Hello all .

 

This UnpackMe was protected with Box+Cp+reactor etc ..

 

Have a try  ,UnpackMe...

 

Good luck ! 

 

I don't want tutorial ，i want to do it by myself ...

UnpackMe_hard.rar

Edited April 13, 201510 yr by 381400744

1.megaDump or 7zip to remove boxapp

2.de4dot strtok 6000029 and 600002a.

3 de4dot again

4.ilspy debug ( Crypto Obfuscator ) 

 

 

@ghostfish

 

Thanks for sharing ！

 

But i think you have not Unpacked full. 

yes. not fully unpacked.

and I will continue to learn.

crypto obfuscator and appfuscator 

 

my deobfuscator can handle most of appfuscator

 

 

 

 

UnpackMe hard_deob_ren.rar

Edited April 13, 201510 yr by Alcatraz3222

  i find BoxedAppSDK+Reactor+Crypto+Appfuscator

but i can't Decrypt Appfuscator ......

I don't know how to continue?  

boxed app + crypto + net reactor removed!

but i don't known how to decrypt appfuscator sorry.

 

 

boxedapp_dump-cleaned-cleaned.rar

crypto obfuscator and appfuscator 

 

my deobfuscator can handle most of appfuscator

nice

Edited April 13, 201510 yr by CodeShark

 

I can not decrypt string at all , Because it has a lot    

UnpackMe hard_Unpacked.rar

Edited April 13, 201510 yr by CodeEnding

Thenks Dear 

@Alcatraz3222

 

 

装逼遭雷劈？

Edited April 14, 201510 yr by 381400744

@Alcatraz3222

 

 

装逼遭雷劈？

i don't understand chinese, and i don't think the translation of google translator is correct.

@Alcatraz3222

 

Don't mind ! 

 

can you share your tools ?

 

if you don't want . dosen't matter...

@Alcatraz3222

 

Don't mind ! 

 

can you share your tools ?

 

if you don't want . dosen't matter...

no sorry, still work in progress, and i don't think they will be public

OK，I respect your choice  .. 

I don't know the .NET stuff to decrypt but here is first layer removal (Boxed APP Packer).

The exe reside unencrypted at last section.

You just need to dump and fix.

Here is a video for those who are interested.

 

http://upx.nz/5jQw6z