Jump to content
Tuts 4 You
  • 0
Sign in to follow this  
JustinOOO

EazFuscator v2018.1

Question

JustinOOO

Difficulty : 5 (?)
Language : C# (.NET)
Platform : Windows
OS Version : Windows 7+
Packer / Protector : EazFuscator v2018.1

Description :

When pressing the "go" button some unknown function takes text from the input box and converts it to something to put in the output box.

Your goal is to unpack the program and provide me with the source code to that function.

Screenshot :

jEilUbA.png

unpack-me.exe

Share this post


Link to post

4 answers to this question

Recommended Posts

  • 2
Abigor

    private void btnGo_Click(object sender, EventArgs e)
    {
        this.txtOutput.Text = main.smethod_0(this.txtInput.Text);
    }
    private static string smethod_0(string string_0)
    {
        byte[] bytes = Encoding.UTF8.GetBytes("5myd2VTtPqB7dJ0i");
        byte[] bytes2 = Encoding.UTF8.GetBytes(string_0);
        byte[] bytes3 = new PasswordDeriveBytes("uh oh... looks like i've been unpacked", null).GetBytes(32);
        ICryptoTransform transform = new RijndaelManaged
        {
            Mode = CipherMode.CBC
        }.CreateEncryptor(bytes3, bytes);
        MemoryStream memoryStream = new MemoryStream();
        CryptoStream cryptoStream = new CryptoStream(memoryStream, transform, CryptoStreamMode.Write);
        cryptoStream.Write(bytes2, 0, bytes2.Length);
        cryptoStream.FlushFinalBlock();
        byte[] inArray = memoryStream.ToArray();
        memoryStream.Close();
        cryptoStream.Close();
        return new string(Convert.ToBase64String(inArray).ToArray<char>().Reverse<char>().ToArray<char>()).Replace("=", string.Empty);
    }

unpack-me_.exe

  • Like 3

Share this post


Link to post
  • 0
demon_da

Hi @JustinOOO

Can you post another one but this Time also with Native Code VM for protecting that specific function?!

Share this post


Link to post
  • 0
Kazura
On 4/27/2018 at 5:30 PM, demon_da said:

Hi @JustinOOO

Can you post another one but this Time also with Native Code VM for protecting that specific function?!

This one is protected with VM Already.

Share this post


Link to post

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  
×
×
  • Create New...