[Unpack]Crypto+Confuser 1.9

[patchaya]

How to Clean & String Decrypt , Thank you 

 

 

UnpackMe.rar

Edited February 8, 2015 by patchaya

[ιvancιтooz]

Emmms, the file it's packed with crypto and confuser, and the title is unpack confuser 1.9

[SHADOW_UA]

Too lazy to clean all junk classes

 

 

UnpackMe_unpacked.zip

[SHADOW_UA]

Tutorial:

 

1. MegaDumper, get ResourceAssembly.dll (assembly than contains resources)

2. Use ConfuserDelegateKiller to remove delegates from UnpackMe.exe (google it)

3. de4dot with parameters (-p un --strtyp delegate --strtok 06000043)

4. CryptoObfuscator constant fixer by me (pm if you need)

4. Remove all instructions from <Module>.cctor

5. Attach resources with ResourceManager (use file from step 1)

6. Clean from junk classes and delegates

Edited February 8, 2015 by SHADOW_UA

[ιvancιтooz]

  On 2/8/2015 at 7:14 PM, SHADOW_UA said:

Tutorial:

 

1. MegaDumper, get ResourceAssembly.dll (assembly than contains resources)

2. ConfuserDelegateKiller (google it)

3. de4dot with parameters (-p un --strtyp delegate --strtok 06000043)

4. CryptoObfuscator constant fixer by me (pm if you need)

4. Remove all instructions from <Module>.cctor

5. Attach resources with ResourceManager

6. Clean from junk classes and delegates

I try to use confuser delegate killer but no works 

[SHADOW_UA]

  On 2/8/2015 at 8:41 PM, ♛IvancitoOz♛ said:

I try to use confuser delegate killer but no works

ResourceAssembly.dll is for step 6. You need to drag UnpackMe.exe on ConfuserDelegateKiller, not this dll.

[ιvancιтooz]

  On 2/8/2015 at 8:44 PM, SHADOW_UA said:

ResourceAssembly.dll is for step 6. You need to drag UnpackMe.exe on ConfuserDelegateKiller, not this dll.

and what is the step 1 , i don't understand sorry

Edited February 8, 2015 by ♛IvancitoOz♛

[patchaya]

@SHADOW_UA  thank you very much  

[ιvancιтooz]

 

 

Unpacked with cleaning source  , thanks to shadow_ua , unpacked by IvancitoOz

Edited February 10, 2015 by ♛IvancitoOz♛

[ghostfish]

@SHADOW_UA  thank you very much  

[LeeZay]

@SHADOW_UA  help unpack Obfuscated .net 

Edited September 16, 2016 by LeeZay

[TheProxy RE]

  On 9/16/2016 at 8:17 AM, LeeZay said:

@SHADOW_UA  help unpack Obfuscated .net 

Expand  

As i can see form the picture that is appfuscator so try to use CodeCracker Apffuscator Unpackers

[antony]

thank you very much 

[ymmxl]

  On 2/8/2015 at 7:14 PM, SHADOW_UA said:

Tutorial:

 

 

 

 

1. MegaDumper, get ResourceAssembly.dll (assembly than contains resources)

 

 

2. Use ConfuserDelegateKiller to remove delegates from UnpackMe.exe (google it)

 

 

3. de4dot with parameters (-p un --strtyp delegate --strtok 06000043)

 

 

4. CryptoObfuscator constant fixer by me (pm if you need)

 

 

4. Remove all instructions from <Module>.cctor

 

 

5. Attach resources with ResourceManager (use file from step 1)

 

 

6. Clean from junk classes and delegates

 

Expand  

 

Hi there, i know its been a long time since but i would like to know how to determine the specific string token to use in de4dot?

[aguml]

Hello friend.

I need "CryptoObfuscator constant fixer".

¿Can you send me it?

Thanks.

PD: I'm spanish and my english is very bad.

[aguml]

Hello friend.

I need too "ResourceManager".

¿Can you send me it?

Thanks.

Edited December 23, 2017 by aguml