Jump to content

CryptoObfuscator v2020.200911

Go to solution Solved by BataBo,

Recommended Posts

This was a fun challenge!



Steps that i took:

There is probably a better way to do this, but oh well.

  • Drag n drop the file on dnspy, we can see that CommandSerializer is a winform and UpdateServer is the button click handler. The button click handler method seems to be invoking a multicastdelegate - which is the dynamic method. I found that the quickest way of dealing with this protection is simply loading the assembly and getting the value of the field dynamically, then using asmresolver (dnlib should work aswell with dynamicbodyreader) we use CilMethodBody.FromDynamicMethod & set the cilmethodbody of the method to the result.
  • Analyzing the file i found that we have to input 5 numbers, seperated by dashes. Simply putting a breakpoint on the Sum method of IEnumerable<int> and inputting 5 random numbers (ex. 1-1-1-1-1), will call it 5 different times, writing down the numbers it returns, seperated by dashes, will get us our serial. (note - we are debugging the original file)



  • Thanks 2
Link to comment

very nice @TobitoFatito

spacer.png how much time to reach @ "Simply putting a breakpoint on the Sum method of IEnumerable<int> and inputting 5 random numbers (ex. 1-1-1-1-1), will call it 5 different times", as I wrote a complex code, on how it call the method do the summation.



the only glitch is @ 


by this, what I understood, you cant read the exact code. just get the sum values by the debugger.

Edited by whoknows
Link to comment
  • Solution

This assembly was challenging but I managed to unpack it,

1.)At some point in execution the program decrypts methods and the method IL code is stored in byte array so I log that array

2.)I automatically decrypt all methods and fix all adresses, but assembly breaks

3.)I analyze the assembly and get all the relevant methods and manually fix the assembly

4.)While I was at it I also removed a lot of junk from the assembly

So here is the result


  • Thanks 1
Link to comment


impressive how you restore back the code..  the button click works like this : 






   host.Initialize doing some reflection.

  host.PropagateEvent doing the call to 'methods' you putted on the form class. 



The origin EXE structure



impressive impressive impressive impressive impressive. well done...



also removed a lot of junk from the assembly

was all the 'dynamic' thing I done on this classes^  :) 


I have submit rev2 by 16/12.. still w8ing for approval.

Edited by whoknows
Link to comment
  • 1 year later...

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Create New...