Reverse Engineering RET Homepage RET Members Reverse Engineering Projects Reverse Engineering Papers Reversing Challenges Reverser Tools RET Re-Search Engine Reverse Engineering Forum Reverse Engineering Links

Go Back   Reverse Engineering Team Board > Reverse Engineering Board > .NET Reverse Engineering
FAQ Members List Calendar Search Today's Posts Mark Forums Read

Reply
 
Thread Tools Display Modes
  #1  
Old 05-03-2008, 06:26 AM
bigmouse bigmouse is offline
Senior Member
 
Join Date: Sep 2007
Posts: 125
Default .Net Reactor Unpacker, (for library mode only)

after unpack, use my .Net Assembly Rebuilder to rebuild the unpacked assembly.

download:
http://momupload.com/files/92257/Rea...acker.rar.html
__________________
interest in .NET Reverse Engineering.
Blog: http://jithook.blogspot.com/

.Net Assembly Rebuilder - a tool to rebuild dumped assemblies.
Re-Max - a tool to unpack maxtocode protected assemblies.
Reply With Quote
  #2  
Old 05-03-2008, 07:04 AM
tankaiha tankaiha is offline
Member
 
Join Date: May 2007
Posts: 30
Default

great job!

an advice, add log message function, so we know what's going on when the unpacker does not response.
Reply With Quote
  #3  
Old 05-03-2008, 07:52 AM
Andu Andu is offline
Member
 
Join Date: Apr 2008
Posts: 46
Default

Wow!

Bigmouse you did it again!

Now I have to look for another solution

Anyway, it's better to know beforehand than after, isn't it

Regards,

Andu
Reply With Quote
  #4  
Old 05-03-2008, 08:21 AM
tankaiha tankaiha is offline
Member
 
Join Date: May 2007
Posts: 30
Default

i get an half finished solution, by jit hook.
i use reflection+invoke, then catch the msil from jit. but i can only get all methods except .ctor and .cctor.
when invoke constructors and static constructors, always get exception.
still don't know how to solve this poblem. hope bigmouse can help
Reply With Quote
  #5  
Old 05-03-2008, 08:28 AM
bigmouse bigmouse is offline
Senior Member
 
Join Date: Sep 2007
Posts: 125
Default

Quote:
Originally Posted by tankaiha View Post
i get an half finished solution, by jit hook.
i use reflection+invoke, then catch the msil from jit. but i can only get all methods except .ctor and .cctor.
when invoke constructors and static constructors, always get exception.
still don't know how to solve this poblem. hope bigmouse can help
System.Activator.CreateInstance will invoke .ctor internal.
and also .cctor will be invoked impliedly
__________________
interest in .NET Reverse Engineering.
Blog: http://jithook.blogspot.com/

.Net Assembly Rebuilder - a tool to rebuild dumped assemblies.
Re-Max - a tool to unpack maxtocode protected assemblies.
Reply With Quote
  #6  
Old 05-03-2008, 08:34 AM
Andu Andu is offline
Member
 
Join Date: Apr 2008
Posts: 46
Default

Hey bigmouse,

maybe you want to give the developer of .Net Reactor some tips how he can harden his protection. I'm almost confident that he's aware of this discussion

Regards,

Andu
Reply With Quote
  #7  
Old 05-03-2008, 08:24 AM
bigmouse bigmouse is offline
Senior Member
 
Join Date: Sep 2007
Posts: 125
Default

its library mode decrypted the whole assembly at once.
the only problem is , after decrypted, its also wiped some header values.
we can use disk image to fixthe memory image .
after fixed, dump memory section.

seems to .net reactor itself using a diffent protection type.
it only decrypt one type each time, but also can by easily unpacked.

here is the unpacked file of its latest version v3.7.9.1
http://www.filesend.net/download.php...7e8d91d8892519
__________________
interest in .NET Reverse Engineering.
Blog: http://jithook.blogspot.com/

.Net Assembly Rebuilder - a tool to rebuild dumped assemblies.
Re-Max - a tool to unpack maxtocode protected assemblies.
Reply With Quote
  #8  
Old 08-27-2008, 12:25 AM
peterg peterg is offline
Member
 
Join Date: Aug 2008
Posts: 7
Default

Quote:
Originally Posted by bigmouse View Post
after unpack, use my .Net Assembly Rebuilder to rebuild the unpacked assembly.

download:
http://momupload.com/files/92257/Rea...acker.rar.html
What is it mean "Library mode only" ? pls.
Reply With Quote
Reply


Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Forum Jump





Powered by vBulletin® Version 3.6.4
Copyright ©2000 - 2021, Jelsoft Enterprises Ltd.