ConfuserEx 1.6.0

Public key sample protected using ConfuserEx 1.6.0.

https://github.com/mkaring/ConfuserEx/releases/tag/v1.6.0

Your challenge is to unpack and decompile the file.

File Information

Submitter cipsi

Submitted 02/04/2023

Category UnPackMe (.NET)

View File

 

• Debug with dnSpy and Remove Anti-Tamper.
• NOP Anti-Tamper Call and Save.
• Search for "GCHandle.Free" and put BP.
• Debug the File and Save koi module from Memory.
• NOP Anti-Tamper Call after debugging in dnSpy.
• Clean Cflow as It is a basic "switch" one.
• Clean Proxy.
• Clean Constants.
• Rename using de4dot.

 

WindowsFormsApp1_unpacked.exe

39 minutes ago, BlackHat said:

 

• Debug with dnSpy and Remove Anti-Tamper.
• NOP Anti-Tamper Call and Save.
• Search for "GCHandle.Free" and put BP.
• Debug the File and Save koi module from Memory.
• NOP Anti-Tamper Call after debugging in dnSpy.
• Clean Cflow as It is a basic "switch" one.
• Clean Proxy.
• Clean Constants.
• Rename using de4dot.

 

WindowsFormsApp1_unpacked.exe 11.5 kB · 0 downloads

Can you elaborate a bit on the part about cleaning the control flow?

12 hours ago, cipsi said:

Can you elaborate a bit on the part about cleaning the control flow?

1. You don't need any tool to remove Anti Tamper.

2. Cflow/Proxy = Use Cawk Cfex Unpacker/ TheProxy Proxy Remover.

3. Contants = You have to make your own as Cawk Unpacker doesn't support newer version of Cfex Mods. 

4. de4dot is available on Github.

On 2/4/2023 at 1:33 PM, BlackHat said:

1. You don't need any tool to remove Anti Tamper.

2. Cflow/Proxy = Use Cawk Cfex Unpacker/ TheProxy Proxy Remover.

3. Contants = You have to make your own as Cawk Unpacker doesn't support newer version of Cfex Mods. 

4. de4dot is available on Github.

i can't get tools can you upload it and some hint for use it . Thanks

On 2/4/2023 at 3:16 PM, BlackHat said:

 

• Debug with dnSpy and Remove Anti-Tamper.
• NOP Anti-Tamper Call and Save.
• Search for "GCHandle.Free" and put BP.
• Debug the File and Save koi module from Memory.
• NOP Anti-Tamper Call after debugging in dnSpy.
• Clean Cflow as It is a basic "switch" one.
• Clean Proxy.
• Clean Constants.
• Rename using de4dot.

 

WindowsFormsApp1_unpacked.exe 11.5 kB · 14 downloads

can you explain or share your tools ? 
have a problem when unpack confuser.core same as above, cctor just have gchandle.free and i bp just have koi.exe no have entry point

On 8/21/2023 at 9:08 AM, fireboxdev said:

can you explain or share your tools ? 
have a problem when unpack confuser.core same as above, cctor just have gchandle.free and i bp just have koi.exe no have entry point

upload the file to see it

i have file ConfuserEx 1.6.0 . but it not exe only  file .dll . how to do dubug

you can't debug dll

find exe that runs you dll

 

no create an assembly loader to load the dll and then use dnspy and the rest

 

loader not enough

you need to call dll API

 

yes you call it inside a assembly loader app

this is .dll file it has all the functions of .exe .exe file just call up and written in c++ to call .dll file to run

 

@kenvevn

did u try @

forum.tuts4you.com/topic/45360-confuseexdantitamper/#findComment-224077

?

https://www.youtube.com/watch?v=D1uc1u2d3Dw&t=161s

Edited yesterday at 08:35 AM1 day by .hloire

On 8/21/2023 at 9:08 PM, fireboxdev said:

can you explain or share your tools ? 
have a problem when unpack confuser.core same as above, cctor just have gchandle.free and i bp just have koi.exe no have entry point

fixxing entry point?

Write Click on Koi Press Alt + Enter Click on Managed & Click on empty Box then select your Entry point. Press ok....

Edited yesterday at 10:50 AM1 day by .hloire

@.hloire there is another confuser-ex on steroids -> https://forum.tuts4you.com/topic/40934-fujifuscator/

try to put your stanza over it! :)

20 hours ago, jackyjask said:

@.hloire there is another confuser-ex on steroids -> https://forum.tuts4you.com/topic/40934-fujifuscator/

try to put your stanza over it! :)

@jackyjask this one....

@jackyjask Friend You want tutorial for thiss.

Edited 9 hours ago9 hr by .hloire