I'm wwh1004.
Focus on .NET reverse engineering and Windows security.
Also love architecture design and software development.
Programming mainly in C#, C++.
This is my new blog wwh1004.com and knowledge will be shared here.
.NET Assembly Dumper
I'm wwh1004.
Focus on .NET reverse engineering and Windows security.
Also love architecture design and software development.
Programming mainly in C#, C++.
This is my new blog wwh1004.com and knowledge will be shared here.
请问如何使用这个工具呢?能反混淆dll吗?
试过几次,发现了两个问题:
1、Emit 动态创建的Dll无法Dumper
2、某些软件找不到进程,无法Dumper,可能和加壳有关?
As there are not much info about this tool.
Just wondering what is purpose of this tool as there is MegaDumper. Is this project some sort improved MegaDumper?
If yes, then what are actual improvements ExtremeDumper vs MegaDumper? Would be good such info to be in readme https://github.com/wwh1004/ExtremeDumper
[LDHK] DllMain: Loaded
[LDHK] DllMain: Monitor created
[LDHK] LoaderHookMonitorLoop: Found nLoadImage at 74D26310 by ECall
[LDHK] InstallHook: 1
[LDHK] LoaderHookMonitorLoop: LDHK_MONITOR_CLR at 74D26310
Unhandled Exception: System.IO.IOException: The handle is invalid.
at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
at System.Console.GetBufferInfo(Boolean throwOnNoConsole, Boolean& succeeded)
at System.Console.Clear()
at Colorful.Console.Clear()
at Main.Menu()
at Program.Main(String[] args)
我这里有一个程序,确实是.Net的,反编译后能得到类型成员,但无法得到方法内具体代码
用这个软件查看后是检测不到clr的,也无法dump
请问可以发你看看吗
Hello, I created an injector dll with dnlib inside the memory and wanted to inject the byte array into process without writing it to a temp directory. It seems in the function WriteMachineCode is not able to loadlibrary without assemblyPath.
return pRuntimeHost->ExecuteInDefaultAppDomain(L"assemblyPath", L"typeName", L"methodName", L"argument", pReturnValue);
I think if you write the dll into process memory and change that function wrapper to this
_AppDomainPtr spDefaultAppDomain = NULL;
if (pCorRuntimeHost->GetDefaultDomain(&spAppDomainThunk) != S_OK)
{
_AssemblyPtr spAssembly = NULL;
return spDefaultAppDomain->Load_3(safeArray, &spAssembly)) {
}
}
we shall use in memory injection and benefit from faster execution and eliminating the unnecessary use of reading and writing form hard drive and keeping the injector more covert.
here is the link to the full article.
Common Language Runtime In Memory Execution
CLR.hpp
Thanks in advance.
hi i was wondering if we can make this a console app as well to be able to dump apps using the command line
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.