ILVirtualization (Custom Scratch VM)

[CursedLand]

View File

ILVirtualization (Custom Scratch VM)

---

PLEASE NOTE THIS NOT MODDED PUBLIC VM, THANKS

Difficulty : 4/10

Language : C# / .NET

Windows OS Version : All

Protection : ILVirtualization v1.0

Goals: 

Silver Medal: Clean Mutations.

Gold Medal: Devirtualize The Code.

---

• Submitter
  CursedLand
• Submitted
  06/28/2021
• Category
  UnPackMe (.NET)

 

Edited July 2, 2021 by CursedLand

[BataBo]

In your assembly there is a field Interpreter.zC which contains virtualized version of il code.This is a field of type Dictionary<int,byte[]> and the int in there is an md token of the method so I knew which body corresponds to which method. Then I copy some code from your assembly to my devirtualizer. So then I convert body from byte[] to o(class name) then we have property L2 which contains a list of instructions.Instruction is of type x(also class name).One of the properties of x is p4 which indicates what op command that x is.With that info I can easily convert o to a list of cil instructions and in field xV there is additional info about the instruction if neccessery so if the instruction is ldstr filed xV will contain the string... ,then reconstruct the bodies, remove vm code and fix issues and that's it.

There is unpacked assembly below.

UnPackMe-ILV -Unpacked-Cleaned.exe

[CursedLand]

Nicely Done !