BigMouse.Net

how to run Re-Max 3.4 with real .net framework environment?

2009-02-06T00:28:00.000-08:00

1. should only installed .Net Framework 2.0. (v2.0.50727.42).
2. only need RE-Max v3.4。
3. should rename RE-Max 's filename. eg: renamed to test.exe.
4. run re-max with commandline "/real" .
eg:
test.exe /real

maxtocode unpacker RE-Max v3.40 available for download

2009-02-02T00:05:00.000-08:00

1. virtual .net framework environment support:
maxtocode v3.38, v3.39, v3.40 and version before v3.36.

2. for v3.36 and v3.37, should run re-max with real .net framework environment.

3. how to use real .net framework environment?
a. should only installed .Net Framework 2.0. (v2.0.50727.42).
b. make your own rsdeploy.dll .

4. this is *only* the upgrade file. RE-Max v1.0 is needed for virtual .net framework environment.

RE-MaxV3.40.rar (890.41 kB)
http://www.zshare.net/download/55041427861b9ca6/

RE-MaxV3.40.rar (890.41 kB)
http://www.filesend.net/download.php?f=28e11c3fd9bd7ff3012fa9bd85df7465

RE-Max_v1.0.rar (15.17 MB)
http://www.filesend.net/download.php?f=92e5de1349125c941421f918bbd23f94

maxtocode unpacker RE-Max v3.39 available for test

2008-12-22T22:25:00.000-08:00

if you have any sample assembly, you can post here for test.
http://www.reteam.org/board/showthread.php?t=1262

.Net Reactor v3.7.9.1 deflowed

2008-05-03T07:53:00.000-07:00

deflowed:
can view c# source code in reflector.

http://momupload.com/files/92305/dp_dotNET_Reactor-rb.rar.html

.Net Reactor Unpacker (for library mode only)

2008-05-03T01:31:00.000-07:00

.Net Reactor Unpacker (for library mode only)

after unpack, you need to use my .Net Assembly Rebuilder to rebuild the unpacked assembly.

download:

http://momupload.com/files/92257/ReactorUnpacker.rar.html

http://bigmouse.net.googlepages.com/ReactorUnpacker.rar

.Net Reactor v3.7.9.1 unpacked

2008-05-02T23:03:00.000-07:00

dp_dotNET_Reactor.rar (1.37 MB)
Download Link: http://www.filesend.net/download.php?f=8a8fd65edc99cb04be7e8d91d8892519

all method been restored.can be viewed in reflector ,but can't run.you need to strip the strongname, and remove all publickey check code.

.Net Reactor 3.7.1.0 unpacked and deflowed

2008-05-02T10:34:00.000-07:00

now , can view C# source code in reflector

Download Link:
http://www.filesend.net/download.php?f=a01cffca430e7bb75d96e4131a7e7f7d

.NET Reactor v3.7.1.0 unpacked

2008-04-29T09:20:00.000-07:00

.net reactor 3.7.1.0 unpacked

http://momupload.com/files/91593/dp_dot_Reactor.rar.html

all method been restored.
can be viewed in reflector ,but can't run.
you need to strip the strongname, and remove all publickey check code.

bypass DNGuard trial's 30 days limit

2008-04-28T23:13:00.000-07:00

i found dnguard use GetSystemTimeAsFileTime to obtain current system.
we can write a loader or a wrap dll to hook this function,and return a fake time to cheat the runtime.

RE-Max v3.35 unpacker for MaxToCode v3.35

2008-04-25T09:10:00.000-07:00

[+]support for maxtocode professional v3.35
[+]auto correct #GUID size
[*]improved support for maxtocode professional
can full unpack all methods now.

i finally have made it works with the previous virtual .net framework envionment.
but not sure if it would work for all computer.
it should work fine for most of yours.

this is *only* the upgrade file. RE-Max v1.0 is needed

RE-MaxV3.35.rar (221.07 kB)

Download Link: http://www.filesend.net/download.php?f=0c61cc559d0f7215a900df0900858d7b

RE-Max_v1.0.rar (15.17 MB) http://www.filesend.net/download.php?f=92e5de1349125c941421f918bbd23f94

i'v received several emails about re-maxV3.35 can't unpack some assemblies.
i checked those samples. found maxtocode 3.35 have a special anti for re-max.
to bypass this anti, rename "Re-MaxV3.35.exe" to other else.

abount Flow-Control-Obfuscation of Dotfuscator

2008-04-23T07:40:00.000-07:00

many obfucator using branch instructions in Flow-Control-Obfuscation.

this can be deobfuscate easily.

dotfuscator support using switch instruction to obfuscate flow-control.

how deobfuscate this type Flow-Control-Obfuscation?

maybe we can use 2 steps to do this.

step 1:

convert switch intruction to branch instructions.*

step 2:

deobfuscate normally.

look at this picture (from rongchaua)

the problem is how to convert switch to branchs.

first, analyse the ilcode and find out switch instruction and its condition variable.
so we can got
L_0016: ldloc num
L_001a: switch(L_0014, L_0075, L_008d, L_0050)

remove above instructions and log (L_0014, L_0075, L_008d, L_0050).

and then, find out all stloc num instructions.
replace this instructions with branch instructions.

but where is the branch's target?
this according to the previous ldc.i4 n instruction of each stloc num instruction.
if n ==0 then target is L_0014.
if n ==1 then target is L_0075.
if n ==2 then target is L_008d.
if n ==3 then target is L_0050.

RE-Max 3.35 available for test (maxtocode unpacker)

2008-04-21T20:35:00.000-07:00

[+]auto correct #GUID size
[*]improved support for maxtocode professional 3.21can full unpack all methods now.
[+]add support for maxtocode professional 3.22
[+] support maxtocode 3.35[the latest version]

the unpacker only work on special system envionment yet.i'll try to make it work with the previous virtual .net framework envionment .

currently, i only got a few maxtocode 3.3x's assemblies.
if you have any, you can post here for test.

RE-Max v2.0 unpacker for MaxToCode v3.2x

2008-04-21T20:33:00.000-07:00

[*]fixed bug in listing assembly files.
[+]support for maxtocode professional v3.2x

RE-MaxV2.0.rar (138.30 kB)Download Link: http://www.filesend.net/download.php...77dbe7d224ffd5

this is *only* the upgrade file.RE-Max v1.0 is needed ,

Download Link: RE-Max_v1.0.rar (15.17 MB) http://www.filesend.net/download.php?f=92e5de1349125c941421f918bbd23f94

.Net Assembly Rebuilder v1.0

2008-04-21T20:13:00.000-07:00

Dumped Assembly can be viewed in reflector but can't run or can't be opened by cecil?
try using this tool to rebuild it

.Net Assembly Rebuilder.rar (127.04 kB)
Download Link: http://www.filesend.net/download.php?f=f4c228e741c7849ae06fe9b03c241ebb

http://bigmouse.net.googlepages.com/NetAssemblyRebuilder.rar

Hello world

2008-01-23T23:50:00.000-08:00

this is my first post.