Jump to content
Tuts 4 You

[UnPackMe] .NET UnPackMe(SE+DNG)

Go to solution Solved by Hadits follower,

Recommended Posts

thanks all of guys !


all of you are powerful but me ! :prop: 


thank you my brother @n0t!ng very much !


thank you for all of your help !

Link to comment
Share on other sites

@codecracker  can you upload the file which is fixed the entry point?  Thanks ! I am newbie.

@death   for you method .I stop at the fourth step . dont know how to do it.



codecracker and death . you are the master for .net reverse. Thank you for your sharing tools and ideas!

Link to comment
Share on other sites

  • 6 months later...


Finally done as full 

Here is tutorial how to unpack proper 


Edited :


1. Dump net from process module [ can use dotnet dumper ] 

2. remove .hvmRunt + .rsrc + .HVMRunt Delete ( header and data ) use cff

3. Find corExe by cff in string mod and find comfortamble location copy the rva use that on Impordirection RVA [CFF]

3. Use universal fixer without mark .net and fix [ For fix the mscoree.dll with corExe place in correct location ]

4. Use Cff and copy the virtualize dowrd address from section header[x] .text 

5. .Net direction flags value should be 0003 [ilcode mark]

6. use Dnguard Unpacker 

7. for run use ilasm and ildasm 


it is all at long last .


End of the game ....



Attached Unpacked4 Final Tutroial 


thanks a lot

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Create New...