Jump to content
Tuts 4 You

[CrackMe] .NET CrackMe By CodeNatif


CodeNatif

Recommended Posts

Can not decrypt appfucator string until codecracker update his calculator tools . 

 

confuser and crypto unpacked 90 %

Got as far as removing Them/WinLic, Goliath and Dotobfuscator as well. However I could not get the resulting exe to run with AppFuscator still in place.

Any chance you'd be willing to make a tutorial of how you got your result? Would be interested to see it.

Little bit of proof showing how far I got in case there are any issues with anyone not believing etc.

C:\Tools\de4dot - 3.1.41592>de4dot.exe "C:\Users\atom0s\Desktop\CrackMe.exe" -dde4dot v3.1.41592.3405 Copyright (C) 2011-2014 de4dot@gmail.comLatest version and source code: https://github.com/0xd4d/de4dotMore than one obfuscator detected:  Crypto Obfuscator (use: -p co)  Dotfuscator (use: -p df)  Goliath.NET (use: -p go)Detected Crypto Obfuscator (C:\Users\atom0s\Desktop\CrackMe.exe)
de4dot can remove the Dotfuscator and Goliath.NET fine but fails on Crypto/AppFuscator.

For the first part, Themida/WinLicense was removed via the Ultra Unpacker script from LCF-AT and friends. Worked great on the file in question as far as I can tell, no issues. Dumped memory with WinHex and fixed via Themnet Unpacker v1.0.0.9. All of which seemed to work fine. Just got stuck after removing two of the 3 .NET protections though.

Edited by atom0s
Link to comment
Share on other sites

Hadits follower

de4dot can't able take care crypto until attach dump confuser ex resource . 

Edited by abcd
Link to comment
Share on other sites

Hadits follower

Can not decrypt appfucator string until codecracker update his calculator tools . 

 

confuser and crypto unpacked 90 %

Good job bro !

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...