SMD For Agile

[hp3]

@CodeCracker :

crash in unpacking exe and dll
test in win 7 - 32bit 64bit and win10 64bit and Net box
this maybe for files have virtualization ?

[CodeCracker]

crash in unpacking exe and dll

Please mark "No new Appdomain" option;
Error should be shown now. Let me know.

[hp3]

this is error when try unpack exe and dll

[CodeCracker]

Please send me a PM with all targets so I could check them.

[hp3]

i think PM is close in forum

hp3.1980.hp3@gmail.com
if u can send a mail and i will contact u on mail

[CodeCracker]

Originally Posted by hp3

i think PM is close in forum

Than please share all targets here.

[embassy]

Hello! The provided executable gives the error message "Could not load file or assembly 'System.Net.Http ...' "
Below is the full callstack. To reproduce, you can use the decryptor on itself or other code, in a virtual machine (but I have the same result on my main machine) This is with the latest version.

************** Exception Text **************
System.IO.FileNotFoundException: Could not load file or assembly 'System.Net.Http, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a' or one of its dependencies. The system cannot find the file specified.
File name: 'System.Net.Http, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a'
   at Simple_MSIL_Decryptor.MainForm.SendToJit()
   at System.AppDomain.DoCallBack(CrossAppDomainDelegate callBackDelegate)
   at System.AppDomain.DoCallBack(CrossAppDomainDelegate callBackDelegate)
   at Simple_MSIL_Decryptor.MainForm.Button2Click(Object sender, EventArgs e)
   at System.Windows.Forms.Control.OnClick(EventArgs e)

[chants]

Looks like you don't have a version of the .NET framework installed that it's specifically referencing.

[congviet]

Missing reference files or the target is using a newer version of the .net framework

[CodeCracker]

SMD for AGILE bug fixed version: now should work.
https://workupload.com/file/6vbvr38yVZG

[sendersu]

what bug(s) was(were) fixed?

[th3tuga]

Originally Posted by sendersu

what bug(s) was(were) fixed?

The errors noted in posts #37 and #39 are now fixed.

[CodeCracker]

SMD_FOR_AGILE_Fix2:
What's new:
- Now should work fine even on old Framework 4.0 version - with Netbox
- One more native counter patch for x86
- Re-enabled "Set .cctor body" for being able to send to jit more methods & .cctor methods are not being changed in unpacked exe for x86 version

[CodeCracker]

SMD_FOR_AGILE_Fix3:
What's new:
- bugs fixed for x64
- now log methods not send to jit (old "undecrypted" count) plus how many methods are decrypted.

[CodeCracker]

SMD_FOR_AGILE_Fix4:
What's new:
- more Framework supported for x64; maybe all of them I don't know yet
- added "LoadLibraryA hook" checkbox - this will transform from full path of Agile dll (temp path) to short name Agile dll - when you use this option Agile dll has to be in the current directory;
- "No SetAllowAutoRedirect" checkbox: - code - but it using reflection:
public static void SetAllowAutoRedirect()
{
HttpClient client = new HttpClient(new HttpClientHandler
{
AllowAutoRedirect = false
});

For x64 still something is missing, this is why I've set 32 Bit required for SMD for Agile and used the attached 32 bits dll AgileDotNetRTPro.dll. And I really miss debugger for AnyCpu assemblies - x64dbg fails:
and also an 64 bits hexeditor of process memory.