Subveiton Posted January 1, 2019 Share Posted January 1, 2019 Difficulty : 5 (I think) Not sure Language : C# Platform : Windows x32 OS Version : Windows All Packer / Protector : PC-RET protection v1.1 Bronze :just unpack it. Silver: unpack + password of programm Gold: unpack + password + tutorial VirusTotal: https://www.virustotal.com/ru/file/2d0cbe8416c8bc72d73945eecc16cf754488e7a07d26926330e8f59f14afd8ca/analysis/1546348036/ Unpackme.exe Link to comment Share on other sites More sharing options...
CodeExplorer Posted January 1, 2019 Share Posted January 1, 2019 Native layer seems to be protected by Enigma. .NET looks like ILProtector! 1 Link to comment Share on other sites More sharing options...
xdd Posted January 2, 2019 Share Posted January 2, 2019 Confuser + Ilprotector + Enigma 1 Link to comment Share on other sites More sharing options...
CodeExplorer Posted May 15, 2019 Share Posted May 15, 2019 NativeDumper for dumping .NET exe: the main module exe; Do not change EP (Entry Point) Exception messages: Unable to load DLL 'Protect32.dll': The specified module could not be found. (Exception from HRESULT: 0x8007007E) The type initializer for '<Module>' threw an exception Dump the native dll with DllSaver; I once more can't unpack ILProtector. https://www30.zippyshare.com/v/vWikkev7/file.html Link to comment Share on other sites More sharing options...
cawk Posted May 15, 2019 Share Posted May 15, 2019 6 hours ago, CodeExplorer said: NativeDumper for dumping .NET exe: the main module exe; Do not change EP (Entry Point) Exception messages: Unable to load DLL 'Protect32.dll': The specified module could not be found. (Exception from HRESULT: 0x8007007E) The type initializer for '<Module>' threw an exception Dump the native dll with DllSaver; I once more can't unpack ILProtector. https://www30.zippyshare.com/v/vWikkev7/file.html Heres ilprotector removed Unpackme_dump_bodyRestored.exe 1 Link to comment Share on other sites More sharing options...
BlackHat Posted March 15, 2021 Share Posted March 15, 2021 ConsoleApp1.exe Remove Enigma Protector. Dump ILProtector Native DLL File. Remove ILProtector. Remove Cfex by fixing Strings, Proxy Calls etc etc. (I have done partially only) Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now