Jump to content
Tuts 4 You

[UnPackMe] Simple .NET Unpack Me


CodeExplorer

Recommended Posts

[unPackMe] Simple .NET Unpack Me

 

Protected with a private version of my .NET protector.

 

 

If you can unpack write a tutorial!

 

 

 

Edited by CodeCracker
Removed attachement: sorry!
  • Like 2
Link to comment
  • 3 weeks later...
  • 3 weeks later...
  • 3 weeks later...

Didn't meant to bump an old thread but CodeCracker clearly exhorted those who achieved the unpacking of this to write a tutorial, probably for better understanding of those who are like me that don't have enough understanding could then understand how to approach better ways of unpacking...


 


Kindest Regards,


ULI-R0


Link to comment
  • 1 month later...

here is my unpacked file 

 

@abcd how did you fix the strings? (i used a lame way ,by using windbg to dump strings )

Unfortunately your exe ripped from 2nd post as proved the res

"SimpleUnpackMe.MainForm.resources" was my rename because de4dot rename was ns0,class0.resources

 

You just remove two namespace and all anti method from my exe and rebuild by visual studio  , 

 

Ripper should get ban , i can prove evidence that his posted exe ripped , i can see that .

 

Original embeded dumped exe no had version info which i see clear he ripped the second post exe.

 

the string restored in original dumped exe by key " 0 1 2 .. . 

xd

fake :

" (i used a lame way ,by using windbg to dump strings )"

Edited by Death
Link to comment

Unfortunately your exe ripped from 2nd post as proved the res

"SimpleUnpackMe.MainForm.resources" was my rename because de4dot rename was ns0,class0.resources

 

You just remove two namespace and all anti method from my exe and rebuild by visual studio  , 

 

Ripper should get ban , i can prove evidence that his posted exe ripped , i can see that .

 

Original embeded dumped exe no had version info which i see clear he ripped the second post exe.

 

the string restored in original dumped exe by key " 0 1 2 .. . 

xd

fake :

" (i used a lame way ,by using windbg to dump strings )"

you retard do you think that you are the only one able to unpack a .net unpackme!

just fix MetaDataHeader and you will find file table (same as Confuser)!

get embd file and fix couple things like the target architecture in file header...etc,then use ModuleToAssembly

you can get the resource and strings by setting breakpoint at AppDomain.CurrentDomain.SetData

or you can find them in overlay of the file 

 

now can you shut up ?

Edited by n0th!ng
  • Like 1
Link to comment

i never said i can do that , it simple all man can do that , but i just see you are the one posted the file is proper ripped , 


because you file res and my file res is same so i no need explain more , xd


 


can you provide the command you used in windbg ?


and can you explain about it why it res name as same mine there should be 3 res 


and explain about it the res rename .

Link to comment

i never said i can do that , it simple all man can do that , but i just see you are the one posted the file is proper ripped , 

because you file res and my file res is same so i no need explain more , xd

 

can you provide the command you used in windbg ?

and can you explain about it why it res name as same mine there should be 3 res 

and explain about it the res rename .

 

for that you question you can answer by yourself look at this (in method's token: 0x06000040)

 AppDomain.CurrentDomain.SetData("SimpleUnpackMe.MainForm.resources", data);

any way i won't provide any further information because i don't see any need for that 

 

and for the second time you suspect me for nonsense reason , do you have a problem with me ?

Edited by n0th!ng
  • Like 1
Link to comment

oh my gosh....


 


what's wrong with  you ..@abcd @n0th!ng......


 



This is a communication platform ...



 



The most important thing is to learn from each other.....


Edited by 381400744
Link to comment

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...