FujiFuscator

[weston2337]

Difficulty : (3-4 Maybe?)
Language : (C# .NET)
Platform : (Windows)
OS Version : (Windows 10)
Packer / Protector : (FujiFuscator)

Description :

Please give me a detailed tutorial on how you unpacked this.

Screenshot :

UnPackMe.exe

[Cursedzx]

Just used public tools to get everything.

Lazy2Clean.exe

[SHADOW_UA]

Fully cleaned

 

UnPackMe_unp_.zip

[ozancglr]

On 12/10/2018 at 5:08 PM, Cursedzx said:

Just used public tools to get everything.

Lazy2Clean.exe

how can i use the program

 

[HackerTA]

On 10.12.2018 at 17:16, SHADOW_UA said:

Полностью очищен

 

UnPackMe_unp_.застежка-молния

How did you do that?

 

[boi420]

how do you use lazy2clean my os is on windows 7 and it will crash

[looikuj]

can someone explain what FujiFuscator is and how to unpack it?

[bruhware2811]

Lazy2Clean is the fujifuscated executable, but not fully cleaned.

[Prab]

How i did it :

1. Remove Anti Tamper
2. x86 retranslater
3. Edit Module -> Cor20 -> ILOnly
4. Clean Control Flow
5. Constants Decryptor
6. ConfuserEx Protections Call Killer (clean junks)

UnPackMe-tamp_noX86_ILOnly-NoFlow-ConstantDec_Killed.exe

Edited June 9, 2020 by Prab
Added Image

[CreateAndInject]

@Prab  Do you  write some tools yourself? I think you can't clean this file just with these tools, such as:

 Does `Constants Decryptor` support `sizeof` instruction? Do you write tools yourself to convert `sizeof` to `ldc`？

[Prab]

1 hour ago, CreateAndInject said:

@Prab  Do you  write some tools yourself? I think you can't clean this file just with these tools, such as:

 Does `Constants Decryptor` support `sizeof` instruction? Do you write tools yourself to convert `sizeof` to `ldc`？

I forgot to mentioned that i used TheProxy's Cflow cleaner and it did it job

[CreateAndInject]

What is FujiFuscator? Is there an official website? How to download the obfuscator in order to make more test.

[CreateAndInject]

@SHADOW_UA @Prab

I didn't find this obfuscator, but there's another one protected by FujiFuscator:

 

[joinexception]

On 6/9/2020 at 1:26 PM, Prab said:

I forgot to mentioned that i used TheProxy's Cflow cleaner and it did it job

whats the secret key?

 

[nausixkiz]

On 6/9/2020 at 6:26 PM, Prab said:

TheProxy's Cflow cleaner

Can you sharing it?