Fu*ckuscator v1.1

Brand new obfuscator on the market.

I've already completed this crackme but wanted to see what you guys come up with.

Good luck!

File Information

Submitter Asentrix

Submitted 12/28/2020

Category CrackMe

View File

Is this another confuser mutant ?

Spoiler

Correct pass: wjdaisjdaowidjasoijdwdjaisuhdiouhaeoiheufaiouehfasiuohfeiofhuasdifu98729837642897346298374629837462897346928374

Approach

Spoiler

Didn't even open the app in a decompiler or attempted to deobfuscate. CrackMe's that use string.Equals with the correct serial immediately makes it a 0/10 difficulty challenge

Steps to reproduce:

• Run program
• Attach WinDbg and load SOS extension (.loadby sos clr)
• Set breakpoint on System.String.Equals(string, string), (e.g. using !name2ee mscorlib.dll System.String.Equals to get the address, and using bp to set the breakpoint)
• Continue
• Enter random text
• Notice breakpoint hit.
• Run !dumpstackobjects
• Observe correct password:

 

Edited December 30, 20204 yr by Washi

On 12/30/2020 at 11:42 AM, Washi said:

  Reveal hidden contents

Correct pass: wjdaisjdaowidjasoijdwdjaisuhdiouhaeoiheufaiouehfasiuohfeiofhuasdifu98729837642897346298374629837462897346928374

Approach

  Reveal hidden contents

Didn't even open the app in a decompiler or attempted to deobfuscate. CrackMe's that use string.Equals with the correct serial immediately makes it a 0/10 difficulty challenge

Steps to reproduce:

• Run program
• Attach WinDbg and load SOS extension (.loadby sos clr)
• Set breakpoint on System.String.Equals(string, string), (e.g. using !name2ee mscorlib.dll System.String.Equals to get the address, and using bp to set the breakpoint)
• Continue
• Enter random text
• Notice breakpoint hit.
• Run !dumpstackobjects
• Observe correct password:

 

Nice work

i cant deob the calli ;  

some new encryption may be ?

 

but i reconstruct the exe with some old tools

How i have done ======

1. dotnet dumper with dont rename option 

2. reconstruct blod , us , string with cff explorer (i used)

3. universel fixer for fixed some dummy pe

4. de4dot option --keep-names-d --keep-types 

5. now we can reflect the code with lutz reflector

6. confuser codecracker tools 

7. drop again de4dot with 45 error what ever now SIMPLE ASSEMBLY EXPLORER for crack

CrackMe69420_C_Cracked.exe

Edited January 11, 20214 yr by Death

Passwords:

Spoiler

wjdaisjdaowidjasoijdwdjaisuhdiouhaeoiheufaiouehfasiuohfeiofhuasdifu98729837642897346298374629837462897346928374

1. Remove Hide Methods, Remove Calli and Cflow

2. Remove Math

3. Decrypt Base64

 

That's about it. For new guys, figure it out yourself first. 😁