Jump to content
Tuts 4 You

UnpackMe ConfuserEx Modified


NightBaron
Go to solution Solved by SHADOW_UA,

Recommended Posts

Difficulty : 3-4
Language : .NET
Platform : Windows
OS Version : All Windows (.NET Framework 4.6 or higher)
Packer / Protector : ConfuserEx Modified

Description :

Fully unpack the file , and keep the application working

and make a Short Tut for it.

Screenshot :

067877e76eb14638a6d77960f5cbda85.png.a4eb64a2c47d0dea9d7be2126ce3a4b9.png

 

Download

ConsoleApplication1.rar

Link to comment
  • Solution

First you need to dump and decrypt code of main module. You can stop on System.Runtime.InteropServices.GCHandle.get_Target in mscorlib.dll, after returning from it in eax will be pointer to main module in memory. Dump and decrypt it using UnConfuserEx or manually (code will be decrypted after first call in .cctor()).

After that just use CodeCracker's tools except Constant Decryptor (you need to modify the code of this tool to search for string decrypter method with two arguments instead of one).

Unpacked file attached (not cleaned from trash):

 

 

unpacked.zip

  • Like 3
Link to comment

@SHADOW_UA: Thanks for sharing the method to unpack.

@BambooQJ: Thanks for recording but was unable to extract the password protected file "ConfuserEx 脱壳教程.7z".

Edited by yinhuo
Link to comment

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...