How to Clean & String Decrypt , Thank you 

 

 

UnpackMe.rar

Edited February 8, 201510 yr by patchaya

Emmms, the file it's packed with crypto and confuser, and the title is unpack confuser 1.9

Too lazy to clean all junk classes

 

 

UnpackMe_unpacked.zip

Tutorial:

 

1. MegaDumper, get ResourceAssembly.dll (assembly than contains resources)

2. Use ConfuserDelegateKiller to remove delegates from UnpackMe.exe (google it)

3. de4dot with parameters (-p un --strtyp delegate --strtok 06000043)

4. CryptoObfuscator constant fixer by me (pm if you need)

4. Remove all instructions from <Module>.cctor

5. Attach resources with ResourceManager (use file from step 1)

6. Clean from junk classes and delegates

Edited February 8, 201510 yr by SHADOW_UA

Tutorial:

 

1. MegaDumper, get ResourceAssembly.dll (assembly than contains resources)

2. ConfuserDelegateKiller (google it)

3. de4dot with parameters (-p un --strtyp delegate --strtok 06000043)

4. CryptoObfuscator constant fixer by me (pm if you need)

4. Remove all instructions from <Module>.cctor

5. Attach resources with ResourceManager

6. Clean from junk classes and delegates

I try to use confuser delegate killer but no works 

I try to use confuser delegate killer but no works

ResourceAssembly.dll is for step 6. You need to drag UnpackMe.exe on ConfuserDelegateKiller, not this dll.

ResourceAssembly.dll is for step 6. You need to drag UnpackMe.exe on ConfuserDelegateKiller, not this dll.

and what is the step 1 , i don't understand sorry

Edited February 8, 201510 yr by ♛IvancitoOz♛

@SHADOW_UA  thank you very much  

 

 

Unpacked with cleaning source  , thanks to shadow_ua , unpacked by IvancitoOz

Edited February 10, 201510 yr by ♛IvancitoOz♛

@SHADOW_UA  thank you very much  

@SHADOW_UA  help unpack Obfuscated .net 

Edited September 16, 20169 yr by LeeZay

On 9/16/2016 at 10:17 AM, LeeZay said:

@SHADOW_UA  help unpack Obfuscated .net 

As i can see form the picture that is appfuscator so try to use CodeCracker Apffuscator Unpackers

thank you very much 

On 2/9/2015 at 3:14 AM, SHADOW_UA said:

Tutorial:

 

 

 

 

1. MegaDumper, get ResourceAssembly.dll (assembly than contains resources)

 

 

2. Use ConfuserDelegateKiller to remove delegates from UnpackMe.exe (google it)

 

 

3. de4dot with parameters (-p un --strtyp delegate --strtok 06000043)

 

 

4. CryptoObfuscator constant fixer by me (pm if you need)

 

 

4. Remove all instructions from <Module>.cctor

 

 

5. Attach resources with ResourceManager (use file from step 1)

 

 

6. Clean from junk classes and delegates

 

 

Hi there, i know its been a long time since but i would like to know how to determine the specific string token to use in de4dot?

Hello friend.

I need "CryptoObfuscator constant fixer".

¿Can you send me it?

Thanks.

PD: I'm spanish and my english is very bad.

Hello friend.

I need too "ResourceManager".

¿Can you send me it?

Thanks.

Edited December 23, 20177 yr by aguml