Jump to content
Tuts 4 You

Edit History

SychicBoy

SychicBoy

7 hours ago, CreateAndInject said:

 I think @SychicBoy don't know anything about virtualization rather than @kao

@SychicBoy See `awesome.Form01.method_1`, it just call `awesome.Form01.method_2` which is  just the stub of DNR virtualization

```

// awesome.Form01
[MethodImpl(MethodImplOptions.NoInlining)]
public static string method_2(string string_1)
{
    object[] array = Class01.method_03(0, new object[]
    {
        string_1
    }, null);
    return (string)array[0];
}

```

 

You didn't restore `awesome.Form01.method_1` at all.

There is it full devirtualized file

image.png.d118aadd750f4775017f16955d8b441d.png

awsome_unpacked.exe

 

SychicBoy

SychicBoy

7 hours ago, CreateAndInject said:

 I think @SychicBoy don't know anything about virtualization rather than @kao

@SychicBoy See `awesome.Form01.method_1`, it just call `awesome.Form01.method_2` which is  just the stub of DNR virtualization

```

// awesome.Form01
[MethodImpl(MethodImplOptions.NoInlining)]
public static string method_2(string string_1)
{
    object[] array = Class01.method_03(0, new object[]
    {
        string_1
    }, null);
    return (string)array[0];
}

```

 

You didn't restore `awesome.Form01.method_1` at all.

There is it full devirtualized file

awsome_unpacked.exe

 

×
×
  • Create New...