Exetools

Exetools (https://forum.exetools.com/index.php)
-   Community Tools (https://forum.exetools.com/forumdisplay.php?f=47)
-   -   Improve .NET Deobfuscator (https://forum.exetools.com/showthread.php?t=15145)

wilson bibe 07-21-2013 18:23

Improve .NET Deobfuscator
 
Short Description:
iMPROVE .NET it's a deobfuscator for packers that de4dot can't unpack. Current supported packers:

-DotBundle (only main exe and dlls unpacking)
-ExePack.NET
-.NetZ .NET Packer
-Macrobject Obfuscator .NET 2009
-.netshrink

Thanks to the author of this tool.....

WEB:http://sourceforge.net/projects/improvenetdeobf/

Searched in forum with the words iMPROVE, improve, and iMPROVE .NET Deobfuscator, nothing found.

Dreamer 07-22-2013 02:37

LordCoder rocks :)

LordCoder 07-23-2013 14:54

Added .NET Spin obfuscator. :D

wilson bibe 07-23-2013 18:16

A good tool that you developed LordCoder, I used in the obsfuscators dotbundle and netz, all files deobfuscated.

giv 07-23-2013 19:03

Hey LC...you are making good steps in the path that ded4dot did.
Congrats....
:)

LordCoder 07-23-2013 20:03

Thanks to all. That's what I want. I'm coding more deobfuscators soon I publish an update.

LordCoder 07-24-2013 17:00

New update to v0.1.2

What's new?

-DotWall obfuscator added
-Solved some detection errors

Download at: https://sourceforge.net/projects/improvenetdeobf/files/latest/download
Source it's on the Source Code directory.
:D

Av0id 07-31-2013 19:55

��ould you take a look at obfuscar? not so hard, but time consuming

LordCoder 08-01-2013 17:15

@Av0id Thanks for the obfuscator :D I will take a look. Could you give me an example obfuscated? I don't knwo how to use it :P

wilson bibe 08-01-2013 18:57

1 Attachment(s)
Quote:

Originally Posted by LordCoder (Post 86062)
@Av0id Thanks for the obfuscator :D I will take a look. Could you give me an example obfuscated? I don't knwo how to use it :P

Hello LordCoder in attached the obfuscator
BR

LordCoder 08-01-2013 20:02

Thanks @wilson bibe. And how to use it? Because I drag and drop an example exe and it says it needs a project. I put a project but I can't find the obfuscated exe. Anyone knows how to obfuscate an assembly with Obfuscar?

And other question if someone knows something about NET-Twister obfuscator please explain me what's it. Thanks :)

wilson bibe 08-01-2013 21:35

Quote:

Originally Posted by LordCoder (Post 86065)
Thanks @wilson bibe. And how to use it? Because I drag and drop an example exe and it says it needs a project. I put a project but I can't find the obfuscated exe. Anyone knows how to obfuscate an assembly with Obfuscar?

And other question if someone knows something about NET-Twister obfuscator please explain me what's it. Thanks :)

Hello LordCoder
I believe that this obfuscator obfucate the code used in the VS to generate an exe file, and when you compile this code the result is an exe file obfuscated. I'm not sure but I believe that should be the principle

wilson bibe 08-07-2013 05:59

LordCoder upadated his toll to version v.0.1.3, link in the post#1,
Thanks LordCoder

LordCoder 08-14-2013 17:42

New Version 0.1.4 with some interesting and useful news:

Quote:

-Symbol renaming improved: now it only renames invalid and obfuscated names.
-New clean detection: before detection was bad. Now used some detections from native obfuscators.
-Added Phoenix Protector (thanks to Mr. eXoDia for saying me about this obfuscator).
-Clean code (deleted un-useful code and now it's a fast clean).
Av0id for next version I will add the obfuscar requested.

Click here to download: https://sourceforge.net/projects/improvenetdeobf/files/latest/download

LordCoder 08-14-2013 21:16

@Av0id For the obfuscar you can use the "Unknown Packer". This will rename all needed to see the code. You can use also the de4dot.

Warren 08-16-2013 09:47

a good tool, thank.

LordCoder 09-01-2013 19:27

New version 0.1.5 with:

Quote:

-New Packer: Sixxpack
-Option to choose what symbols rename
Please request more obfuscators (not supported by de4dot or developed by de4dot). And report bugs/new tools for this deobfuscator please :D

Download: https://sourceforge.net/projects/improvenetdeobf/files/Binary/
Source Code: https://sourceforge.net/projects/improvenetdeobf/files/Source%20Code/

kjms 09-01-2013 20:31

@LordCoder
Future release you could add DNGuard HVM

LordCoder 09-01-2013 21:07

Oh yes I forgot this obfuscator. I will try to add for next version.

besoeso 09-02-2013 23:21

yes, add DNGuard HVM is good feature.

sendersu 09-03-2013 00:31

LordCoder,
consider latest .net Reactor, d4d reject to handle it

giv 09-03-2013 13:55

Or the problematic Confuser.

sendersu 09-05-2013 03:11

one more candidate :)

http://en.netobf.com/download

besoeso 09-05-2013 21:41

other more

http://www.remotesoft.com/salamander/obfuscator.html

wilson bibe 09-21-2013 21:30

Like Sendersu, Lord Coder, if you add in your tool a deobfuscate method to the last update of the Net Reactor I will be greatful, this obfuscator are being used by a lot of developers.
Thank you for your last update "2013-09-01".

LordCoder 09-21-2013 22:16

The problem of adding support to it it's that if de4dot it's updated (sure soon it will be) I need again to update each new version of it because I won't support an obfuscator and when de4dot again supports it I delete it.

wilson bibe 09-22-2013 11:41

Understood Lord Coder, Thanks for your replay.

LordCoder 09-22-2013 16:02

If de4dot it's not begin updated I will start supporting this new versions. But If I support them it's like stealing the obfuscators to de4dot.

sendersu 09-23-2013 01:04

How much days for count down, LordCoder? :)

LordCoder 09-28-2013 03:29

New update v0.1.6:

Quote:

Changes:
-Added NETpack
-Added option of intelligent renaming
-Fixed errors in renaming
Still developing all requested obfuscators from now it was a necesary update.

Download: Click Here.

XorRanger 09-29-2013 05:13

Nice Update LordCoder.
Could You add Support For obfusasm.

http://www.devextras.com/obfuscation/

Thanks.

LordCoder 11-01-2013 17:47

New version 0.1.7 with:
Quote:

  • Added RPX
  • Added option of context menu to the Explorer
  • Redesign of the main window
  • Added drag n' drop function
  • Added update checker

The DNGuard will be really difficult for me hope someone can help me on it. As I saw, it has a section called "hvm" which is encrypted. The dll is called as a .exe with an entry point on the DllImport of the .NET application. What I need to get is all IL code from the memory and save it as exe. My problem is how to get the code from the memory? The big problem for me is the low IDA/OllyDbg knowledge so it's really difficult for me to do so.

For the .NetObf is almost done and also TnTLicensing is also almost supported but not added until.


Download it here: https://sourceforge.net/projects/improvenetdeobf/

Thanks for support.

s eriari8 11-14-2013 00:26

thanks uuuuuuuuuuuu

LordCoder 12-01-2013 00:05

New update to v0.1.8
 
New version v0.1.8 with:
Quote:

  • OrangeHeap is now supported
  • NetObf-Protector is now supported (requested by sendersu)
  • Fixed Phoenix Protector String Decryption.
  • Fixed ExePack.NET dlls unpacking
  • DotBundle is supported (as a packer)
  • Added option to change the colours of the window
  • Various Obfuscators Detector and Deobfuscator
  • DotWall Obfuscator string decryption maximum supported

Download Binary: Download it Here

Source Code:
Download Source

If you want to request new obfuscators I will try to support them.

LordCoder 12-29-2013 04:25

New update to v0.1.9!

What's new/fixed?

Quote:

  • Obfuscar is now supported (requested by Av0id)
  • Added MPRESS
  • Castle Crypter v0.1 is now supported
  • Fixed DotBundle unpacking (password was not correct).
  • Deobfuscated assembly should run correctly
  • Fixed small bugs in renaming
  • Fixed some bugs on RPX

Download Binary: Click here
Download Source Code: Click here

Thanks :D

Git 12-29-2013 18:39

Downloaded the binary twice and it seems to be a corrupt archive.

Git

XorRanger 12-29-2013 19:19

Nice to see the way this Project is going. Good Job LordCoder. Still Waiting For obfusasm Support.
http://www.devextras.com/
obfuscation/

LordCoder 12-29-2013 22:25

@Git Try again downloading maybe it was because of the WinRAR v5. I uploaded it again.
@XorRanger I'm still developing it please be patient. You can go trying this deobfuscator for Obfusasm: http://netdeob0.codeplex.com/

serseri_1453 03-02-2014 06:24

Add Confuser 1.9 :)

Thanks LordCoder

sendersu 09-14-2014 23:41

Hi Author
some kind of issues with 1.9 on win7 x64
on changing settings and trying to save it.
http://prntscr.com/4mrgoj


All times are GMT +8. The time now is 12:00.

Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2026, vBulletin Solutions, Inc.
Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX