Jump to content
Tuts 4 You

.NET Reactor v7.3


Go to solution Solved by CreateAndInject,

Recommended Posts

Posted

.NET Reactor v7.3


File protected by .NET Reactor v7.3 having /Code Virtualization/ enabled. By nature the application using /Dependency Injection/, the 3rd party files embedded to main exe (see shot2). Find registration combination and reply it with the success message!


 

  • Like 1
  • Solution
CreateAndInject
Posted

image.png.7e42f0024352e66c8d9a3956a5141295.png

  • Like 2
CodeExplorer
Posted (edited)

>    WindowsFormsApplication37_Slayed.exe!WindowsFormsApplication37.Internal.PolicyFinalizer.VisualContainerPolicy.CombineTransaction(WindowsFormsApplication37.Internal.PolicyFinalizer.ArgumentViewer instance) (IL=0x2260, Native=0x091A0040+0x6B85)

                case (PolicyFinalizer.NotificationCall)128:
                    if (PolicyFinalizer.m_PolicySenderList.Count == 0)
                    {
                        Module module = typeof(PolicyFinalizer).Module;
                        this.m_ClientEvaluator.IncludeManager(new PolicyFinalizer.PolicyFinder(module.ResolveString((int)this.m_CustomDecryptorPolicyObj | 1879048192)));
                        return;
                    }

70000000
metadataToken    0x7000174A    int

 - metadataToken of good string: 0x700016DE

but it is not easy as replacing a string- it is not working after changing string.
 

Edited by CodeExplorer
  • Like 1

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...