[UnPackMe] ConfuserEX 0.4.0 Only compression used.

[madskillz]

[unPackMe]

 

Packed with ConfuserEX 0.4.0 compiled as on 14-01-2015 from github source.

 

Only Compression Packer setting is used.

 

Please write a tutorial on manually unpacking it.

 

Thank you

 

 

Unpackme_ConfuserEXonlyCompression.zip

[GIV]

Please write a tutorial on manually unpacking it.

Sure.

Everybody need a tutorial.

Better not.

Private Sub InitializeComponent()    Me.textBox1 = New TextBox    MyBase.SuspendLayout    Me.textBox1.Location = New Point(&H48, 100)    Me.textBox1.Name = "textBox1"    Me.textBox1.Size = New Size(&H79, 20)    Me.textBox1.TabIndex = 0    Me.textBox1.Text = "Make a Tutorial please"    AddHandler Me.textBox1.TextChanged, New EventHandler(AddressOf Me.textBox1_TextChanged)    MyBase.AutoScaleDimensions = New SizeF(6!, 13!)    MyBase.AutoScaleMode = AutoScaleMode.Font    MyBase.ClientSize = New Size(&H11C, &H105)    MyBase.Controls.Add(Me.textBox1)    MyBase.Name = "Form1"    Me.Text = "Form1"    MyBase.ResumeLayout(False)    MyBase.PerformLayoutEnd Sub

Unpackme_unpacked.7z

Edited January 14, 2015 by GIV

[SomethingDarkInsideMe]

Too easy

 

 

using System;

using System.ComponentModel;

using System.Drawing;

using System.Windows.Forms;

namespace WindowsFormsApplication3

{

   public class Form1 : Form

   {

        private IContainer components = null;

        private TextBox textBox1;

       public Form1()

       {

           this.InitializeComponent();

       }

       private void textBox1_TextChanged(object sender, EventArgs e)

       {

       }

       protected override void Dispose(bool disposing)

       {

           if (disposing && this.components != null)

           {

               this.components.Dispose();

           }

           base.Dispose(disposing);

       }

       private void InitializeComponent()

       {

           this.textBox1 = new TextBox();

           base.SuspendLayout();

           this.textBox1.Location = new Point(72, 100);

           this.textBox1.Name = "textBox1";

           this.textBox1.Size = new Size(121, 20);

           this.textBox1.TabIndex = 0;

           this.textBox1.Text = "Make a Tutorial please";

           this.textBox1.TextChanged += new EventHandler(this.textBox1_TextChanged);

           base.AutoScaleDimensions = new SizeF(6f, 13f);

           base.AutoScaleMode = AutoScaleMode.Font;

           base.ClientSize = new Size(284, 261);

           base.Controls.Add(this.textBox1);

           base.Name = "Form1";

           this.Text = "Form1";

           base.ResumeLayout(false);

           base.PerformLayout();

       }

   }

}

 

[SomethingDarkInsideMe]

Just use UnConfuserEx

Edited January 14, 2015 by SomethingDarkInsideMe

[GIV]

Just use UnConfuserEx

The autor want a "manual" unpack tutorial.

The sources are public.

Why don't study the protector a little to see how to reverse?

What could be simple?

[madskillz]

Yes unconfuserex works on it.

 

Only Compression Packer setting is used.

 

Someone could make a manual tutorial.

[GIV]

Read what i wrote above.

Is not fair enough?

[Hadits follower]

it is toooooooo easy to dump the dump koi module or decrypt the code by ollydbg just find it on memory by search "koi" ascii .

no matter what ever it does pack , max or other but still can dump it within few sec from olly map

[madskillz]

I posted the same time when you did , so I did not see it before posting it was not updated.

 

I agree with you the source is publicly available.

[madskillz]

http://gyazo.com/1437c4ea05496bbc04c7ee908f13c4f5

[Hadits follower]

is there any short size desktop recorder available if so can link that will make a short cut video decrypt confuser old or ex what ever it does still simple decrypt code and dump main module

[GIV]

is there any short size desktop recorder available if so can link that will make a short cut video decrypt confuser old or ex what ever it does still simple decrypt code and dump main module

Sure:

 

http://www.screen-record.com/screen2exe.htm

[Hadits follower]

https://forum.tuts4you.com/topic/36671-confuser-history-dump-module-and-decrypt-code-tut/

 

i hope this will help u out

[★ριмραηмσ∂z™★]

To easy :

using System;

using System.ComponentModel;

using System.Drawing;

using System.Windows.Forms;

namespace WindowsFormsApplication3

{

   public class Form1 : Form

   {

        private IContainer components = null;

        private TextBox textBox1;

       public Form1()

       {

           this.InitializeComponent();

       }

       private void textBox1_TextChanged(object sender, EventArgs e)

       {

       }

       protected override void Dispose(bool disposing)

       {

           if (disposing && this.components != null)

           {

               this.components.Dispose();

           }

           base.Dispose(disposing);

       }

       private void InitializeComponent()

       {

           this.textBox1 = new TextBox();

           base.SuspendLayout();

           this.textBox1.Location = new Point(72, 100);

           this.textBox1.Name = "textBox1";

           this.textBox1.Size = new Size(121, 20);

           this.textBox1.TabIndex = 0;

           this.textBox1.Text = "Make a Tutorial please";

           this.textBox1.TextChanged += new EventHandler(this.textBox1_TextChanged);

           base.AutoScaleDimensions = new SizeF(6f, 13f);

           base.AutoScaleMode = AutoScaleMode.Font;

           base.ClientSize = new Size(284, 261);

           base.Controls.Add(this.textBox1);

           base.Name = "Form1";

           this.Text = "Form1";

           base.ResumeLayout(false);

           base.PerformLayout();

       }

   }

}

 

File Unpacked : UnpackMe-Unpcked

Edited January 15, 2015 by ★ριмραηмσ∂z™★

[Teehvsx]

This was easy, however had a problem, the executable has stopped working out, what can I do so he can return to work?

 the assembly has all the same as mentioned above.

private void InitializeComponent()

{

    this.textBox1 = new TextBox();

    base.SuspendLayout();

    this.textBox1.Location = new Point(0x48, 100);

    this.textBox1.Name = "textBox1";

    this.textBox1.Size = new Size(0x79, 20);

    this.textBox1.TabIndex = 0;

    this.textBox1.Text = "Make a Tutorial please";

    this.textBox1.TextChanged += new EventHandler(this.textBox1_TextChanged);

    base.AutoScaleDimensions = new SizeF(6f, 13f);

    base.AutoScaleMode = AutoScaleMode.Font;

    base.ClientSize = new Size(0x11c, 0x105);

    base.Controls.Add(this.textBox1);

    base.Name = "Form1";

    this.Text = "Form1";

    base.ResumeLayout(false);

    base.PerformLayout();

}

  private void InitializeComponent()

{

    this.textBox1 = new TextBox();

    base.SuspendLayout();

    this.textBox1.Location = new Point(0x48, 100);

    this.textBox1.Name = "textBox1";

    this.textBox1.Size = new Size(0x79, 20);

    this.textBox1.TabIndex = 0;

    this.textBox1.Text = "Make a Tutorial please";

    this.textBox1.TextChanged += new EventHandler(this.textBox1_TextChanged);

    base.AutoScaleDimensions = new SizeF(6f, 13f);

    base.AutoScaleMode = AutoScaleMode.Font;

    base.ClientSize = new Size(0x11c, 0x105);

    base.Controls.Add(this.textBox1);

    base.Name = "Form1";

    this.Text = "Form1";

    base.ResumeLayout(false);

    base.PerformLayout();

}

[ιvancιтooz]

unpacked

Unpackme_ConfuserEXonlyCompression-unpacked.rar

[atom0s]

 

Sure.

Everybody need a tutorial.

Better not.

Private Sub InitializeComponent()

Me.textBox1 = New TextBox

MyBase.SuspendLayout

Me.textBox1.Location = New Point(&H48, 100)

Me.textBox1.Name = "textBox1"

Me.textBox1.Size = New Size(&H79, 20)

Me.textBox1.TabIndex = 0

Me.textBox1.Text = "Make a Tutorial please"

AddHandler Me.textBox1.TextChanged, New EventHandler(AddressOf Me.textBox1_TextChanged)

MyBase.AutoScaleDimensions = New SizeF(6!, 13!)

MyBase.AutoScaleMode = AutoScaleMode.Font

MyBase.ClientSize = New Size(&H11C, &H105)

MyBase.Controls.Add(Me.textBox1)

MyBase.Name = "Form1"

Me.Text = "Form1"

MyBase.ResumeLayout(False)

MyBase.PerformLayout

End Sub

 

Not to sound rude but why is this a popular trend in the latest unpackme / crackme / keygenme topics here.. everyone refuses to post tutorials. Did everyone forget the point of this site being to share knowledge and tutorials of cracking/unpacking things? It's a bit upsetting to see anyone with under a certain post count get treated like garbage here anymore as if post count equates to anything other then the literal post count. 

[kao]

@at0mos: In the last few years the quality of "crackmes" posted here has gone down from "umm, a crackme, will be fun to reverse it!" to "did he use ConfuserEx or ILProtector?" The point of this site is not to use commercial protectors to protect 10-line crap-me, and then request a tutorial on how to defeat the protector. 

[GIV]

As long as pro users post here tools for this protector or other there is no fun and 90% of the user that post the solution just use tools that others developed.

That kind of users don't have any idea about the protector that have been stripped away from encapsulated executable. They just don't know nothing. They just know that in Olly click there, put a ret there, use that kind of script or tool and tadaaaaa.... you are a great unpacker/cracker etc (i myself believe that someday in the past ). In fact i did not know nothing abut anything just use some work of other pro users.

 

So a tutorial is useless IMHO in most of the cases and here i post my second conclusion.

 

Most of the users who request tutorials use the tutorials to pirate commercial things.

Anyway, great respect for the user who post QUALITY tutorials.

 

 

 

[Base64]

atom0s -

Totally agree with you my friend

Giv & Kao -

If you don't like then it's just you guys point Of view which you see after getting good knowledge of subject

Yes this unpack me doesn't offer much & level of such challenges fall

But no one here control interest factor of others

Why don't you guy's see the other side of such post?

It's just because Most of Pro user don't share the way they do that in most of unpack me

When someone ask for method they just put some random theory or reference to some source

I mean everyone here is not relates to good understanding of codes but this kind of small things help

Yes! Spoon feeding is not good but little favour and Guidance of you guy's will help a lot for amateurs like us

At the end of day it doesn't matter that one is noob or pro but we all are learners here

Peace & Respect

Base64

[GIV]

When someone ask for method they just put some random theory or reference to some source

 

Really?

Random theory.

Do you think that doing without knowing what you do is a good option?

[Base64]

The one who know the subject it's not

But for noobs it's pure theory & for them following such institutions are like walking on the path were they have no idea what they are doing

PS- I am not arguing, do correct me if I m still wrong

[GIV]

10 x lol

That's because "noobs" start to do things upside down. Start from the most complicated thing (read protector) to the easy one.

The things must go from easy to hard.

As in native you must go from UPX unpack to VMProtect (let's say) here must be the same. Not backwards.

That is why "noobs" should first accommodate with theory, weak protectors/packers etc then go to next step.

For me case is closed, i don't want to hijack this thread.

[madskillz]

Tutorial by me for OP's unpackme.

 

The resulting file is unpacked but cant run.

 

Check it out and comment please to help , correct , etc.

 

Tutorial.rar

Edited March 22, 2015 by madskillz

[GIV]

If it cannot run then is not unpacked=not good for any use.