UnpackMe ConfuserEx Modified

[NightBaron]

Difficulty : 3-4
Language : .NET
Platform : Windows
OS Version : All Windows (.NET Framework 4.6 or higher)
Packer / Protector : ConfuserEx Modified

Description :

Fully unpack the file , and keep the application working

and make a Short Tut for it.

Screenshot :

 

Download

ConsoleApplication1.rar

[SHADOW_UA]

First you need to dump and decrypt code of main module. You can stop on System.Runtime.InteropServices.GCHandle.get_Target in mscorlib.dll, after returning from it in eax will be pointer to main module in memory. Dump and decrypt it using UnConfuserEx or manually (code will be decrypted after first call in .cctor()).

After that just use CodeCracker's tools except Constant Decryptor (you need to modify the code of this tool to search for string decrypter method with two arguments instead of one).

Unpacked file attached (not cleaned from trash):

 

 

unpacked.zip

[NightBaron]

@SHADOW_UA

Thanks for answer to my thread  

[DrakPack]

@SHADOW_U

thanks

please answer specific how to unpack. 

Edited February 25, 2017 by DrakPack

[BambooQJ]

I recorded a tutorial

http://www.jmpoep.com/thread-2875-1-1.html

链接：https://pan.baidu.com/s/1gfbuCQR 密码：dfea

 

[yinhuo]

@SHADOW_UA: Thanks for sharing the method to unpack.

@BambooQJ: Thanks for recording but was unable to extract the password protected file "ConfuserEx 脱壳教程.7z".

Edited February 26, 2017 by yinhuo

[NightBaron]

@yinhuo

the password to extract :  www.jmpoep.com

[MindSystem]

7 hours ago, BambooQJ said:

I recorded a tutorial

http://www.jmpoep.com/thread-2875-1-1.html

链接：https://pan.baidu.com/s/1gfbuCQR 密码：dfea

 

When i launch the exe, it writes me failed1, what do i have to do?

[BambooQJ]

1 hour ago, Legend-Modz-V1 said:

When i launch the exe, it writes me failed1, what do i have to do?

Code Cracker  Tutorial   

[YuqseLx]

2 hours ago, Legend-Modz-V1 said:

When i launch the exe, it writes me failed1, what do i have to do?

Change file name to "a" or something

[BambooQJ]

I can unpacked  But can't clear the confusion

 

123.7z

Edited February 26, 2017 by BambooQJ