![]() |
|
#1
|
|||
|
|||
|
Another .NET packer
Hi all,
Surfing on the web I found another .NET packer and I began to unpack it. Full and demo versions of the protector are packed by itself so I started from there. I suggest you to unpack demo version because it's the same thing as the full one except that you can avoid license check. You can find it here: hxxp://dotnetprotector.pvlog.com/ I have dumped the exe and all the other assemblies loaded at runtime in the following way: 1 - Hardware breakpoint in Olly at PEFile::Create in mscorwks.dll 2 - Once there, dump using the Dumper feature of IsDebuggerPresent plugin for Olly, with the value at esp+4 as start address and the one at esp+8 for size Now the problem: everything works till the .cctor() method of a dll called "dotNetProtector.Special.dll" is called. There I receive a NullReference Object Error from the CLR. I think that the problem is due to the fact that probably the packer loader sets something before calling the main exe, so removing it leaves some objects not instatiated. Any suggestion on what to do? Thanks. |
| Thread Tools | |
| Display Modes | |
|
|
Similar Threads
|
||||
| Thread | Thread Starter | Forum | Replies | Last Post |
| sys packer | emptyHook | General Discussion | 6 | 07-24-2012 19:46 |
| First .NET packer? | SystemeD | General Discussion | 16 | 06-05-2005 15:15 |
| What packer would you use | Fade | General Discussion | 35 | 04-03-2004 12:01 |