Exetools  

Go Back   Exetools > General > General Discussion

Notices

 
 
Thread Tools Display Modes
Prev Previous Post   Next Post Next
  #1  
Old 08-19-2005, 17:04
SystemeD SystemeD is offline
Friend
 
Join Date: Dec 2004
Posts: 68
Rept. Given: 8
Rept. Rcvd 1 Time in 1 Post
Thanks Given: 0
Thanks Rcvd at 0 Times in 0 Posts
SystemeD Reputation: 1
Another .NET packer

Hi all,
Surfing on the web I found another .NET packer and I began to unpack it. Full and demo versions of the protector are packed by itself so I started from there.
I suggest you to unpack demo version because it's the same thing as the full one except that you can avoid license check. You can find it here:
hxxp://dotnetprotector.pvlog.com/

I have dumped the exe and all the other assemblies loaded at runtime in the following way:

1 - Hardware breakpoint in Olly at PEFile::Create in mscorwks.dll

2 - Once there, dump using the Dumper feature of IsDebuggerPresent plugin for Olly, with the value at esp+4 as start address and the one at esp+8 for size

Now the problem: everything works till the .cctor() method of a dll called "dotNetProtector.Special.dll" is called. There I receive a NullReference Object Error from the CLR.
I think that the problem is due to the fact that probably the packer loader sets something before calling the main exe, so removing it leaves some objects not instatiated. Any suggestion on what to do?
Thanks.
Reply With Quote
 


Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
sys packer emptyHook General Discussion 6 07-24-2012 19:46
First .NET packer? SystemeD General Discussion 16 06-05-2005 15:15
What packer would you use Fade General Discussion 35 04-03-2004 12:01


All times are GMT +8. The time now is 16:26.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )