zodiac Posted September 11, 2018 Share Posted September 11, 2018 Difficulty : 5 Language : .NET C# Platform : Windows .x32/x64 OS Version : All Windows Packer / Protector : DotNetPatcher 4.5.9 (last Version) Description : max Protaction. note Method and tutorial how to unpack it. The file should be runnable after unpacking it Screenshot : unpackme.zip Link to comment Share on other sites More sharing options...
Ahmad_k Posted September 12, 2018 Share Posted September 12, 2018 There is no need to unpack. Link to comment Share on other sites More sharing options...
XenocodeRCE Posted September 13, 2018 Share Posted September 13, 2018 18 hours ago, Ahmad_k said: There is no need to unpack. its in the "unpackme" section of the forum, so the goal is to unpack it, not to dump correct string from memory 2 Link to comment Share on other sites More sharing options...
zodiac Posted September 14, 2018 Author Share Posted September 14, 2018 On 9/13/2018 at 5:26 AM, XenocodeRCE said: its in the "unpackme" section of the forum, so the goal is to unpack it, not to dump correct string from memory thanks XenocodeRCE. I mean, it's unpacking exe file, not finding a string. It is clear that the string is compared in memory and by the method. XenocodeRCE I downloaded your tools in the github, but works for lower versions of Dont net Patch. This version of the app is strong. 🙂 Please introduce a new method for unpack. Link to comment Share on other sites More sharing options...
Ahmad_k Posted September 14, 2018 Share Posted September 14, 2018 The new ControlFlow in DNP is not hard to defeat, actually after reading the source code i was able to remove Cflow partially (some error still exist in the tool and need to be fixed). Here is the file unpacked and cflow removed. still not runnable because of error also you can find in the attachment the source code of my cflow removal, just adding to @XenocodeRCE tool and use it. If anyone can contribute and find what did i miss it will be great. i don't know why it fails in some methods and not fixing them correctly. And finally i did post my answer above like this because the point from obfuscation is to make your code more complex when debugging. unpacked_noCflow.zip CFlow.zip 1 Link to comment Share on other sites More sharing options...
zodiac Posted September 15, 2018 Author Share Posted September 15, 2018 15 hours ago, Ahmad_k said: The new ControlFlow in DNP is not hard to defeat, actually after reading the source code i was able to remove Cflow partially (some error still exist in the tool and need to be fixed). Here is the file unpacked and cflow removed. still not runnable because of error also you can find in the attachment the source code of my cflow removal, just adding to @XenocodeRCE tool and use it. If anyone can contribute and find what did i miss it will be great. i don't know why it fails in some methods and not fixing them correctly. And finally i did post my answer above like this because the point from obfuscation is to make your code more complex when debugging. unpacked_noCflow.zip CFlow.zip thanks but is not full unpak. anti tamper. anti dumper and etc how to remove. new dnp strange. Link to comment Share on other sites More sharing options...
Ahmad_k Posted September 15, 2018 Share Posted September 15, 2018 (edited) Yes i know it is not fully unpacked. I was just trying to remove cflow for the code to be understandable and almost the same as source code. You can download the source code for DNP and try to reverse it Edited September 15, 2018 by Ahmad_k Link to comment Share on other sites More sharing options...
CodeOfDark Posted October 20, 2018 Share Posted October 20, 2018 Cleaned File: Full DeObfuscate using : https://github.com/CodeOfDark/Deobf-DotNetPatcher Link to comment Share on other sites More sharing options...
Vinnu Posted October 22, 2018 Share Posted October 22, 2018 Unpack File https://www19.zippyshare.com/v/gUL4cYuO/file.html Link to comment Share on other sites More sharing options...
modz50 Posted November 28, 2022 Share Posted November 28, 2022 On 10/20/2018 at 9:19 AM, CodeOfDark said: Cleaned File: Full DeObfuscate using : https://github.com/CodeOfDark/Deobf-DotNetPatcher the link is no longer available any chance of uploading the source code for it again pease Link to comment Share on other sites More sharing options...
Coco420 Posted November 28, 2022 Share Posted November 28, 2022 https://github.com/fobricia/Deobf-DotNetPatcher Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now