.Net Reactor Unpacker, (for library mode only)

[bigmouse]

after unpack, use my .Net Assembly Rebuilder to rebuild the unpacked assembly.

download:
http://momupload.com/files/92257/Rea...acker.rar.html

[tankaiha]

great job!

an advice, add log message function, so we know what's going on when the unpacker does not response.

[Andu]

Wow!

Bigmouse you did it again!

Now I have to look for another solution

Anyway, it's better to know beforehand than after, isn't it

Regards,

Andu

[tankaiha]

i get an half finished solution, by jit hook.
i use reflection+invoke, then catch the msil from jit. but i can only get all methods except .ctor and .cctor.
when invoke constructors and static constructors, always get exception.
still don't know how to solve this poblem. hope bigmouse can help

[bigmouse]

Originally Posted by tankaiha

i get an half finished solution, by jit hook.
i use reflection+invoke, then catch the msil from jit. but i can only get all methods except .ctor and .cctor.
when invoke constructors and static constructors, always get exception.
still don't know how to solve this poblem. hope bigmouse can help

System.Activator.CreateInstance will invoke .ctor internal.
and also .cctor will be invoked impliedly

[Andu]

Hey bigmouse,

maybe you want to give the developer of .Net Reactor some tips how he can harden his protection. I'm almost confident that he's aware of this discussion

Regards,

Andu

[bigmouse]

its library mode decrypted the whole assembly at once.
the only problem is , after decrypted, its also wiped some header values.
we can use disk image to fixthe memory image .
after fixed, dump memory section.

seems to .net reactor itself using a diffent protection type.
it only decrypt one type each time, but also can by easily unpacked.

here is the unpacked file of its latest version v3.7.9.1
http://www.filesend.net/download.php...7e8d91d8892519

[peterg]

Originally Posted by bigmouse

after unpack, use my .Net Assembly Rebuilder to rebuild the unpacked assembly.

download:
http://momupload.com/files/92257/Rea...acker.rar.html

What is it mean "Library mode only" ? pls.