SMD For Agile

[CodeCracker]

SMD_FOR_AGILE_Fix10:
- added "Agile dll name" to specify Agile runtime dll name, although currently LoadlibraryExA hook file name is only fixed for x86 (32 bits)
- Fixed "getEHInfo" for 64 bits, fallowing .Net Frameworks should be supported: 4.5, 4.7. 4.8
Released as AnyCpu

[cvetkisa]

Thank you so much for your effort, dear friend, it really means a lot to me.
I’ve been away for a few days, sorry for the LTR. Thank you sendersu for sending the NT8.1.1.7

Could you please upload and share fix for the other two modules on Workupload (BOF_L2_msil.dll and BookMapNT_msil.dll)?
I can’t repeat your procedure.
How did you finally manage to get (NinjaTrader.Core_msil.dll and NinjaTrader.Gui_msil.dll) when SMD crashes and disappears?

[CodeCracker]

How did you finally manage to get (NinjaTrader.Core_msil.dll and NinjaTrader.Gui_msil.dll) when SMD crashes and disappears?

I execute SMD process multiple times until it succeeds.
Anyway, I think I fixed those bugs.

Here are updated tools: SMD and EazFixer
https://workupload.com/file/edPsz5BVXDJ

So just run SMD, after that de4dot with packer unknown:
de4dot --dont-rename "C:\test1\BOF_FP_msil.dll" -p un

And now you can use EazFixer.exe to decrypt strings:
EazFixer.exe --file "C:\test1\BOF_FP_msil-cleaned.dll" --virt-fix

Now it is much easier. EazFixer was changed to patch Module.cctor when executed.

[CodeCracker]

Check:
https://forum.exetools.com/showthread.php?p=132624#post132624
Now after SMD, de4dot no required prior of using EazFixer since I've added basic control flow deobfuscation using de4dot.blocks.dll
So just use SMD and then run: EazFixer.exe --file "C:\test1\BOF_FP_msil.dll" --virt-fix
And as final step you could run de4dot --dont-rename "C:\test1\BOF_FP_msil-eazfix.dll"
to get ride of CliSecure classes.

[cvetkisa]

Fantastic work.
Thank you so much for your selfless help!!!