DNGuard Static Unpacker By CodeExplorer

风吹屁屁凉

DNGuard Static Unpacker
project wasn't started by me, I will continue it.
The advantage of it is that will work even if trial version is expired.
File attached.
It is a console program it should be started like this: DNGuard Static Unpacker.exe file_to_be_unpacked

Supported versions:
Trial:
v3.9.6.2 v1 https://forum.tuts4you.com/files/file/2176-dnguard-hvm-v3962/
v3.9.7 https://forum.tuts4you.com/files/file/2175-dnguard-hvm-v397/

Enterprise https://forum.tuts4you.com/files/file/2263-netprotectio-v200/
Enterprise v3.9.5/v3.9.6/v3.9.7

Trial v3.9.6
Trial v4.0
Trial v4.1
Trial v4.2
Trial v4.3
Trial v4.6
Trial v4.8

Currently I am specially interested on versions between 3.9.6 and v4.8 trial setup or unpackme;
and also on Enterprise unpackmes.
if you have any let me know.
Besides unpacking this program will print protection options, and you will also know if is protected by Enterprise or not;
on Enterprise Encryption_Dword is different from 0.

Version 1.1 beta:
- now shows Enterprise on DNGuard Enterprise4.8 UnpackMe.zip posted by xiaotang;
- added full unpack support for the Enterprise: https://forum.tuts4you.com/topic/42522-dnguard-hvm-v3953

Download link:
https://workupload.com/file/c4tnPF3RbEJ

For version 3.9.0 currently only displays protection options:

[C#] 纯文本查看 复制代码

if (this.version.StartsWith("3.9.0"))
                {
                    this.DataStructure.ProtectionSettings = (this.value1 ^ this.value3 ^ this.valueN4)^this.DataStructure.Encryption_Dword;
                }
                else
                    this.DataStructure.ProtectionSettings = (this.value1 ^ this.value3 ^ this.DataStructure.Encryption_Dword);

For v3.9.0 I fail to find Methods Count in structures and also MethodOffset.
Method Offset changes when applied on same unpackme
v3.9.6/v4.1/v4.2 284C
v3.9.7/v4.0 2840
v4.3 2848
v4.6/v4.8 2858

LEHSize changes when applied on same unpackme:
v3.9.0  1184 ???
v3.9.6 1256
v3.9.7 1212
v4.0 1239
v4.1 1216
v4.2 1229
v4.3 1203
v4.6 1233
v4.8 1220

ThemanRonin

DNGuard 静态解包器
项目不是我发起的，但我会继续下去。
它的优点是，即使试用版过期也能使用。
所附文件。
这是一个控制台程序，应该这样启动：DNGuard Static Unpacker.exe file_too_be_unpacked

支持的版本
试用版：
v3.9.6.2 v1 https://forum.tuts4you.com/files/file/2176-dnguard-hvm-v3962/
v3.9.7 https://forum.tuts4you.com/files/file/2175-dnguard-hvm-v397/

企业版 https://forum.tuts4you.com/files/file/2263-netprotectio-v200/
企业版 v3.9.5/v3.9.6/v3.9.7

试用版 v3.9.6
试用版 v4.0
试用版 v4.1
试用版 v4.2
试用版 v4.3
试用版 v4.6
试用版 v4.8

目前，我特别关注的是3.9.6到4.8版本之间的试用版安装程序或解包文件；以及企业版的解包文件。如果你有相关的文件，请告诉我。

此外，解包这个程序时，它会打印保护选项，并且你还会知道是否受到企业版保护；在企业版中，`Encryption_Dword`与0不同。

版本 1.1 beta：
- 现在显示了在 DNGuard Enterprise4.8 UnpackMe.zip（由 xiaotang 发布）中的企业版；
- 为企业版添加了完全解包支持： https://forum.tuts4you.com/topic/42522-dnguard-hvm-v3953

下载链接：
https://workupload.com/file/c4tnPF3RbEJ

对于 3.9.0 版本，目前只显示保护选项。

[C#] 纯文本查看 复制代码

if (this.version.StartsWith("3.9.0"))
                {
                    this.DataStructure.ProtectionSettings = (this.value1 ^ this.value3 ^ this.valueN4)^this.DataStructure.Encryption_Dword;
                }
                else
                    this.DataStructure.ProtectionSettings = (this.value1 ^ this.value3 ^ this.DataStructure.Encryption_Dword);

在 v3.9.0 版中，我无法在结构中找到方法计数（Methods Count），也无法找到方法偏移（MethodOffset）。
方法偏移在应用于同一解包时发生变化
v3.9.6/v4.1/v4.2 284C
v3.9.7/v4.0 2840
v4.3 2848
v4.6/v4.8 2858

LEHSize 在应用于同一解包时会发生变化：
v3.9.0 1184 ???
v3.9.6 1256
v3.9.7 1212
v4.0 1239
v4.1 1216
v4.2 1229
v4.3 1203
v4.6 1233
v4.8 1220

byh3025

这个也太厉害了

lg18866718849

第一，第一，第一，卧槽，大佬牛逼，感谢大佬

flea033

感谢分享！

skip2

卧槽，牛逼！

ly871108

感谢分享……

3yu3

盯一个更新。另外如何判别.NET程序 用哪个版本加的？

666888tzq

厉害了，企业版也能脱。

weiya909

大佬，这个有相关教材吗