Exetools - SMD For Agile

Page 3 of 6

Show 40 post(s) from this thread on one page

Exetools (https://forum.exetools.com/index.php)

- Community Tools (https://forum.exetools.com/forumdisplay.php?f=47)

- - SMD For Agile (https://forum.exetools.com/showthread.php?t=19219)

hp3	01-08-2024 15:51

@CodeCracker :

crash in unpacking exe and dll
test in win 7 - 32bit 64bit and win10 64bit and Net box
this maybe for files have virtualization ?

CodeCracker

01-08-2024 20:10

Quote:

crash in unpacking exe and dll

Please mark "No new Appdomain" option;
Error should be shown now. Let me know.

hp3	01-08-2024 20:49

exe and dll files unpack

3 Attachment(s)

this is error when try unpack exe and dll

CodeCracker

01-08-2024 22:30

Please send me a PM with all targets so I could check them.

hp3	01-08-2024 22:49

i think PM is close in forum

[email protected]
if u can send a mail and i will contact u on mail

CodeCracker

01-09-2024 00:52

share all targets here

Quote:

Originally Posted by hp3 (Post 129877)

i think PM is close in forum

Than please share all targets here.

embassy

02-29-2024 09:12

Hello! The provided executable gives the error message "Could not load file or assembly 'System.Net.Http ...' "
Below is the full callstack. To reproduce, you can use the decryptor on itself or other code, in a virtual machine (but I have the same result on my main machine) This is with the latest version.

Code:

************** Exception Text **************

System.IO.FileNotFoundException: Could not load file or assembly 'System.Net.Http, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a' or one of its dependencies. The system cannot find the file specified.

File name: 'System.Net.Http, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a'

   at Simple_MSIL_Decryptor.MainForm.SendToJit()

   at System.AppDomain.DoCallBack(CrossAppDomainDelegate callBackDelegate)

   at System.AppDomain.DoCallBack(CrossAppDomainDelegate callBackDelegate)

   at Simple_MSIL_Decryptor.MainForm.Button2Click(Object sender, EventArgs e)

   at System.Windows.Forms.Control.OnClick(EventArgs e)

chants

02-29-2024 17:49

Looks like you don't have a version of the .NET framework installed that it's specifically referencing.

congviet

02-29-2024 22:25

Missing reference files or the target is using a newer version of the .net framework

CodeCracker

06-10-2024 19:16

bug fixed version

SMD for AGILE bug fixed version: now should work.
https://workupload.com/file/6vbvr38yVZG

sendersu

06-10-2024 23:39

what bug(s) was(were) fixed?

th3tuga

06-11-2024 00:15

Quote:

Originally Posted by sendersu (Post 131094)

what bug(s) was(were) fixed?

The errors noted in posts #37 and #39 are now fixed.

CodeCracker

08-20-2024 22:46

SMD_FOR_AGILE_Fix2

1 Attachment(s)

SMD_FOR_AGILE_Fix2:
What's new:
- Now should work fine even on old Framework 4.0 version - with Netbox
- One more native counter patch for x86
- Re-enabled "Set .cctor body" for being able to send to jit more methods & .cctor methods are not being changed in unpacked exe for x86 version

CodeCracker

08-21-2024 23:00

SMD_FOR_AGILE_Fix3

1 Attachment(s)

SMD_FOR_AGILE_Fix3:
What's new:
- bugs fixed for x64
- now log methods not send to jit (old "undecrypted" count) plus how many methods are decrypted.

CodeCracker

11-25-2024 01:22

SMD_FOR_AGILE_Fix4

1 Attachment(s)

SMD_FOR_AGILE_Fix4:
What's new:
- more Framework supported for x64; maybe all of them I don't know yet
- added "LoadLibraryA hook" checkbox - this will transform from full path of Agile dll (temp path) to short name Agile dll - when you use this option Agile dll has to be in the current directory;
- "No SetAllowAutoRedirect" checkbox: - code - but it using reflection:
public static void SetAllowAutoRedirect()
{
HttpClient client = new HttpClient(new HttpClientHandler
{
AllowAutoRedirect = false
});

For x64 still something is missing, this is why I've set 32 Bit required for SMD for Agile and used the attached 32 bits dll AgileDotNetRTPro.dll. And I really miss debugger for AnyCpu assemblies - x64dbg fails:
and also an 64 bits hexeditor of process memory.

All times are GMT +8. The time now is 18:26.

Page 3 of 6

Last »

Show 40 post(s) from this thread on one page