Comments on: Microsoft CCI Framework for Deobfuscating .Net binaries. http://www.casabasecurity.com/blog/2010/02/microsoft-cci-framework-for-deobfuscating-net-binaries/ Building and breaking software and robots Thu, 29 Apr 2010 09:19:21 +0000 http://wordpress.org/?v=2.9.2 hourly 1 By: Kent http://www.casabasecurity.com/blog/2010/02/microsoft-cci-framework-for-deobfuscating-net-binaries/comment-page-1/#comment-20 Kent Sun, 21 Feb 2010 03:01:12 +0000 http://www.casabasecurity.com/blog/?p=152#comment-20 Missing the + on this line: Stream peStream = File.Create(module.Location + ".fixed"); BTW: This is FAR better than using a hex editor. Good job! Missing the + on this line:
Stream peStream = File.Create(module.Location + “.fixed”);

BTW: This is FAR better than using a hex editor. Good job!

]]> By: John Hernandez http://www.casabasecurity.com/blog/2010/02/microsoft-cci-framework-for-deobfuscating-net-binaries/comment-page-1/#comment-14 John Hernandez Thu, 18 Feb 2010 18:10:17 +0000 http://www.casabasecurity.com/blog/?p=152#comment-14 Hey Shane, I updated that code and also updated the code on part two to fix those issues. Hopefully that helps! Hey Shane,
I updated that code and also updated the code on part two to fix those issues. Hopefully that helps!

]]> By: John Hernandez http://www.casabasecurity.com/blog/2010/02/microsoft-cci-framework-for-deobfuscating-net-binaries/comment-page-1/#comment-13 John Hernandez Thu, 18 Feb 2010 17:41:28 +0000 http://www.casabasecurity.com/blog/?p=152#comment-13 You're right. I fixed it =). We're testing out new "code" plugin's that don't always work as expected. You’re right. I fixed it =). We’re testing out new “code” plugin’s that don’t always work as expected.

]]> By: Shane http://www.casabasecurity.com/blog/2010/02/microsoft-cci-framework-for-deobfuscating-net-binaries/comment-page-1/#comment-11 Shane Thu, 18 Feb 2010 07:35:51 +0000 http://www.casabasecurity.com/blog/?p=152#comment-11 It looks like the post stripped the type passed to the generic List in the Visit() method. Can you fix the post? It looks like the post stripped the type passed to the generic List in the Visit() method. Can you fix the post?

]]>