Thinstall unpacking

[peleon]

I havent had a deep look at Thinstall internally....but my few tests tell me that it leaves the EXE almost untouched when decrypted, so you can make a dump (by regions) and construct the original EXE without suffering much

It's true that they use a local file system inside the EXE and that makes .NET application to be run without problems after protecting (no mangling any structures)...but, well, I think this is another story....