Jump to content
Tuts 4 You

UnpackMe ConfuserEx Modified

Go to solution Solved by SHADOW_UA,

Recommended Posts

Difficulty : 3-4
Language : .NET
Platform : Windows
OS Version : All Windows (.NET Framework 4.6 or higher)
Packer / Protector : ConfuserEx Modified

Description :

Fully unpack the file , and keep the application working

and make a Short Tut for it.

Screenshot :





Link to comment
Share on other sites

  • Solution

First you need to dump and decrypt code of main module. You can stop on System.Runtime.InteropServices.GCHandle.get_Target in mscorlib.dll, after returning from it in eax will be pointer to main module in memory. Dump and decrypt it using UnConfuserEx or manually (code will be decrypted after first call in .cctor()).

After that just use CodeCracker's tools except Constant Decryptor (you need to modify the code of this tool to search for string decrypter method with two arguments instead of one).

Unpacked file attached (not cleaned from trash):




  • Like 3
Link to comment
Share on other sites

@SHADOW_UA: Thanks for sharing the method to unpack.

@BambooQJ: Thanks for recording but was unable to extract the password protected file "ConfuserEx 脱壳教程.7z".

Edited by yinhuo
Link to comment
Share on other sites

2 hours ago, Legend-Modz-V1 said:

When i launch the exe, it writes me failed1, what do i have to do?

Change file name to "a" or something

  • Like 2
Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Create New...