet Protector.
Added anti-JIT.

This is a simple calculator.exe. Protected with ILProtector 2.0.22.14 and double layer Enigma 7.40. First layer on DLL, second layer on EXE and added DLL in Enigma Virtualbox.
For skilled reversers this will not be a problem unpack this.

This file is protected by the first version of VirtualGuard. VirtualGuard is an obfuscator I develop that I am trying to receive some stress testing on
I hope this VM makes people think at least a little bit; It's fairly close to 1:1, however I do believe I do some interesting things with comparisons and branching. Haven't seen it anywhere else. Let the record state this is not a "mod" of any other vm, so if you are interested in seeing some new stuff this is for you.
This sample contains some fairly simple branch offset mutations, at first glance it may be a slight "wtf moment" (at least I hope), but as soon as you figure out how the comparison system works it should be fairly easy to figure out.
Anyways, enough of the kind-of hints. Would love any feedback on this. The crack-me element is fairly basic, just entering a password. Would definitely be a first step to solving though, so would like to see how people work on figuring that out.
Good luck!

AgileNET (code virtualization on 1 method only, no other protector features used) 

I took my NETBuilderInjection and turned it into a Protector, but I don't know how secure it is. (For me, it's safe enough.)
So I made this little program, The objectives are:
[Unpackme] You should unpack it and get the cleanest code possible.
[Crackme] In the textbox where the HWID is displayed you must modify the text and write something else in it.
[Bypass] You will need to disable "Falcon Anticheat" from the executable.
----------------------------------------------------------------------------
Difficulty : Unknown
Language Base : .NET
Platform : Windows - .NET Framework 4.6
OS Version :  Windows 7 or higher.
Packer / Protector : Improved NETBuilderInjection (in C) + VMP
Description :
NETBuilderInjection allows you to generate a Dll.NET assembly that can be easily injected into any process like any native dll. but in itself it is a packer. I made some improvements to it.

File packed with .NetReactor 6.9 -- All options

This file is protected using DNGuard HVM 3.9.6.2
Protections used : 
HVM Jit Challenge is to unpack and post details of methods used.

I would like you to test the obfuscator I am still working on developing.
The goal is to unpack the file and provide your unpacking method.
https://www.virustotal.com/gui/file/965c96b4e7a431635ab9f450cb89784791aec2eec27a204e195dece2fcce5f36?nocache=1

Public key sample protected using ConfuserEx 1.6.0.
https://github.com/mkaring/ConfuserEx/releases/tag/v1.6.0
Your challenge is to unpack and decompile the file.

File protected by Winlicense, asking for registration code, when valid inserted a small game appears.
Purpose is to dump the .net code of this game,

Hi all,
This is a protected with the RETAIL edition... 
Mutation / Virtualization w/ the built in VMProtect license system.
There are 2 enter serial dialogs, once you solve the 1st, drives you to 2nd, when a valid serial entered exporting a file... 
If a valid serial entered on 1st form, is saved to license.diz file.

The file is protected with Olivia Guard v1.3.
The protection in currently in beta, it's not completed yet.
Goal : Unpack the file and provide details of the methods you used to bypass the protection.

Unpack the exe to find the key! If you would give a brief explanation on how you unpacked it.
The exe has max protections and will pop up a messagebox once you enter the correct password.
Protections added to this: Hide String, Control Flow, Obfuscate Name, Obfuscate NameSpaces, Virtualize code.

Update 04-June 2022
Version 2022.2

Unpack Password - BH2022.2


 
Old 2022.1 Info -

This unpackme is protected with latest version of EAZfuscator = https://www.gapotchenko.com/eazfuscator.net/features
Password to unpack = EAZ2022 (I made a RAR file with password protection because I was unable to upload the unpackme directly. I was getting error due to false virus alarm)
Your job is to unpack the file fully. Partial unpacking won't be accepted.

I have been working on modifying and creating new protections for the past few months. Here is an unfinished UnPackMe sample.