Posted February 25, 20178 yr Difficulty : 3-4Language : .NETPlatform : WindowsOS Version : All Windows (.NET Framework 4.6 or higher)Packer / Protector : ConfuserEx Modified Description : Fully unpack the file , and keep the application working and make a Short Tut for it. Screenshot : Download ConsoleApplication1.rar
February 25, 20178 yr Solution First you need to dump and decrypt code of main module. You can stop on System.Runtime.InteropServices.GCHandle.get_Target in mscorlib.dll, after returning from it in eax will be pointer to main module in memory. Dump and decrypt it using UnConfuserEx or manually (code will be decrypted after first call in .cctor()). After that just use CodeCracker's tools except Constant Decryptor (you need to modify the code of this tool to search for string decrypter method with two arguments instead of one). Unpacked file attached (not cleaned from trash): unpacked.zip
February 25, 20178 yr @SHADOW_U thanks please answer specific how to unpack. Edited February 25, 20178 yr by DrakPack
February 26, 20178 yr I recorded a tutorial http://www.jmpoep.com/thread-2875-1-1.html 链接:https://pan.baidu.com/s/1gfbuCQR 密码:dfea
February 26, 20178 yr @SHADOW_UA: Thanks for sharing the method to unpack. @BambooQJ: Thanks for recording but was unable to extract the password protected file "ConfuserEx 脱壳教程.7z". Edited February 26, 20178 yr by yinhuo
February 26, 20178 yr 7 hours ago, BambooQJ said: I recorded a tutorial http://www.jmpoep.com/thread-2875-1-1.html 链接:https://pan.baidu.com/s/1gfbuCQR 密码:dfea When i launch the exe, it writes me failed1, what do i have to do?
February 26, 20178 yr 1 hour ago, Legend-Modz-V1 said: When i launch the exe, it writes me failed1, what do i have to do? Code Cracker Tutorial
February 26, 20178 yr 2 hours ago, Legend-Modz-V1 said: When i launch the exe, it writes me failed1, what do i have to do? Change file name to "a" or something
February 26, 20178 yr I can unpacked But can't clear the confusion 123.7z Edited February 26, 20178 yr by BambooQJ
Create an account or sign in to comment