[UnPackMe] .NET UnPackMe(SE+DNG)

[NCK]

thanks all of guys !

 

all of you are powerful but me !  

 

thank you my brother @n0t!ng very much !

 

thank you for all of your help !

[NCK]

@ABCD

 

" End of the game ...."

 

i like this words !

[badbaby]

Hope to hurry up to take off DNG3.70 version

[je9rry]

@codecracker  can you upload the file which is fixed the entry point?  Thanks ! I am newbie.

@death   for you method .I stop at the fourth step . dont know how to do it.

 

 

codecracker and death . you are the master for .net reverse. Thank you for your sharing tools and ideas!

[kuazi GA]

• thanks all of guys ! @Death

Edited March 25, 2015 by kuazi GA

[77413036]

 

Finally done as full 

Here is tutorial how to unpack proper 

 

Edited :

 

1. Dump net from process module [ can use dotnet dumper ] 

2. remove .hvmRunt + .rsrc + .HVMRunt Delete ( header and data ) use cff

3. Find corExe by cff in string mod and find comfortamble location copy the rva use that on Impordirection RVA [CFF]

3. Use universal fixer without mark .net and fix [ For fix the mscoree.dll with corExe place in correct location ]

4. Use Cff and copy the virtualize dowrd address from section header[x] .text 

5. .Net direction flags value should be 0003 [ilcode mark]

6. use Dnguard Unpacker 

7. for run use ilasm and ildasm 

 

it is all at long last .

 

End of the game ....

 

 

Attached Unpacked4 Final Tutroial 

 

thanks a lot