.NET 3.0 program to reverse

[pburman]

.NET 3.0 program to reverse

[Kurapica]

Ildasm cannot disassemble it because it's a protected module (SuppressIldasmAttribute)

to solve this problem you need to use Ildasm 1.1 where it was possible to open all assemblies, here is the link.
http://www.filesend.net/download.php?f=1be0d169ae386f516e0115c33cf1d8f6

In .NET Reflector I see only obfuscation :) like this:

Obfuscation can be easily defeated using this tool which is called "DeObfuscator", you can get it from here
http://portal.b-at-s.info/tools.php

Good luck.

[Kurapica]

I have tried DeObfuscator earlier today and it said: "Can't open assembly for DeObfuscation" and then "Index was outside the bounds of the array"

there must be something wrong in the PE file structure, try to check and try again. Deobfuscator needs an intact PE file to work.

[Kurapica]

what causes that I can't see bodies of functions?

Clearly this target uses JIT hooking to encrypt and hide code from Reflector !!! and this is not good :-(

Try to find the name of the protector,there are many protectors that use jit hooking like CLI-Secure, for example if it is "MaxtoCode" protector then you can use BigMouse's tool to unpack it and restore hidden code.

[Kurapica]

Sorry I can't crack it for you, but I can help you as much as I can, this program is not protected by JIT hooking protectors so it's not that hard, You need a generic dotnet dumper to dump the .NET process after it's completely loaded, you can find a similar tool here.
http://ntcore.com/netunpack.php

dump the process and you will see the code in Reflector again.

[Kurapica]

How do you know it's not JIT hook protector :) ?

I just saw this protection before and I could restore the code using only a generic unpacker.