DNGuard HVM v4.94

Hey,

Dropping my second UnpackMe challenge, made just for fun. This one’s a bit tougher than my first, but still very doable. The goal is to unpack and analyze the binary and reach the success message. Cracking it is extra, not required.

It’s a simple .NET WinForms app that asks for a password and shows “Access granted” when the condition is met. The UI is trivial, the focus is on what’s happening once protections kick in.

Protected with DNGuard HVM Enterprise. Source code, compiler-generated code, constructors, strings, managed resources, and blob heaps are encrypted. HVM and HVM II are both enabled at level 5, with proxy methods and additional runtime protections. Metadata is obfuscated, name heaps are destroyed, automatic renaming and dynamic control flow obfuscation are enabled, and basic anti-dump and anti-static measures are in place.

The password is not stored in plaintext. Verification is done against a SHA-256 hex hash (PasswordSha256Hex). If you want to reverse or bypass that, that’s the crack portion and optional.

Screenshots show the app and protection settings used.

File Information

Submitter Visual Studio

Submitted 12/13/2025

Category UnPackMe (.NET)

View File

Do you accept crack without unpacking the target?

Just patching :)

Edited yesterday at 02:24 PM1 day by Sh4DoVV

Basically it works like this,your input gets hased and compared to stored hashed thats inside crackme.

Stored hash is : 97328946466865e882e741277903962e7f1ca9cbb4e71948d740bbd38f702f3c <- crackmes hash.

To patch application put bp on MessageBoxW and check the call stack.

The address in my case is the second one on the call stack:

097044E3 - 8B CE - mov ecx,esi

From this address scroll up and you will see :

097044A7 - 74 10 - je 097044B9

097044A9 - C6 05 744ED005 01 - mov byte ptr [05D04E74],01 { (0),1 }

097044B0 - 8B CE - mov ecx,esi

097044B2 - E8 CDE96500 - call 09D62E84

097044B7 - EB 2A - jmp 097044E3

097044B9 - C6 05 744ED005 00 - mov byte ptr [05D04E74],00 { (0),0 }

Patch the first one 097044A7 - 74 10 - je 097044B9 to jne 097044B9 and that should be it.

It was interesting 😅

UnpackMe.Dumped.exe UnpackMe.Unpacked.exe

Edited 21 hours ago21 hr by 0xFFFFDAY

1 hour ago, 0xFFFFDAY said:

挺有意思的😅

<font dir="auto" style="vertical-align: inherit;"><font dir="auto" style="vertical-align: inherit;">UnpackMe.Dumped.exe</font></font> <font dir="auto" style="vertical-align: inherit;"><font dir="auto" style="vertical-align: inherit;">UnpackMe.Unpacked.exe</font></font>

so awesome

So we're supposed to brute-force the SHA-256?

return !string.IsNullOrEmpty(input) && Form1.FixedTimeEquals(Form1.ComputeSha256Hex(input), "97328946466865e882e741277903962e7f1ca9cbb4e71948d740bbd38f702f3c");