Exetools

Exetools (https://forum.exetools.com/index.php)
-   Community Tools (https://forum.exetools.com/forumdisplay.php?f=47)
-   -   .NET Obfuscator Detector (https://forum.exetools.com/showthread.php?t=15751)

LordCoder 04-27-2014 03:32

.NET Obfuscator Detector
 
Hello,

After a bit period of inactivity I come here with a new project.

As you know, DNiD is not updated. ProtectioniD has a bit of detection for .NET but not all the obfuscators. So I decided to create a new obfuscator detector (and because I don't know how to name my projects I just put that :D).

Features:

-Good detection with +85% probability. It doesn't show a result if it's not sure.
-Gives clear information about which is/are the protector/s.
-It even gives information if it's a trial version and how many days are left.
-Drag and drop is enabled.
-Quickly access and check the obfuscator!

Currenctly it detects +20 obfuscators/packers/protectors.

Download it here: https://www.firedrive.com/file/D7D13E361752F551

serseri_1453 04-27-2014 17:23

Thanks for the Program

Confuser know yet realase of walls does not recognize the
Net Reactor 3-4 does not recognize the version of

Multi-scan feature list in the form indicates that it is much better

ontryit 04-28-2014 15:43

Quote:

Originally Posted by LordCoder (Post 91083)
Hello,

After a bit period of inactivity I come here with a new project.

As you know, DNiD is not updated. ProtectioniD has a bit of detection for .NET but not all the obfuscators. So I decided to create a new obfuscator detector (and because I don't know how to name my projects I just put that :D).

Features:

-Good detection with +85% probability. It doesn't show a result if it's not sure.
-Gives clear information about which is/are the protector/s.
-It even gives information if it's a trial version and how many days are left.
-Drag and drop is enabled.
-Quickly access and check the obfuscator!

Currenctly it detects +20 obfuscators/packers/protectors.

Download it here: https://www.firedrive.com/file/D7D13E361752F551

I think just simple name it "LordCoder Obfuscator Detector", its unique and good enogh :)

LordCoder 05-01-2014 20:17

New version! I hope you like it :D. It's now stable and added more obfuscators:
Quote:

-Added njRAT:
-Gives information about hacker's IP, fake process and njRAT's version.
-Added DotNet Reactor
-Added context menu for Explorer
-Added "Check for updates" function
-Improved & fixed detection on ILProtector
-Fixed CryptoObfuscator detection
Download it here: https://www.firedrive.com/file/E468DCBBBAFB396C

Any bug found? Please report!

LordCoder 05-01-2014 21:40

Here the link: https://www.firedrive.com/file/38831938053F98FC
I removed the other one.

lihanbok 05-02-2014 01:56

This is good tools. I will try it! Thank you so much!
Brs,'
li

riverstore 05-02-2014 15:43

It's a good tool. Do you support Confuser? The tool can't detect a program packed by Confuser

leetone 05-02-2014 18:35

Quote:

Originally Posted by LordCoder (Post 91164)
Here the link: https://www.firedrive.com/file/38831938053F98FC
I removed the other one.

Much appreciated. I am so glad to have an updated obfuscation checker.

ontryit 05-02-2014 21:05

Quote:

Originally Posted by LordCoder (Post 91160)
New version! I hope you like it :D. It's now stable and added more obfuscators:


Download it here: https://www.firedrive.com/file/E468DCBBBAFB396C

Any bug found? Please report!

Little suggesstion for the GUI, especially the Report Memo, you should add 'Clear Report' on the right context menu or automatically clear the previous report when load a new .NET Assemblies.

Why there no -> [Language: ... ] item report like the screenshot you put on tuts4you?

Thank you

LordCoder 05-04-2014 03:26

Quote:

Originally Posted by riverstore (Post 91171)
It's a good tool. Do you support Confuser? The tool can't detect a program packed by Confuser

Oh forgot to add the packer option. Thanks for the report!

Quote:

Originally Posted by ontryit (Post 91178)
Little suggesstion for the GUI, especially the Report Memo, you should add 'Clear Report' on the right context menu or automatically clear the previous report when load a new .NET Assemblies.

Why there no -> [Language: ... ] item report like the screenshot you put on tuts4you?

Thank you

Thanks for the feature. I will add it for the next version. :) That language menu was a demo I made. I will implement language options for the next release.

serseri_1453 05-04-2014 17:11

This topic packleri if we add, it's more comfortable for you, so that the individual they do not add in bulk, you will be added. In particular, this version attention if you will be more comfortable "smart assembly" , "net reactor" , "confuser", etc

http://forum.exetools.com/showthread.php?p=91204#post91204

Multi-while browsing, to log you can add a recording.

heima911 05-07-2014 10:27

.NET Obfuscator Detector
 
Quote:

Originally Posted by LordCoder (Post 91196)
Oh forgot to add the packer option. Thanks for the report!



Thanks for the feature. I will add it for the next version. :) That language menu was a demo I made. I will implement language options for the next release.


. NET Obfuscator Detector, you can give the latest version of downloading? Thank you

Alcatraz3222 05-14-2014 18:56

work really fine, thank you LordCoder, @riverstore for me also not detect confuser, i guess it is not added, anyway is a good detector for NET

0xd0000 05-18-2014 14:02

I was going to slip a bit of code into your app so I could integrate with the context menu, but realize your still in Beta and and likely adding tons of features.

I used to work the scene with author of DNID - I'm glad to see someone else pick up where he left off.

Request if you have time - Add File Arguments so it could be passed any file, rasher then dealing with drag and drop.

Something simple...

string[] args = Environment.GetCommandLineArgs();

Mahmoudnia 08-09-2014 06:09

Changes from 0.1 to 0.2
=======================
-Added xRAT
-Gives full info about it (like njRAT).
-Improved some detections.
-Some others I don't remember :P

http://www.firedrive.com/file/46116551681C3349


All times are GMT +8. The time now is 12:16.

Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2024, vBulletin Solutions, Inc.
Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX