Modded ConfuserEx (Find the Password)

[BillsTheGod]

Platform: Windows
Language: C#/.NET
OS Version: Windows 10 (I only tested on it so)
Protector: Modded ConfuserEx

Objective:

Modification to ConfuserEx; constants, math protection, variablesmelter, antide4dot (broked rn), three antidebugs (one inside antitamper), sizeof, antivm, antiemulator, antidnspy, antijustdecompiler, intergritychecking, typescrambler etc 

Unpack the file and find the password. Document how you deobfuscated it.

https://www.virustotal.com/#/file/3cd889f4be35cb440f4a4a1c3ececc62a7075ccddeb76553e06ad12e96d94fe4/detection (false positive because of the obfuscation)

If there are any errors in this thread or in my english, I am sorry, it is my first time at this forum and I am brazillian

Screenshot:

Download: 

CrackMee.exeFetching info...

[XenocodeRCE]

Hello

 

Password is : 

 

  Reveal hidden contents

firsttahsaying2435dgauuatherworksainsewerofadamyheadi

 

It's relatively easy to get the corretc flag. All your obfuscation routines is not usefull against memory scanning. Enter a wrong pass, click on button, get wrong pass flag, search for it in memory, and the good password is in clear in the file.

 

Also you should consider something as far as dnlib is concerned to shrunk the old strings from the binary file, because the good password is in clear not only in memory (thats to be expected somehow) but also in raw bytes at offset 00001b790

[BillsTheGod]

  On 3/11/2019 at 11:54 AM, XenocodeRCE said:

Hello

 

Password is : 

 

  Reveal hidden contents

firsttahsaying2435dgauuatherworksainsewerofadamyheadi

 

It's relatively easy to get the corretc flag. All your obfuscation routines is not usefull against memory scanning. Enter a wrong pass, click on button, get wrong pass flag, search for it in memory, and the good password is in clear in the file.

 

Also you should consider something as far as dnlib is concerned to shrunk the old strings from the binary file, because the good password is in clear not only in memory (thats to be expected somehow) but also in raw bytes at offset 00001b790

Expand  

Nice work, I re-added Ref Proxy and fixed some issue at it, changed a little bit of MathProtection, fixed sizeof's issues, stopped normal x86 converter and more, I will post another CrackMe soon, Thanks for your reply.