Exetools  

Go Back   Exetools > General > Community Tools

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 10-04-2024, 17:15
CodeCracker CodeCracker is offline
VIP
 
Join Date: Jun 2011
Posts: 905
Rept. Given: 68
Rept. Rcvd 660 Times in 278 Posts
Thanks Given: 64
Thanks Rcvd at 3,819 Times in 717 Posts
CodeCracker Reputation: 500-699 CodeCracker Reputation: 500-699 CodeCracker Reputation: 500-699 CodeCracker Reputation: 500-699 CodeCracker Reputation: 500-699 CodeCracker Reputation: 500-699
VMProtectNoDelegates (.NET)

VMProtectNoDelegates (.NET):
- Clean delegates of VMProtect .NET

You will need to use DeMutation first:
https://github.com/xlfj5211/DeMutation
https://forum.exetools.com/showthread.php?t=21105
https://forum.tuts4you.com/topic/45162-demutation-vmprotect-net/

I only tested on 1 sample so let me know if you find bugs.
Attached Files
File Type: rar VMProtectNoDelegates.rar (465.5 KB, 40 views)

Last edited by CodeCracker; 10-04-2024 at 19:36.
Reply With Quote
The Following User Gave Reputation+1 to CodeCracker For This Useful Post:
Dr.FarFar (10-06-2024)
The Following 16 Users Say Thank You to CodeCracker For This Useful Post:
ahmadmansoor (10-16-2024), alekine322 (04-12-2025), besoeso (10-05-2024), blue_devil (10-04-2024), canopus (10-21-2025), Doit (10-05-2024), Dr.FarFar (10-06-2024), Gyrus (10-06-2024), MarcElBichon (10-04-2024), niculaita (10-05-2024), NoneForce (10-05-2024), SofTw0rm (10-05-2024), tonyweb (10-06-2024), uranus64 (10-04-2024), user_hidden (10-04-2024), yoza (04-23-2025)
  #2  
Old 10-05-2024, 01:31
Sh4DoVV Sh4DoVV is offline
Friend
 
Join Date: Sep 2023
Posts: 45
Rept. Given: 1
Rept. Rcvd 4 Times in 4 Posts
Thanks Given: 17
Thanks Rcvd at 78 Times in 17 Posts
Sh4DoVV Reputation: 4
Hi CodeCracker
Please upload in mega or other uploading site
Reply With Quote
  #3  
Old 10-05-2024, 17:26
JMP-JECXZ JMP-JECXZ is offline
Friend
 
Join Date: Mar 2017
Posts: 123
Rept. Given: 0
Rept. Rcvd 5 Times in 4 Posts
Thanks Given: 15
Thanks Rcvd at 150 Times in 69 Posts
JMP-JECXZ Reputation: 5
mega link:
Code:
https://mega.nz/file/jkUURIBC#F9yiaqB4-uIadimY_9nubGZUOh49vZDQg-m8R5Kjs-Y
DeMutation: https://mega.nz/file/Hws3QRyA#vZ-LMZDpMOeAKcc2zK_I4Oo53ysgvUghU6FPTXQBtEA
Reply With Quote
The Following User Says Thank You to JMP-JECXZ For This Useful Post:
Doit (10-07-2024)
  #4  
Old 10-05-2024, 19:59
Samoray Samoray is offline
Friend
 
Join Date: Oct 2023
Posts: 8
Rept. Given: 0
Rept. Rcvd 2 Times in 2 Posts
Thanks Given: 0
Thanks Rcvd at 2 Times in 2 Posts
Samoray Reputation: 2
Quote:
Originally Posted by Sh4DoVV View Post
Hi CodeCracker
Please upload in mega or other uploading site
CodeCracker shares his work on the tuts4you forum also.
You can head over there to download all the same attachments instead of asking for a re-upload here...
That's the fastest way.
Reply With Quote
The Following User Gave Reputation+1 to Samoray For This Useful Post:
CodeCracker (10-06-2024)
The Following User Says Thank You to Samoray For This Useful Post:
CodeCracker (10-06-2024)
  #5  
Old 01-21-2025, 21:02
CodeCracker CodeCracker is offline
VIP
 
Join Date: Jun 2011
Posts: 905
Rept. Given: 68
Rept. Rcvd 660 Times in 278 Posts
Thanks Given: 64
Thanks Rcvd at 3,819 Times in 717 Posts
CodeCracker Reputation: 500-699 CodeCracker Reputation: 500-699 CodeCracker Reputation: 500-699 CodeCracker Reputation: 500-699 CodeCracker Reputation: 500-699 CodeCracker Reputation: 500-699
VMProtectNoDelegates_Fixed1

VMProtectNoDelegates_Fixed1:
What's new:
- Added DynamicILInfo checkbox;
- Added "No Environment.Exit" to Patch Environment.Exit(int) and "Patch HWID.IsCorrect" so will work for this target
https://forum.tuts4you.com/topic/43262-vmprotect-v351 when the message is showed just click Ok, I choose not to patch the message showing.
- Added "Preserve All" checkbox to preserve tables.
Attached Files
File Type: rar VMProtectNoDelegates_Fixed1.rar (1.06 MB, 42 views)
Reply With Quote
The Following 2 Users Gave Reputation+1 to CodeCracker For This Useful Post:
MarcElBichon (01-21-2025), wx69wx2023 (01-22-2025)
The Following 8 Users Say Thank You to CodeCracker For This Useful Post:
alekine322 (04-12-2025), Apuromafo (01-23-2025), darkBLACK (01-25-2025), SofTw0rm (01-22-2025), user_hidden (01-21-2025), wilson bibe (01-22-2025), wx69wx2023 (01-22-2025), Zeokat (01-22-2025)
  #6  
Old 10-12-2025, 18:03
CodeCracker CodeCracker is offline
VIP
 
Join Date: Jun 2011
Posts: 905
Rept. Given: 68
Rept. Rcvd 660 Times in 278 Posts
Thanks Given: 64
Thanks Rcvd at 3,819 Times in 717 Posts
CodeCracker Reputation: 500-699 CodeCracker Reputation: 500-699 CodeCracker Reputation: 500-699 CodeCracker Reputation: 500-699 CodeCracker Reputation: 500-699 CodeCracker Reputation: 500-699
VMProtectNoDelegates_Fixed2

VMProtectNoDelegates_Fixed2:
What's new:
- Added "Native Save"
- now also decrypt ldsfld instructions (Fields) not only methods;
- fixed various bugs
Attached Files
File Type: rar VMProtectNoDelegates_Fixed2.rar (1.35 MB, 23 views)
Reply With Quote
The Following User Gave Reputation+1 to CodeCracker For This Useful Post:
Apuromafo (10-12-2025)
The Following 10 Users Say Thank You to CodeCracker For This Useful Post:
Apuromafo (10-12-2025), computerline (10-13-2025), Fyyre (10-16-2025), Hypnz (10-14-2025), user_hidden (10-12-2025), wilson bibe (10-13-2025), wx69wx2023 (10-14-2025), Zeokat (10-12-2025), zionoobie (10-21-2025)
  #7  
Old 05-30-2026, 03:44
CodeCracker CodeCracker is offline
VIP
 
Join Date: Jun 2011
Posts: 905
Rept. Given: 68
Rept. Rcvd 660 Times in 278 Posts
Thanks Given: 64
Thanks Rcvd at 3,819 Times in 717 Posts
CodeCracker Reputation: 500-699 CodeCracker Reputation: 500-699 CodeCracker Reputation: 500-699 CodeCracker Reputation: 500-699 CodeCracker Reputation: 500-699 CodeCracker Reputation: 500-699
VMProtectNoDelegatesFixed4

VMProtectNoDelegatesFixed4:
- Fixed a very bogus bug, it has to with instruction opcode newobj detection;
Attached Files
File Type: rar VMProtectNoDelegatesFixed4.rar (1.82 MB, 17 views)
Reply With Quote
The Following User Says Thank You to CodeCracker For This Useful Post:
wilson bibe (05-30-2026)
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



All times are GMT +8. The time now is 06:24.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )