SMD For Agile
1 Attachment(s)
SimpleMSILDecryptorForAgile:
this tool decrypts methods of last version of Agile; inspirited by duyan13 https://board.b-at-s.info/index.php?showtopic=9313 Two Frameworks are supported: Framework 2.0 and Framework 4.0; Framework 4+ (latter Frameworks like 4.6.1 etc.) should be supported by Framework 4.0: Place Simple_MSIL_Decryptor.exe.config, SJITHook.dll and Simple_MSIL_Decryptor.exe in the target program directory; start Simple_MSIL_Decryptor.exe from NetBox 4.0 and try to decrypt target assembly; if reports missing assemblies you should place them in the target directory for being able to decrypt MSIL of those methods; in the end undecrypted count should be 0. Next step: unvirtualize Agile with de4dot: This may not work for some targets! After we decrypt MSIL we deobfuscate methods with de4dot v3.1.41592, we just set decrypts methods to false so de4dot won't decrypt methods by adding to de4dot.exe the parameter: --an-methods false in command line do: de4dot.exe filename.exe --an-methods false |
Thanks for interesting tool
why it says on startup this? --------------------------- Warning --------------------------- GAC installation failed! --------------------------- OK --------------------------- |
It will try to install the assembly on GAC (Global Assembly Cache):
https://en.wikipedia.org/wiki/Global_Assembly_Cache On Windows 7 or latter system will fail! So what you should do? You should Simple_MSIL_Decryptor.exe.config, SJITHook.dll and Simple_MSIL_Decryptor.exe to the target program directory; and ignore that warning! During Appdomain creating the program (Simple_MSIL_Decryptor.exe) try to loads itself; which fails it won't find proper file (Simple_MSIL_Decryptor.exe) in GAC or in current directory! http://www.adamtuliper.com/2009/12/adding-permissions-to-add-items-to-gac.html |
1 Attachment(s)
I can't derypte this dll file. Please try it.
|
Missing dlls:
AgileDotNetRT64.dll RevitAPI, Version=17.0.0.0, Culture=neutral, PublicKeyToken=null RevitAPIUI, Version=17.0.0.0, Culture=neutral, PublicKeyToken=null 0 undecrypted methods! File saved! So RevitAPI and RevitAPIUI must be placed in the program directory else some methods like: public Result Execute(ExternalCommandData commandData, ref string message, ElementSet elements); Declaring Type: ohM=.oRM= Assembly: DecryptMe, Version=1.0.0.0 If you have RevitAPI and RevitAPIUI please share them! |
Quote:
RevitAPI.dll: Quote:
Quote:
|
Sorry but still can't do it: they are lots of missing referenced assemblies!
Those are part of Revit API 2017 x64 right? Is there any Revit API 2017 x32? |
Autodesk has only x64 version.
You can try the setup: Quote:
Quote:
|
The unpacked file (msil decryted)
The unpacked file (msil decryted):
https://www80.zippyshare.com/v/Zp0cgvVz/file.html As for what I did: I created my own dlls RevitAPI.exe and RevitAPIUI.exe with only their constructions (classes/methods) for being able to unpack MSIL; let me know if the unpacked exe is ok; you got to also nop Agile constructors! |
To decrypt strings runs the fallowing command:
de4dot filename --an-methods false --strtyp delegate --strtok 06000006 06000006 is the method which decrypt strings in this case. @congviet: Let me know if there is any undecrypted method or other problem! |
Quote:
2. This source code: Code:
using System; Code:
using System; Thank you very much. |
Here are the two dlls
Here are the two dlls:
https://www67.zippyshare.com/v/3MW9QG87/file.html As for the Chinese characters those are some fields - delegates type! I rather not rename at all: the dll may not work after renaming! |
I tried the file at
Quote:
Quote:
Quote:
|
SMD for Agile with any CPU
@congviet:
Sorry for late reply. Compiled SMD for Agile with any CPU. Should load referenced (x64) assemblies just fine, of course they should be present in the target's program directory. |
1 Attachment(s)
Quote:
I get an error when click the decrypt button. My OS is Win10Pro x64. |
All times are GMT +8. The time now is 10:19. |
Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2024, vBulletin Solutions, Inc.
Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX