DotNetPatcher 4.5

[zodiac]

Difficulty : 5
Language :  .NET C#
Platform : Windows .x32/x64
OS Version : All Windows
Packer / Protector : DotNetPatcher 4.5.9 (last Version)

Description :

max Protaction.  note Method and tutorial how to unpack it.

The file should be runnable after unpacking it

Screenshot :

unpackme.zip

[Ahmad_k]

There is no need to unpack.

[XenocodeRCE]

18 hours ago, Ahmad_k said:

There is no need to unpack.

its in the "unpackme" section of the forum, so the goal is to unpack it, not to dump correct string from memory  

 

[zodiac]

On 9/13/2018 at 5:26 AM, XenocodeRCE said:

its in the "unpackme" section of the forum, so the goal is to unpack it, not to dump correct string from memory  

 

thanks XenocodeRCE. I mean, it's unpacking exe file, not finding a string. It is clear that the string is compared in memory and by the method.

XenocodeRCE  I downloaded your tools in the github, but works for lower versions of Dont net Patch. This version of the app is strong. 🙂 Please introduce a new method for unpack.
 

[Ahmad_k]

The new ControlFlow in DNP is not hard to defeat, actually after reading the source code i was able to remove Cflow partially (some error still exist in the tool and need to be fixed). Here is the file unpacked and cflow removed. still not runnable because of error

also you can find in the attachment the source code of my cflow removal, just adding to @XenocodeRCE tool and use it. If anyone can contribute and find what did i miss it will be great. i don't know why it fails in some methods and not fixing them correctly.

And finally i did post my answer above like this because the point from obfuscation is to make your code more complex when debugging. 

unpacked_noCflow.zip

CFlow.zip

[zodiac]

15 hours ago, Ahmad_k said:

The new ControlFlow in DNP is not hard to defeat, actually after reading the source code i was able to remove Cflow partially (some error still exist in the tool and need to be fixed). Here is the file unpacked and cflow removed. still not runnable because of error

also you can find in the attachment the source code of my cflow removal, just adding to @XenocodeRCE tool and use it. If anyone can contribute and find what did i miss it will be great. i don't know why it fails in some methods and not fixing them correctly.

And finally i did post my answer above like this because the point from obfuscation is to make your code more complex when debugging. 

unpacked_noCflow.zip

CFlow.zip

thanks but is not full unpak. anti tamper. anti dumper and etc how to remove. new dnp strange.

[Ahmad_k]

Yes i know it is not fully unpacked. I was just trying to remove cflow for the code to be understandable and almost the same as source code. You can download the source code for DNP and try to reverse it

Edited September 15, 2018 by Ahmad_k

[CodeOfDark]

Cleaned File: 

 

Full DeObfuscate using : https://github.com/CodeOfDark/Deobf-DotNetPatcher

[Vinnu]

Unpack File

https://www19.zippyshare.com/v/gUL4cYuO/file.html
 

[modz50]

On 10/20/2018 at 9:19 AM, CodeOfDark said:

Cleaned File: 

 

Full DeObfuscate using : https://github.com/CodeOfDark/Deobf-DotNetPatcher

the link is no longer available any chance of uploading the source code for it again pease

[Coco420]

https://github.com/fobricia/Deobf-DotNetPatcher