Posted August 31, 20195 yr Language : .NET Platform : Windows OS Version : x64 Packer / Protector : Phoenix + Beds + ILprotector + Enigma (ILprotector + Enigma + Beds = Paid + Newest Versions) Description : Let us know how it was done! Sorry Mods For File Size (Enigma Seems To Increase The File Size No Matter What As Well As IlProtector I can Show Proof And Protect In front If Need Be) Screenshot : Download File: Download Unpack_Me.rar Edited September 2, 20195 yr by Teddy Rogers
September 1, 20195 yr Please attach the file to your post and not an external host. Thank you... Ted.
September 2, 20195 yr Author I cannot attach it because it is a 0.90MB max file size, When using Enigma its VM it creates I imagine is why the file size increases by so much, ILProtect increases it as well due to the DLLs it requires at runtime.
November 7, 20204 yr First i dumped file and enigma protector was removed Then i used ILProtector Unpacker by ElektroKill After i use constant decryptor made by cursedsheep and i was able to see the code Edited November 7, 20204 yr by 0x59
December 3, 20204 yr https://anonfiles.com/p8b248vfp7/Dumper_rar download this and just drag and drop
December 4, 20204 yr @0x59I already removed the enigma layers, but the ILprotect layers give an error, can you help me?
December 5, 20204 yr @0x59 is ILProtector Unpacker by ElektroKill, I removed the engima, but when using the ILProtector Unpacker by ElektroKill it does not work, could you share a video or tutorial on how to remove that ilprotect layer because the ElektroKill tool does not work for me
December 25, 20204 yr I will release an update for the tool which allows the skipping of metadata writing errors!
November 11, 20222 yr 1-Run the file and dump it using ExtremeDumper. 2-Unpack the ILProtector using ElektroKill's ILPUnpacker (attached the fixed version bellow) 3-Remove junk attributes and decrypt strings. My code to remove junk attributes and decrypt strings using dnlib: public static void RemoveAttributes(ModuleDef module) { foreach (var type in module.GetTypes()) foreach (var method in type.Methods) foreach (var customAttribute in method.CustomAttributes.Where(customAttribute => customAttribute.TypeFullName != "System.STAThreadAttribute").ToList()) method.CustomAttributes.Remove(customAttribute); } public static void DecryptStrings(ModuleDef module) { foreach (var type in module.GetTypes()) foreach (var method in type.Methods.Where(x => x.HasBody && x.Body.HasInstructions)) for (var i = 0; i < method.Body.Instructions.Count; i++) { try { if (!method.Body.Instructions[i].OpCode.Equals(OpCodes.Call)) continue; if (method.Body.Instructions[i].Operand is not MethodDef calledMethod) continue; if (calledMethod.DeclaringType.Name != "DefiningMethod") continue; if (!method.Body.Instructions[i - 1].OpCode.Equals(OpCodes.Ldstr)) continue; var operand = Decrypt(method.Body.Instructions[i - 1].Operand.ToString()); method.Body.Instructions[i - 1].OpCode = OpCodes.Nop; method.Body.Instructions[i].OpCode = OpCodes.Ldstr; method.Body.Instructions[i].Operand = operand; } catch { } } } private static string Decrypt(string text) { var length = text.Length; var array = new char[length]; for (var i = 0; i < array.Length; i++) { var c = text[i]; var b = (byte)(c ^ (length - i)); var b2 = (byte)(c >> 8 ^ i); array[i] = (char)((b2 << 8) | b); } return string.Intern(new string(array)); } Unpacked.exe ILPUnpack_NET4.5_FIX.zip Edited November 11, 20222 yr by SychicBoy
Create an account or sign in to comment