Jump to content
Tuts 4 You

ILVirtualization (Custom Scratch VM)

Go to solution Solved by BataBo,

Recommended Posts

ILVirtualization (Custom Scratch VM)


Difficulty : 4/10

Language : C# / .NET

Windows OS Version : All

Protection : ILVirtualization v1.0


Silver Medal: Clean Mutations.

Gold Medal: Devirtualize The Code.


Edited by CursedLand
  • Like 2
Link to comment
Share on other sites

  • Solution

In your assembly there is a field Interpreter.zC which contains virtualized version of il code.This is a field of type Dictionary<int,byte[]> and the int in there is an md token of the method so I knew which body corresponds to which method. Then I copy some code from your assembly to my devirtualizer. So then I convert body from byte[] to o(class name) then we have property L2 which contains a list of instructions.Instruction is of type x(also class name).One of the properties of x is p4 which indicates what op command that x is.With that info I can easily convert o to a list of cil instructions and in field xV there is additional info about the instruction if neccessery so if the instruction is ldstr filed xV will contain the string... ,then reconstruct the bodies, remove vm code and fix issues and that's it.

There is unpacked assembly below.

UnPackMe-ILV -Unpacked-Cleaned.exe

  • Like 4
Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Create New...