darkbullnull / vmp.net-kill Goto Github PK

Good sir, best regards for Christmas Eve, I tell you that I have tried several software and crackme in a didactic way and the algorithm of decrypting string and metadata does not work

https://www.4shared.com/video/-1rdcxDoea/Vmprotect_cleaner.html

Hello friend, will you add, devirtualize, and restore methods?

CRC-check bypassing...

Unhandled Exception: Microsoft.CSharp.RuntimeBinder.RuntimeBinderException: Cannot perform runtime binding on a null reference
at CallSite.Target(Closure , CallSite , Object )
at System.Dynamic.UpdateDelegates.UpdateAndExecute1[T0,TRet](CallSite site, T0 arg0)
at VMPKiller.AntiTricks.AntiDebug(ModuleDefMD& moduleDef, String folderPathFile)
at VMPKiller.Controller..ctor(ModuleDefMD& moduleDef, String pathFile, Int32 userParams)
at VMPKiller.Program.Main(String[] args)

Exceção Sem Tratamento: System.IO.IOException: Could not open file "C:\Users\holdz\Documents\Assembly\VMProtect Unpack\Toir# 10.25b.exe" for reading. Error: 0000007B
em dnlib.IO.MemoryMappedDataReaderFactory.Windows.Mmap(MemoryMappedDataReaderFactory creator, Boolean mapAsImage)
em dnlib.IO.MemoryMappedDataReaderFactory.CreateWindows(String filename, Boolean mapAsImage)
em dnlib.IO.DataReaderFactoryFactory.CreateDataReaderFactory(String fileName, Boolean mapAsImage)
em dnlib.IO.DataReaderFactoryFactory.Create(String fileName, Boolean mapAsImage)
em dnlib.PE.PEImage..ctor(String filename, Boolean mapAsImage, Boolean verify)
em dnlib.DotNet.MD.MetadataFactory.Load(String fileName, CLRRuntimeReaderKind runtime)
em VMPKiller.Program.Main(String[] args)

one question, the tool doesn't work in vmp3.5?

Onverwerkte uitzondering: System.BadImageFormatException: Er wordt verwacht dat de module een assembly-manifest zou bevatten. (Uitzondering van HRESULT: 0x80131018)
bij System.Reflection.RuntimeAssembly.nLoadFile(String path, Evidence evidence)
bij System.Reflection.Assembly.LoadFile(String path)
bij VMPKiller.RestoreMetadatas..ctor(ModuleDefMD& moduleDef, String pathFile)
bij VMPKiller.Controller..ctor(ModuleDefMD& moduleDef, String pathFile, Int32 userParams)
bij VMPKiller.Program.Main(String[] args)
translated:
Unhandled Exception: System.BadImageFormatException: The module is expected to contain an assembly manifest. (Exception from HRESULT: 0x80131018)
at System.Reflection.RuntimeAssembly.nLoadFile (String path, Evidence evidence)
at System.Reflection.Assembly.LoadFile (String path)
at VMPKiller.RestoreMetadatas..ctor (ModuleDefMD & moduleDef, String pathFile)
at VMPKiller.Controller..ctor (ModuleDefMD & moduleDef, String pathFile, Int32 userParams)
at VMPKiller.Program.Main (String [] args)

this happens after i followed the steps in the guide and use vmkiller to use option 4.
and the debug version of the vmkiller misses a tryRestoreMethod.cs

congratulations, you are doing a wonderful job ... you just need the devirtualization, to consider the most complete tool for vmp in .net

haw to unpact dll file?