Difficulty : 4
Language : .NET
Platform : Windows
OS Version : All
Packer / Protector : ConfuserEx Modded

Description :

Hi , one guy is selling his protector (confuserex modded) and it is really expensive. I want to know if someone can unpack that because I don't trust him and his paid protector =/

Thanks in advanced

Good Luck!

Screenshot :

UNpackme.exe

hang on.. paid as in you'll pay to get this cracked or you got him to protect an unpackme with his protector and want it 'evaluated' ? 

Excuse for bad english, i'm not fluent

So he protect the unpackme and I just want to now if it's easy to unpack, don't really need a unpack just someone to say if is easy. But with a unpack I can prove for him that his packer is not good enough for the price (it is really expansive). But if is not easy I will buy. =p

 

Here we go again lol

23 hours ago, [L]over said:

Excuse for bad english, i'm not fluent

So he protect the unpackme and I just want to now if it's easy to unpack, don't really need a unpack just someone to say if is easy. But with a unpack I can prove for him that his packer is not good enough for the price (it is really expansive). But if is not easy I will buy. =p

Please, can you say the name of the person that sell this paid version? 

2 hours ago, Legend-Modz-V1 said:

Please, can you say the name of the person that sell this paid version? 

Hi, his skype is ben-mhenni_

Just use NETGuard. Ben mhenni can be deobfuscated and NETGuard too but it's more professional. Also Ben Mhenni has many bugs so i don't recommend buying it

Edited April 24, 20178 yr by mrtifa12

On 7/4/2019 at 2:07 AM, 0x63 said:

İngilizce yazsam,"sori four may bad england" dersin.

senin burada ne işin var yavrum siktir git Allah aşkına

 

 yavrum demek'ki ok canım bu arada milletin artıklarını kullanmak'da çok iyisiniz biraz adam olun kendi korumanızı kendiniz yapın KOLSUZLAR!

On 7/4/2019 at 2:07 AM, 0x63 said:

İngilizce yazsam,"sori four may bad england" dersin.

senin burada ne işin var yavrum siktir git Allah aşkına

 

ve biraz adam ol ülkene saygı duy VPN kullanma

lol ben mheni again. ok, i got it unpacked but not the cflow cuz i am not good at removing those.

how i unpacked it? well...

1. i removed antitamper with dnspy.

2. removed protection calls in cctor with dnspy.

3. Removed proxy calls and delegates with @TheProxy RE's proxy call fixer.

4. Removed all sizeof mutations with my tool and i ran it on de4dot through fix nops and calculations.

5. Converted all x86 Methods to IL with my tool.

6. decrypted constants with my tool.

7. i ran it through de4dot to clean everything else.

 

UNpackme3_noProxy-SizeOfRemoved-cleaned-NoX86-StringDec-cleaned.exe

Anyone can de-cflow it?

Cleaned Control Flow. I doubt my answer has any interests since I simply used a premade tool I unfortunately can't share but well, it could be useful for someone, who knows?

UNpackme3 - fully unpacked.exe