Eazfuscator.NET v2025.01

File protected by eazfuscator v2025.01 having Code Virtualization enabled. Find registration combination and reply it with the success message!

File Information

Submitter whoknows

Submitted 07/22/2025

Category UnPackMe (.NET)

View File

Devirtualized except 0x06000128 cause of the homomorphic encryption.

WindowsFormsApplication41-devirt.exe

>Console.WriteLine("lZgvL~:R1f{Qj]o!");

 

hm hm

what does it mean

antidbg is quite nice

	internal static void smethod_1(bool bool_0)
	{
		if (bool_0)
		{
			smethod_0();
		}
		if (Debugger.IsLogging())
		{
			Environment.Exit(0);
		}
		if (Debugger.IsAttached)
		{
			Environment.Exit(0);
		}
		if (Environment.GetEnvironmentVariable("complus_profapi_profilercompatibilitysetting") != null)
		{
			Environment.Exit(0);
		}
		if (Environment.GetEnvironmentVariable("COR_ENABLE_PROFILING") == "1")
		{
			Environment.Exit(0);
		}
		if (Environment.OSVersion.Platform == PlatformID.Win32NT)
		{
			int[] array = new int[6];
			int int_ = 0;
			IntPtr handle = Process.GetCurrentProcess().Handle;
			if (NtQueryInformationProcess(handle, 31, array, 4u, ref int_) == 0 && array[0] != 1)
			{
				Environment.Exit(0);
			}
			if (NtQueryInformationProcess(handle, 30, array, 4u, ref int_) == 0 && array[0] != 0)
			{
				Environment.Exit(0);
			}
		}
	}

 

hi @Fr0Mu,

truly u took the pants off @ obfuscated.. . unfortunately not complete, here @ 

u miss 69 lines of code at ???...

which is the required ingredient to make the validation on registration code inputted at textboxes. on those lines used some classes, which already exist to deobbed and decrypted fine. Would like to say, even a cracker have ur deobbed, dont have the logic how to generate the registration code.

appreciate ur time.

=========================================

dont know what u mean by :

Devirtualized except 0x06000128 cause of the homomorphic encryption.

the specific method, virtualized as all the others. According to EAZ documentation :

Working in conjunction with virtualization, homomorphic encryption allows Eazfuscator.NET to achieve
the state of indistinguishable obfuscation for the *specific parts* of obfuscated programs.  #hmmm

Homomorphic encryption is automatically applied to all virtualized methods. 

 

ps : please next time tag me @whoknows to signalize me... (u know the board is old etc.. #LOL @Teddy Rogers)

 

@jackyjask - what else, CodeExplorer

 

Edited Friday at 10:34 AM3 days by whoknows
adding Fr0Mu question

1 hour ago, whoknows said:

hi @Fr0Mu,

truly u took the pants off @ obfuscated.. . unfortunately not complete, here @ 

u miss 69 lines of code at ???...

which is the required ingredient to make the validation on registration code inputted at textboxes. on those lines used some classes, which already exist to deobbed and decrypted fine. Would like to say, even a cracker have ur deobbed, dont have the logic how to generate the registration code.

appreciate ur time.

=========================================

dont know what u mean by :

Devirtualized except 0x06000128 cause of the homomorphic encryption.

the specific method, virtualized as all the others. According to EAZ documentation :

Working in conjunction with virtualization, homomorphic encryption allows Eazfuscator.NET to achieve
the state of indistinguishable obfuscation for the *specific parts* of obfuscated programs.  #hmmm

Homomorphic encryption is automatically applied to all virtualized methods. 

 

ps : please next time tag me @whoknows to signalize me... (u know the board is old etc.. #LOL @Teddy Rogers)

 

@jackyjask - what else, CodeExplorer

 

https://blog.gapotchenko.com/eazfuscator.net/homomorphic-encryption-of-code

"The data encryption guarantees that data remains unobservable unless an observer knows the key. The key is selected to be a large enough number (or blob of data) that is extremely hard (i.e. impossible) to brute force."

if (Hash(input) == hash) {
    RunInstructions(key: input); //Decrypts and runs VM Instructions according to the given output (Just a representative example)
}

So, my tool has no support for homomorphic encryption, the only way is brute-force and god knows how long will it take.. it's rare in a software protected with eazfuscator though.

@whoknows

Edited Friday at 11:25 AM3 days by Fr0Mu

thanks for the link, temporary I mark it as solution, but would like to tell to others :

 

IS NOT SOLVED

from my understandings the key point here is the IndistinguishableDictionary mentioned at the link.

Completely unpacked.

unpacked.exe

Edited Friday at 07:03 PM3 days by CreateAndInject

@CreateAndInject great success, assuming without @Fr0Mu unpacked will be not possible before ah?

thank you both for your time.

 

@others - valid serial 

Quote

2537-3826-1549-7215

 

11 minutes ago, whoknows said:

@CreateAndInject great success, assuming without @Fr0Mu unpacked will be not possible before ah?

thank you both for your time.

 

@others - valid serial 

 

@everyone

Can you please write step by step guide tutorials if you solve these kind of problems, so other people get helped by your efforts.

No meaning jobs, just showing off.

But this is not obligation. your choice for helping others learn.

Regards.

sean.

3 hours ago, lovejoy226 said:

@everyone

Can you please write step by step guide tutorials if you solve these kind of problems, so other people get helped by your efforts.

No meaning jobs, just showing off.

But this is not obligation. your choice for helping others learn.

Regards.

sean.

This ^^

Thanks

8 hours ago, whoknows said:

@CreateAndInject great success, assuming without @Fr0Mu unpacked will be not possible before ah?

thank you both for your time.

 

@others - valid serial 

 

Why? I don't depend on anyone.

Edited Saturday at 12:47 PM2 days by CreateAndInject

@CreateAndInject

thought that u missed a piece of the puzzle that @Fr0Mu offered you...