ILVirtualization (Custom Scratch VM)

PLEASE NOTE THIS NOT MODDED PUBLIC VM, THANKS

Difficulty : 4/10

Language : C# / .NET

Windows OS Version : All

Protection : ILVirtualization v1.0

Goals: 

Silver Medal: Clean Mutations.

Gold Medal: Devirtualize The Code.

File Information

Submitter CursedLand

Submitted 06/28/2021

Category UnPackMe (.NET)

View File

Edited July 2, 20214 yr by CursedLand

In your assembly there is a field Interpreter.zC which contains virtualized version of il code.This is a field of type Dictionary<int,byte[]> and the int in there is an md token of the method so I knew which body corresponds to which method. Then I copy some code from your assembly to my devirtualizer. So then I convert body from byte[] to o(class name) then we have property L2 which contains a list of instructions.Instruction is of type x(also class name).One of the properties of x is p4 which indicates what op command that x is.With that info I can easily convert o to a list of cil instructions and in field xV there is additional info about the instruction if neccessery so if the instruction is ldstr filed xV will contain the string... ,then reconstruct the bodies, remove vm code and fix issues and that's it.

There is unpacked assembly below.

UnPackMe-ILV -Unpacked-Cleaned.exe

Nicely Done !