PDA

View Full Version : Help with Reactor 3.3.1.1 protected file


RapidCrash
05-28-2009, 08:56 PM
So I have extracted a Reactor-protected application. Turns out the application that I was originally trying to get was protected with Reactor (did a google check for license.dll). It reflects perfectly fine after I fixed the PE header and everything, however I am having troubles with two things:

- Strings are encrypted, makes it difficult to follow function flow.

- File also packed other libraries with the executable, but I don't know how to extract those.

tribal
05-29-2009, 09:37 AM
Could you post the application?
You can try to unpack it with the .net generic unpacker after you launched the application and used all the options so that all dll's are loaded into the memory. The unpacker should also unpack virtual file system dll's.

RapidCrash
05-31-2009, 04:17 PM
I did finally unpack it correctly. The issue was that I was unpacking it too early. Apparently a few of the dll's that I wanted did not even get loaded until I used functions that loaded them. I also did figure out an alternate way of unpacking most files.

The thing is that by the time the application is loaded, the files will be available to be unpacked. However Olly did not usually like to load the application (kept stopping at every exception). So what I did was I loaded the program, loaded functions to get my DLL, attached to the process with Olly, then dumped. I was able to get things that NETUnpacker did not.

The only issue I am having now is function naming. they're all encrypted or something of the sort, making it difficult to follow the flow.