[C#] Phoenix + Beds + ILprotector + Enigma

[RockStar]

Language : .NET
Platform : Windows
OS Version : x64
Packer / Protector : Phoenix + Beds + ILprotector + Enigma (ILprotector + Enigma + Beds = Paid + Newest Versions)

Description :
Let us know how it was done!

Sorry Mods For File Size (Enigma Seems To Increase The File Size No Matter What As Well As IlProtector I can Show Proof And Protect In front If Need Be)

Screenshot :

 

Download File: Download

Unpack_Me.rar

Edited September 2, 2019 by Teddy Rogers

[Teddy Rogers]

Please attach the file to your post and not an external host. Thank you...

Ted.

[RockStar]

I cannot attach it because it is a 0.90MB max file size, When using Enigma its VM it creates I imagine is why the file size increases by so much, ILProtect increases it as well due to the DLLs it requires at runtime.

[0x59]

First i dumped file and enigma protector was removed 
Then i used ILProtector Unpacker by ElektroKill 
After i use constant decryptor made by cursedsheep and i was able to see the code

Edited November 7, 2020 by 0x59

[CodSec]

@0x59 how you opened dumper ?

[0x59]

https://anonfiles.com/p8b248vfp7/Dumper_rar

download this and just drag and drop  

[goro1988]

@0x59I already removed the enigma layers, but the ILprotect layers give an error, can you help me?

[0x59]

Modd it and error has ocurred on it 😕 

[goro1988]

@0x59 is ILProtector Unpacker by ElektroKill, 

I removed the engima, but when using the ILProtector Unpacker by ElektroKill it does not work, could you share a video or tutorial on how to remove that ilprotect layer because the ElektroKill tool does not work for me

[tgf]

 send me this tools please 

 

[ElektroKill]

I will release an update for the tool which allows the skipping of metadata writing errors!

[SychicBoy]

 

1-Run the file and dump it using ExtremeDumper.

2-Unpack the ILProtector using ElektroKill's ILPUnpacker (attached the fixed version bellow)

3-Remove junk attributes and decrypt strings.

 

My code to remove junk attributes and decrypt strings using dnlib:

	public static void RemoveAttributes(ModuleDef module)
        {
            foreach (var type in module.GetTypes())
            foreach (var method in type.Methods)
            foreach (var customAttribute in method.CustomAttributes.Where(customAttribute =>
                         customAttribute.TypeFullName != "System.STAThreadAttribute").ToList())
                method.CustomAttributes.Remove(customAttribute);
        }

        public static void DecryptStrings(ModuleDef module)
        {
            foreach (var type in module.GetTypes())
            foreach (var method in type.Methods.Where(x => x.HasBody && x.Body.HasInstructions))
                for (var i = 0; i < method.Body.Instructions.Count; i++)
                {
                    try
                    {

                        if (!method.Body.Instructions[i].OpCode.Equals(OpCodes.Call))
                            continue;
                        if (method.Body.Instructions[i].Operand is not MethodDef calledMethod)
                            continue;
                        if (calledMethod.DeclaringType.Name != "DefiningMethod")
                            continue;
                        if (!method.Body.Instructions[i - 1].OpCode.Equals(OpCodes.Ldstr))
                            continue;

                        var operand = Decrypt(method.Body.Instructions[i - 1].Operand.ToString());
                        method.Body.Instructions[i - 1].OpCode = OpCodes.Nop;
                        method.Body.Instructions[i].OpCode = OpCodes.Ldstr;
                        method.Body.Instructions[i].Operand = operand;
                    }
                    catch
                    {
                    }
                }
        }

        private static string Decrypt(string text)
        {
            var length = text.Length;
            var array = new char[length];
            for (var i = 0; i < array.Length; i++)
            {
                var c = text[i];
                var b = (byte)(c ^ (length - i));
                var b2 = (byte)(c >> 8 ^ i);
                array[i] = (char)((b2 << 8) | b);
            }

            return string.Intern(new string(array));
        }

 

Unpacked.exe ILPUnpack_NET4.5_FIX.zip

Edited November 11, 2022 by SychicBoy