Jump to content
Tuts 4 You

[UnPackMe] .NET UnPackMe(SE+DNG)


NCK
Go to solution Solved by Hadits follower,

Recommended Posts

thanks all of guys !


 


all of you are powerful but me ! :prop: 


 


thank you my brother @n0t!ng very much !


 


thank you for all of your help !


Link to comment
Share on other sites

@codecracker  can you upload the file which is fixed the entry point?  Thanks ! I am newbie.


@death   for you method .I stop at the fourth step . dont know how to do it.


 


 


codecracker and death . you are the master for .net reverse. Thank you for your sharing tools and ideas!


Link to comment
Share on other sites

  • 6 months later...

 

Finally done as full 

Here is tutorial how to unpack proper 

 

Edited :

 

1. Dump net from process module [ can use dotnet dumper ] 

2. remove .hvmRunt + .rsrc + .HVMRunt Delete ( header and data ) use cff

3. Find corExe by cff in string mod and find comfortamble location copy the rva use that on Impordirection RVA [CFF]

3. Use universal fixer without mark .net and fix [ For fix the mscoree.dll with corExe place in correct location ]

4. Use Cff and copy the virtualize dowrd address from section header[x] .text 

5. .Net direction flags value should be 0003 [ilcode mark]

6. use Dnguard Unpacker 

7. for run use ilasm and ildasm 

 

it is all at long last .

 

End of the game ....

 

 

Attached Unpacked4 Final Tutroial 

 

thanks a lot

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...