[unpackme] Xheo Codeveil Unpackme

[LibX]

This unpackme is protected with the latest version of Xheo CodeVeil

I hope u enjoy reversing this nice protection

Regards,

LibX // RETeam

UnpackMe.rar

[pavka]

It is not started XP Sp2

[PiONEER]

Hello

Works fine on Xp Pro SP1

Cheers

[Sonny27]

I?m using XP+SP2, too and it works fine here

I?m using .NET-Framework 1.1 with SDK.

I?ll try my best, LibX

greetz

[LibX]

  Sonny27 said:

I?m using .NET-Framework 1.1 with SDK.

Thats pretty funny since its compiled with .NET 2.0

Regards,

LibX // RETeam

[Sonny27]

I?ve to say that I?ve no idea what to unpack here. I?ve bypassed the layers and a CALL EAX I think went to "OEP" or better said a call to a .NET function that executes the app....

Is this done then?

greetz

[Apakekdah]

All of them that was on the hands sonny27 must be overcome...

*am i right, in writing english... *

Edited March 25, 2007 by Apakekdah

[Sonny27]

I don?t know, but at least I couldn?t understand what you wanted to say

greetz

[LibX]

Its a .net app so the unpacked copy should be loadable in .NET Reflector or any other .net decompiler,

and ofcource the file needs to be fully runnable

Send me ur unpacked copy when ur done

Regards,

LibX // RETeam

[kryho]

LibX my lover

[LibX]

  kryho said:

LibX my lover

Hee bro how are u doing?! I never see u online anymore

We should have a chat on IRC some time

[kryho]

  LibX said:

Hee bro how are u doing?! I never see u online anymore

We should have a chat on IRC some time

hehe i will back on irc soon

ive droped crackin for 2,5years now im trying to get back on tracks

but many new ****s came and this EXECRYPTOR makes me sick ;/

[Sonny27]

hi LibX,

I?ve reached OEP but my dump always refuses to run. I believe that I?ve fixed the Header correctly but it that this was not enough

Could you please help me unpacking this file?

greetz

[Killboy]

Same here, finding OEP is very easy, for a short version just BP the Jump Dword right above the Entrypoint

Anyway, I dumped and then fixed the header so at least it starts.

It immediately crashes with some .NET error message, bla bla...

I dont belive unpacking .NET is that easy, there are some tricks for sure, like magled meta data, dunno :/ Never unpacked .NET apps except for NsPack and even there I used one of the automatic .NET generic unpackers (which works pretty fine most of the time)...

You wouldnt have posted it if it was that easy, huh ?

[Ufo-Pu55y]

tKC pwned it again... lol

http://www.filesend.net/download.php?f=f1c...a72afd72dfcf65e

I think this is what you could need now.

Get this beautiful sh!t and read yourself...

[LibX]

  Ufo-Pu55y said:

tKC pwned it again... lol

http://www.filesend.net/download.php?f=f1c...a72afd72dfcf65e

I think this is what you could need now.

Get this beautiful sh!t and read yourself...

I don't think this dump runs yet

[rendari]

Would be interesting to see how you coded this. I have no idea where to start with protecting .NET :/

[rendari]

Hehe I was lazy. Hex editor in your hands, and warm your seat up a bit, and you can code a xor packer in a day. Amazing that companies sell them for 2k.

[Killboy]

I dont think LibX actually coded this himself ? Or did he ?

He coded the unpackme, but not the packer...

Anyway, if you dont mind you could share your source w/ the forum members, might help somebody...

No must, though... if you want to keep things private

[rendari]

Can't really share much since I signed a contract with a company... but I am allowed to answer questions

[LibX]

Its not that hard if u take a little time to look closer at the stub

And no i didn't code this packer myself thank god

[rendari]

Hi, can someone please reupload TKC's tutorial?

[Ufo-Pu55y]

  rendari said:

Hi, can someone please reupload TKC's tutorial?

http://www.tuts4you.com/download.php?view.1539

[rendari]

Woops, should've looked there.

Thanks!

[rendari]

Hmm looked at the tutorial again. It only shows you how to get a dump, but not how to decrypt the MSIL, so the dump is non-functioning :|