private static void Main(string[] args)
{
try
{
if (args.Length == 2 && args[0] == "-i")
{
IgnoreIndex = Convert.ToInt32(args[1]);
}
Console.BackgroundColor = ConsoleColor.White;
Console.ForegroundColor = ConsoleColor.Black;
Console.WriteLine("*********************************");
Console.WriteLine("*** ***");
Console.WriteLine("*** ILProtector Unpacker ***");
Console.WriteLine("*** V2.0.21.14 - V2.0.22.2 ***");
Console.WriteLine("*** Coded By RexProg ***");
Console.WriteLine("*** ***");
Console.WriteLine("*********************************");
Console.ForegroundColor = ConsoleColor.Blue;
Console.WriteLine("[?] Enter Your Program Path : ");
Console.ForegroundColor = ConsoleColor.Red;
var path = Console.ReadLine();
if (path == string.Empty)
{
return;
}
if (path != null && path.StartsWith("\"") && path[path.Length - 1] == '"')
{
path = path.Substring(1, path.Length - 2);
}
if (!File.Exists(path))
{
Console.ForegroundColor = ConsoleColor.Blue;
Console.WriteLine("[!] File not found");
Console.WriteLine("[!] Press key to exit...");
Console.Read();
return;
}
Console.ForegroundColor = ConsoleColor.DarkRed;
AssemblyWriter = new AssemblyWriter(path);
Assembly = Assembly.LoadFrom(path ?? throw new Exception("path is null"));
Console.WriteLine("[+] Wait...");
MainFrames = new StackTrace().GetFrames();
Memory.Hook(
typeof(StackTrace).Module.GetType("System.Diagnostics.StackFrameHelper")
.GetMethod("GetMethodBase", BindingFlags.Instance | BindingFlags.Public),
typeof(Program).GetMethod("Hook4", BindingFlags.Instance | BindingFlags.Public));
var types = AssemblyWriter.moduleDef.GetTypes();
var list = types as IList <TypeDef> ?? types.ToList();
var globalType = AssemblyWriter.moduleDef.GlobalType;
var fieldMdToken = 0;
foreach (var fieldDef in globalType.Fields)
{
if (fieldDef.Name == "Invoke")
{
fieldMdToken = fieldDef.MDToken.ToInt32();
}
}
if (fieldMdToken == 0)
{
Console.WriteLine("[!] Couldn't find Invoke");
}
var fieldValue = Assembly.Modules.FirstOrDefault()?.ResolveField(fieldMdToken).GetValue(null);
var method = fieldValue?.GetType().GetMethod("Invoke");
if (method == null)
{
Console.WriteLine("[!] Couldn't find InvokeMethod");
}
InvokeDelegates(list, method, fieldValue);
new StringDecrypter(Assembly).ReplaceStrings(list);
foreach (var typeDef in JunkType)
{
typeDef.DeclaringType.NestedTypes.Remove(typeDef);
}
var methodDef = globalType.FindStaticConstructor();
if (methodDef.HasBody)
{
var startIndex = methodDef.Body.Instructions.IndexOf(methodDef.Body.Instructions.FirstOrDefault(
inst =>
inst.OpCode == OpCodes.Call &&
((IMethod)inst.Operand).Name == "GetIUnknownForObject")) - 2;
var endindex = methodDef.Body.Instructions.IndexOf(methodDef.Body.Instructions.FirstOrDefault(
inst =>
inst.OpCode == OpCodes.Call &&
((IMethod)inst.Operand).Name == "Release")) + 2;
methodDef.Body.ExceptionHandlers.Remove(methodDef.Body.ExceptionHandlers.FirstOrDefault(exh =>
exh.HandlerEnd == methodDef.Body.Instructions[endindex + 1]));
for (var i = startIndex; i <= endindex; i++)
{
methodDef.Body.Instructions.Remove(methodDef.Body.Instructions[startIndex]);
}
}
foreach (var meth in globalType.Methods.Where(met =>
met.ImplMap?.Module.Name.ToString() == "Protect32.dll" ||
met.ImplMap?.Module.Name.ToString() == "Protect64.dll").ToList())
{
globalType.Remove(meth);
}
var invokeField = globalType.Fields.FirstOrDefault(fld => fld.Name == "Invoke");
AssemblyWriter.moduleDef.Types.Remove(invokeField?.FieldType.ToTypeDefOrRef().ResolveTypeDef());
globalType.Fields.Remove(invokeField);
AssemblyWriter.Save();
Console.ForegroundColor = ConsoleColor.Blue;
Console.WriteLine("[!] Program Unpacked");
}
catch (Exception ex)
{
Console.WriteLine("[!] Exception :\n" + ex.Message);
}
Console.WriteLine("[!] Press key to exit...");
Console.Read();
}
private static void Main(string[] args)
{
try
{
if (args.Length == 2 && args[0] == "-i")
{
IgnoreIndex = Convert.ToInt32(args[1]);
}
Console.BackgroundColor = ConsoleColor.White;
Console.ForegroundColor = ConsoleColor.Black;
Console.WriteLine("*********************************");
Console.WriteLine("*** ***");
Console.WriteLine("*** ILProtector Unpacker ***");
Console.WriteLine("*** V2.0.21.2 - V2.0.22.14 ***");
Console.WriteLine("*** Coded By RexProg ***");
Console.WriteLine("*** Updated By krysty ***");
Console.WriteLine("*** ***");
Console.WriteLine("*********************************");
Console.ForegroundColor = ConsoleColor.Blue;
Console.WriteLine("[?] Enter Your Program Path : ");
Console.ForegroundColor = ConsoleColor.Red;
var path = Console.ReadLine();
if (string.IsNullOrEmpty(path))
{
if (args.Length == 1)
{
path = args[0];
}
else
{
return;
}
}
if (path != null && path.StartsWith("\"") && path[path.Length - 1] == '"')
{
path = path.Substring(1, path.Length - 2);
}
if (!File.Exists(path))
{
Console.ForegroundColor = ConsoleColor.Blue;
Console.WriteLine("[!] File not found");
Console.WriteLine("[!] Press key to exit...");
Console.Read();
return;
}
if (!HasWritePermission(path))
{
Console.ForegroundColor = ConsoleColor.Blue;
Console.WriteLine("[!] Can't write to " + Path.GetDirectoryName(path));
Console.WriteLine("[!] Press key to exit...");
Console.Read();
return;
}
Console.ForegroundColor = ConsoleColor.DarkRed;
AssemblyWriter = new AssemblyWriter(path);
Assembly = Assembly.LoadFrom(path ?? throw new Exception("path is null"));
Console.WriteLine("[+] Wait...");
HookSystemRuntimeTypeGetMethodBase();
MainFrames = new StackTrace().GetFrames();
//Memory.Hook(
// typeof(StackTrace).GetMethod("GetFrame", BindingFlags.Instance | BindingFlags.Public),
// typeof(Program).GetMethod(nameof(Hook), BindingFlags.Instance | BindingFlags.Public)
//);
//Memory.Hook(
// typeof(StackFrame).GetMethod("SetMethodBase", BindingFlags.Instance | BindingFlags.NonPublic),
// typeof(Program).GetMethod(nameof(Hook2), BindingFlags.Instance | BindingFlags.Public)
//);
//Memory.Hook(
// typeof(StackTrace).GetMethod("CaptureStackTrace", BindingFlags.Instance | BindingFlags.NonPublic),
// typeof(Program).GetMethod(nameof(Hook3), BindingFlags.Instance | BindingFlags.Public)
//);
Memory.Hook(
typeof(StackTrace).Module.GetType("System.Diagnostics.StackFrameHelper")
.GetMethod("GetMethodBase", BindingFlags.Instance | BindingFlags.Public),
typeof(Program).GetMethod(nameof(Hook4), BindingFlags.Instance | BindingFlags.Public)
);
var types = AssemblyWriter.moduleDef.GetTypes();
var list = types as IList <TypeDef> ?? types.ToList();
var globalType = AssemblyWriter.moduleDef.GlobalType;
var fieldMdToken = globalType.Fields
.Where(fieldDef => fieldDef.Name == "Invoke")
.Select(fieldDef => fieldDef.MDToken.ToInt32())
.DefaultIfEmpty(0)
.FirstOrDefault();
if (fieldMdToken == 0)
{
Console.WriteLine("[!] Couldn't find Invoke");
}
var fieldValue = Assembly.Modules.FirstOrDefault()?.ResolveField(fieldMdToken).GetValue(null);
var method = fieldValue?.GetType().GetMethod("Invoke");
if (method == null)
{
Console.WriteLine("[!] Couldn't find InvokeMethod");
}
InvokeDelegates(list, method, fieldValue);
new StringDecrypter(Assembly).ReplaceStrings(list);
foreach (var typeDef in JunkType)
{
typeDef.DeclaringType.NestedTypes.Remove(typeDef);
}
if (_totalUnpackedMethods == _totalPackedMethods)
{
CleanAssembly();
}
AssemblyWriter.Save();
Console.ForegroundColor = ConsoleColor.Blue;
Console.WriteLine($"[!] Total packed methods: {_totalPackedMethods}");
Console.WriteLine($"[!] Total unpacked methods: {_totalUnpackedMethods}");
Console.WriteLine("[!] Program Unpacked");
}
catch (Exception ex)
{
Console.WriteLine("[!] Exception :\n" + ex.StackTrace);
}
Console.WriteLine("[!] Press key to exit...");
Console.Read();
}