Infralution 2.1.6

[snoop]

Difficulty : 9
Language : .NET
Platform : Windows
OS Version :  Windows 7, 8, 8.1,10
Packer / Protector : NET Encryptor - Infralution 2.1.6

Description :

Tutorial how to unpack it. The file should be runnable after unpacking it

de4dot does not recognize it

Screenshot :

 

Unpackme NET Encryptor - Infralution.zipFetching info...

Edited September 16, 2018 by snoop
re-upload file

[iVally]

Maybe I don't understand something, but... 9/10?? Are you serious?

You just need to dump a managed module.

 

 

TestWpfApp.exe

[snoop]

  On 9/18/2018 at 3:00 PM, iVally said:

Tal vez no entiendo algo, pero ... ¿9/10? ¿En serio?

Solo necesita volcar un módulo administrado.

 

 

TestWpfApp.exe

Expand  

I think I failed to comment that it is not valid to use megadumper, because I mention it? because it is possible to embed exe and several dlls, if you simply do this, all references between dlls and exe will be null

[kao]

  On 9/18/2018 at 8:41 PM, snoop said:

I think I failed to comment that it is not valid to use megadumper, because I mention it? because it is possible to embed exe and several dlls, if you simply do this, all references between dlls and exe will be null

Expand  

And I think you have no idea what you're talking about.

 

Here's another method of dumping each assembly separately without MegaDumper:

1) Step into AssemblyLoaderx86/64 dll until the place in screenshot.
2) Dump raw assembly from byte array.
3)Done.

  Reveal hidden contents

 

unpacked.exe

[snoop]

  On 9/18/2018 at 8:56 PM, kao said:

And I think you have no idea what you're talking about.

 

Here's another method of dumping each assembly separately without MegaDumper:

1) Step into AssemblyLoaderx86/64 dll until the place in screenshot.
2) Dump raw assembly from byte array.
3)Done.

  Reveal hidden contents

 

unpacked.exeFetching info...

Expand  

Good job, in terms of references I thought it worked just like CosturaPlugin.

But in this case it is simpler (unbelievable to be a commercial version), because the * .exe is also embedded, you only need the embedded and the rest is useless, very different from what does CosturaPlugin