Exetools

Exetools (https://forum.exetools.com/index.php)
-   Community Tools (https://forum.exetools.com/forumdisplay.php?f=47)
-   -   VMProtectNoDelegates (.NET) (https://forum.exetools.com/showthread.php?t=21106)

CodeCracker 10-04-2024 17:15

VMProtectNoDelegates (.NET)
 
1 Attachment(s)
VMProtectNoDelegates (.NET):
- Clean delegates of VMProtect .NET

You will need to use DeMutation first:
https://github.com/xlfj5211/DeMutation
https://forum.exetools.com/showthread.php?t=21105
https://forum.tuts4you.com/topic/45162-demutation-vmprotect-net/

I only tested on 1 sample so let me know if you find bugs.

Sh4DoVV 10-05-2024 01:31

Hi CodeCracker
Please upload in mega or other uploading site

JMP-JECXZ 10-05-2024 17:26

mega link:
Code:

https://mega.nz/file/jkUURIBC#F9yiaqB4-uIadimY_9nubGZUOh49vZDQg-m8R5Kjs-Y
DeMutation: https://mega.nz/file/Hws3QRyA#vZ-LMZDpMOeAKcc2zK_I4Oo53ysgvUghU6FPTXQBtEA


Samoray 10-05-2024 19:59

Quote:

Originally Posted by Sh4DoVV (Post 131886)
Hi CodeCracker
Please upload in mega or other uploading site

CodeCracker shares his work on the tuts4you forum also.
You can head over there to download all the same attachments instead of asking for a re-upload here...
That's the fastest way.

CodeCracker 01-21-2025 21:02

VMProtectNoDelegates_Fixed1
 
1 Attachment(s)
VMProtectNoDelegates_Fixed1:
What's new:
- Added DynamicILInfo checkbox;
- Added "No Environment.Exit" to Patch Environment.Exit(int) and "Patch HWID.IsCorrect" so will work for this target
https://forum.tuts4you.com/topic/43262-vmprotect-v351 when the message is showed just click Ok, I choose not to patch the message showing.
- Added "Preserve All" checkbox to preserve tables.

CodeCracker 10-12-2025 18:03

VMProtectNoDelegates_Fixed2
 
1 Attachment(s)
VMProtectNoDelegates_Fixed2:
What's new:
- Added "Native Save"
- now also decrypt ldsfld instructions (Fields) not only methods;
- fixed various bugs

CodeCracker 05-30-2026 03:44

VMProtectNoDelegatesFixed4
 
1 Attachment(s)
VMProtectNoDelegatesFixed4:
- Fixed a very bogus bug, it has to with instruction opcode newobj detection;


All times are GMT +8. The time now is 11:47.

Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2026, vBulletin Solutions, Inc.
Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX