whoknows Posted October 23, 2021 Posted October 23, 2021 View File VMProtect v3.5.1 Hi all, This is a protected with the TRIAL edition... Mutation / Virtualization w/ the built in VMProtect license system. VMProtect Debugger detection - disabled. (apparently some C# lines added) VMProtect Trial limitation : user has to patch the file to run to his machine. There are 2 enter serial dialogs, once you solve the 1st, drives you to 2nd, when a valid serial entered exporting a file... If a valid serial entered on 1st form, is saved to license.diz file. Submitter whoknows Submitted 10/07/2021 Category UnPackMe (.NET) 1
Hadits follower Posted September 27 Posted September 27 the exe is not running in my machine , do u have some v3.5 full version protected vm method little sample files
CodeExplorer Posted September 27 Posted September 27 1 hour ago, Hadits follower said: the exe is not running in my machine , do u have some v3.5 full version protected vm method little sample files On 10/23/2021 at 3:15 AM, whoknows said: VMProtect Trial limitation : user has to patch the file to run to his machine. 1
Hadits follower Posted September 27 Posted September 27 hi, thanks but the problem i have failed to do that . i think i need some vmprotect v3.5 full version protected sample little tinny files , which wheres some method have vm marked , actually v3.5 main vm method have perams and also cleaning 0600001 exe after the exe run and also have something which i can not explain in english . 1
Hadits follower Posted September 27 Posted September 27 (edited) if anyone have vmp marked methods v3.5 full version protected sample little test files , please post those files if possible , thank u all very much : Edited September 27 by Hadits follower 1
Hadits follower Posted September 27 Posted September 27 (edited) just protect some files in minimum label without cflow marked , and vm all methods, everything should be by v3.5 , thats it , i will try to learn something from it , thank you too much Edited September 27 by Hadits follower 1
whoknows Posted September 27 Author Posted September 27 @Hadits follower dn 473kb @: https://download.ru/files/wzwPRCwM made by : VMProtect Ultimate v3.5.0.1213-WEB0DAY VMProtect Ultimate v3.5.1.1399-crk 1
CodeExplorer Posted October 2 Posted October 2 de4vmp - VMProtect unvirtualizer: https://github.com/chickenienRE/de4vmp Demutation https://github.com/xlfj5211/DeMutation For MSIL decryption SMD_for_agile can be used. I didn't complete yet the challenge. 2
CodeExplorer Posted October 15 Posted October 15 WindowsFormsApplication4.vmp35.exe: 1. VMUnprotect.Dumper https://github.com/void-stack/VMUnprotect.Dumper/releases/tag/1.1.0.0 2. Unset "IL Only" Flag from .NET Directory with CFF Explorer 3. Demutation Tool https://forum.tuts4you.com/topic/45162-demutation-vmprotect-net https://forum.exetools.com/showthread.php?t=21105 4. de4dot Use --keep-names ntpfg while cleaning the file using de4dot Or use --dont-rename 5. VMP Killer by DarkBullNull Use Option 2 First and Fix CRC and Debug Check https://github.com/DarkBullNull/VMP.NET-Kill https://forum.tuts4you.com/topic/45179-vmpnet-kill/ https://forum.exetools.com/showthread.php?p=131964 6. Unset "IL Only" Flag from .NET Directory with CFF Explorer 7. Use VMProtectNoDelegates to clean delegates https://forum.exetools.com/showthread.php?t=21106 https://forum.tuts4you.com/topic/45163-vmprotectnodelegates-net The only thing left if unvirtualization. WindowsFormsApplication4.vmp35-decrypted-demutate-cleaned.justify_nodel.rar 5 1
whoknows Posted November 30 Author Posted November 30 (edited) for the moment I mark @CodeExplorer reply as solution, still needs @Washi / @BlackHat touch for devirtualization! [EDIT] the CC attached, is another release is not this thread. Edited November 30 by whoknows 1
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now