NETDeob icon indicating copy to clipboard operation
NETDeob copied to clipboard

MPRESS-packed assembly is unpacked incorrectly.

Open Ark-kun opened this issue 12 years ago • 2 comments

It's very easy, but the output of NETDeob was incorrect (didn't even start with MZ) and the program seemed to hang after that.

Ark-kun avatar Oct 10 '12 09:10 Ark-kun

Can you send me the file? Also, what MPRESS version?

maddnias avatar Oct 12 '12 21:10 maddnias

I uploaded the archive with the file, the correct unpacked assembly and the NETDeob unpacked assembly. http://narod.ru/disk/62420021001.2fe2b73c9e41cad455a82f8a116d00b4/NETDeob%20MPRESS%20problem.zip.html or http://depositfiles.com/files/2o17gbwnl

de4dot says it's MPRESS 2.18+ Here is the NETDeob output

NETDeob 0.3.1 BETA

Packer identified: Mpress .NET Packer

Cleaning assembly...

Performing routine: Unpacking

Phase 1: Data retrieval Retrieved compressed data...

Phase 2: Decompression

Performing routine: Remove bad members

Phase 1: Strip assembly from bad members 0 members cleaned from assembly...


Successfully deobfuscated assembly: XXXXX in 195 milliseconds Deobfuscated assembly saved at: XXXXX_deobf.exe

And then the program just hangs there...

Ark-kun avatar Oct 13 '12 13:10 Ark-kun