puff / EazyDevirt

A tool for automatically reconstructing IL code from an assembly virtualized with Eazfuscator.NET

GNU General Public License v3.0

148 stars 33 forks source link

Emulate VMBinaryReader #9

Closed puff closed 1 year ago

puff commented 1 year ago

Description

The endianness of the VM's BinaryReader is scrambled across different Eazfuscator.NET versions. This PR switches the VMBinaryReader class to use emulation so it will always use the correct endianness when reading.

Related Issue

4

puff commented 1 year ago

Tested on multiple samples with varying Eazfuscator.NET versions.