VirBoxDynamicRestore

[CodeCracker]

VirBoxDynamicRestore:
Restore dynamic method of VirBox protector;
you should first unpack the file with SMD : https://forum.tuts4you.com/topic/41297-smd-for-agile/page/6/#findComment-224015
https://forum.exetools.com/showthread.php?t=19219&page=5

VirBoxDynamicRestore is a console program; it has as parameter the file to be unpacked;
Output will be created in originalAssemblynodynamic

[CodeCracker]

VirBoxNoDelegates - the tool attached.
- proxy call restore tool for VirBox.
- Use last one: after SMD and VirBoxDynamicRestore

[CodeCracker]

Framework 4.7 - 4.8.1 should work fine; but unfortunately there is a dnlib import field bug.
dnlib 3.2.0 still has bugs. So I've upgraded to dnlib 3.3.2.0 - from de4dot reactor 6.7 where this bug is gone.
Here is fixed 2 release.

[CodeCracker]

VirBoxDynamicRestoreFr2:
- This is specially build for .NET framework 2.0; for other Frameworks can;t be used
- new parameter for this program: specify -nativesave to native save with dnlib

Download link:
https://workupload.com/file/gBxTHPFdAd2

[CodeCracker]

VirBoxNoDelegatesFr2:
- This is specially build for .NET framework 2.0; for other Frameworks can't be used
- Added "Native Save" checkbox to native save with dnlib

[CodeCracker]

New: Updated VirBoxDynamicRestore to native save the module so will run after unpacking.

[CodeCracker]

VirBoxDynamicRestore:
- NativeSave and NoThrow Instance.

[鯀禹i]

Originally Posted by CodeCracker

VirBoxDynamicRestore:
- NativeSave and NoThrow Instance.

Originally Posted by CodeCracker

Framework 4.7 - 4.8.1 should work fine; but unfortunately there is a dnlib import field bug.
dnlib 3.2.0 still has bugs. So I've upgraded to dnlib 3.3.2.0 - from de4dot reactor 6.7 where this bug is gone.
Here is fixed 2 release.

Thanks CodeCracker for the tool info (dnlib 3.3.2.0, Fixed 2, NativeSave/NoThrow).

I'm hitting a VirBox [V]-virtualized method and can't recover its real IL. The details:

1. The registration-check method's metadata body is just a stub:
ldstr "Runtime exception"; newobj Exception; throw
So it's protected by VirBox's [V] virtualization (VM interpreter + JIT-encrypted).

2. I can load the assembly and invoke the method by reflection — it runs (the VirBox
VM executes the real logic) and returns false for an invalid registration code, but
I CANNOT read the underlying algorithm from the IL.

3. I also wrote a CLR profiler (ICorProfilerCallback2/Info2, SetILFunctionBody at JIT
time, COR_PRF_MONITOR_JIT_COMPILATION) and can force methods to return fixed values,
which lets me override the check — but that doesn't recover the real algorithm.

MAIN BLOCKER — download permission:
- I tried to download VirBoxDynamicRestore.rar (attachmentid=10755, and the
NativeSave / NativeSave&NoThrow variants) from this thread, but my forum account
(a brand-new one) gets "you do not have permission to access this page" — the
attachment download requires a higher user level / post count that I don't have yet.

Could anyone please:
1. Upload the tools to a mirror (or post a direct link that doesn't require the
attachment-download permission)? — VirBoxDynamicRestore_Fixed2.rar, and if possible
the SMD unpacker needed first, would be ideal.
2. Or confirm the correct usage flow: is it "SMD unpack the file, then run
VirBoxDynamicRestore <file>, output in originalAssembly\nodynamic"?
3. And for the [V] VM-interpreter case, does NativeSave work or do I need the NoThrow
variant?

Happy to provide the sample method signature (static bool SisterS(string, string, out
string)) if that helps anyone. Thanks in advance for any help — I'm really stuck on
the download permission and would appreciate a mirror or link.

[chants]

So a simple search indicates CodeCracker has provided the same files on tuts4you. You should edit your post to remove any discussion about the download not working or requesting it as per forum rules. Otherwise a download-rule-Nazi might report you .