Difficulty : 9
Language : .NET
Platform : Windows
OS Version :  Windows 7, 8, 8.1,10
Packer / Protector : NET Encryptor - Infralution 2.1.6

Description :

Tutorial how to unpack it. The file should be runnable after unpacking it

de4dot does not recognize it

Screenshot :

 

Unpackme NET Encryptor - Infralution.zip

Edited September 16, 20186 yr by snoop
re-upload file

Maybe I don't understand something, but... 9/10?? Are you serious?

You just need to dump a managed module.

 

 

TestWpfApp.exe

5 hours ago, iVally said:

Tal vez no entiendo algo, pero ... ¿9/10? ¿En serio?

Solo necesita volcar un módulo administrado.

 

 

TestWpfApp.exe

I think I failed to comment that it is not valid to use megadumper, because I mention it? because it is possible to embed exe and several dlls, if you simply do this, all references between dlls and exe will be null

11 minutes ago, snoop said:

I think I failed to comment that it is not valid to use megadumper, because I mention it? because it is possible to embed exe and several dlls, if you simply do this, all references between dlls and exe will be null

And I think you have no idea what you're talking about.

 

Here's another method of dumping each assembly separately without MegaDumper:

1) Step into AssemblyLoaderx86/64 dll until the place in screenshot.
2) Dump raw assembly from byte array.
3)Done.

Spoiler

 

unpacked.exe

5 hours ago, kao said:

And I think you have no idea what you're talking about.

 

Here's another method of dumping each assembly separately without MegaDumper:

1) Step into AssemblyLoaderx86/64 dll until the place in screenshot.
2) Dump raw assembly from byte array.
3)Done.

  Reveal hidden contents

 

unpacked.exe

Good job, in terms of references I thought it worked just like CosturaPlugin.

But in this case it is simpler (unbelievable to be a commercial version), because the * .exe is also embedded, you only need the embedded and the rest is useless, very different from what does CosturaPlugin