mitovmdev's MitoVM Test (DeVirtualizeMe)

Author:
mitovmdev

Language:
.NET

Upload:
2023-01-08 00:29

Download

Platform:
Windows

Difficulty:
5.5

Quality:
4.0

Arch:
x86-64

Downloads:
20

Size:
39.50 KB

Writeups:
1

Comments:
1

Description

This is a virtualization protection written by me, mito. The goal is to attempt to restore the original instructions.

Comments (1)
Writeups (1)

You must be logged in to post a comment

devsoft on 2023-06-07 16:59: @mito, can this be a sort of DeVirtualization? I'm only asking because imagining there were 2 methods after the readline(), and one is called when 0 and other when not, in that case I guess I wouldn't be able to trace the not selected method... SPOILER!!! = **************************************************************** ****** System.Reflection.RuntimeMethodInfo.UnsafeInvokeInternal.Prefix() ****** # Parameter(System.String[]) = System.String[] # Instance(System.Reflection.RuntimeMethodInfo) = Void EiIjGx(System.String[]) # Instance FullDescription = static System.Void iRyVey::EiIjGx(System.String[] 5OUUUj) # Instance MetadataToken = 100663300 # Instance IsAssembly = False **************************************************************** ****** System.Reflection.RuntimeMethodInfo.UnsafeInvokeInternal.Prefix() ****** # Parameter(System.String) = MitoVM 2.0 Devirtme! # Instance(System.Reflection.RuntimeMethodInfo) = Void set_Title(System.String) # Instance FullDescription = static System.Void System.Console::set_Title(System.String value) # Instance MetadataToken = 100666194 # Instance IsAssembly = False **************************************************************** ****** System.Reflection.RuntimeMethodInfo.UnsafeInvokeInternal.Postfix() ****** **************************************************************** ****** System.Reflection.RuntimeMethodInfo.UnsafeInvokeInternal.Prefix() ****** # Parameter(System.Int32) = 13 # Instance(System.Reflection.RuntimeMethodInfo) = Void set_ForegroundColor(System.ConsoleColor) # Instance FullDescription = static System.Void System.Console::set_ForegroundColor(System.ConsoleColor value) # Instance MetadataToken = 100666160 # Instance IsAssembly = False **************************************************************** ****** System.Reflection.RuntimeMethodInfo.UnsafeInvokeInternal.Postfix() ****** **************************************************************** ****** System.Reflection.RuntimeMethodInfo.UnsafeInvokeInternal.Prefix() ****** # Parameter(System.String) = math object initialized # Instance(System.Reflection.RuntimeMethodInfo) = Void WriteLine(System.String) # Instance FullDescription = static System.Void System.Console::WriteLine(System.String value) # Instance MetadataToken = 100666233 # Instance IsAssembly = False ****************************************************************

You must be logged in to submit a writeup

Solution by devsoft on 2023-06-15 16:20:
Solution with PDF file and logs from my trace with the IL code of some methods that ware virtualized, and all the executions with their respective parameters and response.

Download

crackmes.one

crackmes.one

mitovmdev's MitoVM Test (DeVirtualizeMe)