Jump to content
Tuts 4 You
  • 0
snoop

Infralution 2.1.6

Rate this question

Question

snoop

Difficulty : 9
Language : .NET
Platform : Windows
OS Version :  Windows 7, 8, 8.1,10
Packer / Protector : NET Encryptor - Infralution 2.1.6

Description :

Tutorial how to unpack it. The file should be runnable after unpacking it

de4dot does not recognize it

Screenshot :

image.png.0ff3f7483e1e08fa290c9334ca88c4c1.png

 

Unpackme NET Encryptor - Infralution.zip

Edited by snoop
re-upload file (see edit history)

Share this post


Link to post

4 answers to this question

Recommended Posts

  • 3
iVally

Maybe I don't understand something, but... 9/10?? Are you serious?

You just need to dump a managed module.

 

 

TestWpfApp.exe

Share this post


Link to post
  • 2
kao
11 minutes ago, snoop said:

I think I failed to comment that it is not valid to use megadumper, because I mention it? because it is possible to embed exe and several dlls, if you simply do this, all references between dlls and exe will be null

And I think you have no idea what you're talking about.

 

Here's another method of dumping each assembly separately without MegaDumper:

1) Step into AssemblyLoaderx86/64 dll until the place in screenshot.
2) Dump raw assembly from byte array.
3)Done.

Spoiler

FLYUysJ.png

 

unpacked.exe

  • Thanks 3

Share this post


Link to post
  • 0
snoop
5 hours ago, iVally said:

Tal vez no entiendo algo, pero ... ¿9/10? ¿En serio?

Solo necesita volcar un módulo administrado.

 

 

TestWpfApp.exe

I think I failed to comment that it is not valid to use megadumper, because I mention it? because it is possible to embed exe and several dlls, if you simply do this, all references between dlls and exe will be null

Share this post


Link to post
  • 0
snoop
5 hours ago, kao said:

And I think you have no idea what you're talking about.

 

Here's another method of dumping each assembly separately without MegaDumper:

1) Step into AssemblyLoaderx86/64 dll until the place in screenshot.
2) Dump raw assembly from byte array.
3)Done.

  Reveal hidden contents

FLYUysJ.png

 

unpacked.exe

Good job, in terms of references I thought it worked just like CosturaPlugin.

But in this case it is simpler (unbelievable to be a commercial version), because the * .exe is also embedded, you only need the embedded and the rest is useless, very different from what does CosturaPlugin

Share this post


Link to post

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×