Jump to content
Tuts 4 You

[UnpackMe] .NET Unpackme 1

Go to solution Solved by Hadits follower,

Recommended Posts

Hadits follower

main resource entrypoint Rva 07FFFFFF => OfFset 2F9FE in main exe contain with picture box UPside ascii let me know if is hard


edited : upside have all decrpted string with asii char exe contains

Edited by Death
Link to comment
Share on other sites

  • Solution
Hadits follower

well proper solution of run about res prb in dump exe - the method readres  reading res from memory but here i have have dump res , so no need that part of method , for fix that part have read main exe code 

private unsafe static void smethod_0()
   Stream manifestResourceStream = Assembly.GetExecutingAssembly().GetManifestResourceStream("åíáëåá\v\vïå\a\u000fááé\a");
   IntPtr hglobal;
   Stream stream = Class1.smethod_0(manifestResourceStream, out hglobal);
   stream.Position = 8L;
   Class0 @class = new Class0(stream);
   GClass0.int_0 = (int)@class.method_6();
   object data = @class.method_6();
   AppDomain.CurrentDomain.SetData("allstrings", data);
   int arg_65_0 = (int)stream.Position;
   byte[] array = @class.method_6();
   IntPtr intPtr = Marshal.AllocHGlobal(array.Length);
   Marshal.Copy(array, 0, intPtr, array.Length);
   data = new UnmanagedMemoryStream((byte*)((void*)intPtr), (long)array.Length);
   AppDomain.CurrentDomain.SetData("A5NFUdRddlgosdMh.Et6UQMd0FhRZF2hg.resources", data);


we need this line only for got resource from assembly direct

Stream manifestResourceStream = Assembly.GetExecutingAssembly().GetManifestResourceStream("åíáëåá\v\vïå\a\u000fááé\a");

the function getting resource so we need replace it readres method which reading res in dump exe


åíáëåá\v\vïå\a\u000fááé\a => string_1 as assembly static with instruction ldarg =>

public static UnmanagedMemoryStream ResGet(string string_0)






however this code string part  AppDomain.CurrentDomain.SetData("allstrings", data); u can inject this this il in ResGet(String): UnmanagedMemoryStream in this  for read string  if cant decrypt 


Edited by Death
  • Like 2
Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Create New...