@atzplzw
Remotesoft Salamander crypts your original IL (and store it encrypted in PE) and only at run-time (when JIT is invoked) code is decrypted on the fly and executed ...
JIT hooking and decryption are handled by a native DLL shipped with any protected program (name can vary but you can find RemoteSoft copyright in File Info :P) .
For version 3.5 I analyzed, the process isn't too hard .... just need to understand a little bit of Windows Crypto API and trace a bit (more
) to find where location and size of every method is stored ... there is no IL translated in ASM
Best Regards,
Tony