Exetools  

Go Back   Exetools > General > Community Tools

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 04-15-2025, 19:23
CodeCracker CodeCracker is offline
VIP
 
Join Date: Jun 2011
Posts: 638
Rept. Given: 38
Rept. Rcvd 568 Times in 215 Posts
Thanks Given: 33
Thanks Rcvd at 3,027 Times in 509 Posts
CodeCracker Reputation: 500-699 CodeCracker Reputation: 500-699 CodeCracker Reputation: 500-699 CodeCracker Reputation: 500-699 CodeCracker Reputation: 500-699 CodeCracker Reputation: 500-699
ConfuserEx-Unpacker

ConfuserEx-Unpacker :
Home page: https://github.com/XenocodeRCE/ConfuserEx-Unpacker

A dynamic confuserex unpacker that relies on invoke for most things
If the protected assembly is protected by anti-tamper protection remove it using ConfuseExDAntitamper https://forum.tuts4you.com/topic/45360-confuseexdantitamper
since this tool is bad for antitamper;
use it like this:
ConfuserEx-Unpacker.exe -d file_to_unpack
- This is the recommended option for unpacking most target; it is dynamic unpacking
You could try also static unpacking using ConfuserEx-Unpacker.exe -s file_to_unpack
There is also -vv parameter which can be passed to this program - very verbose - print more stuffs

First version:
- fixed some bugs in control flow deobfuscation
- added constants decryption; initially was only string decryption

ConfuserEx-Unpacker fixed1:
- Fixed some bugs ReferenceProxy removing;

ConfuserEx-Unpacker_fixed1_p2.rar
.sdata section - no anti-tamper fixed.
Attached Files
File Type: rar ConfuserEx-Unpacker_fixed1_p2.rar (1.11 MB, 37 views)
Reply With Quote
The Following 3 Users Gave Reputation+1 to CodeCracker For This Useful Post:
Codeman (05-30-2025), Dr.FarFar (07-01-2025), Mendax47 (05-26-2025)
The Following 16 Users Say Thank You to CodeCracker For This Useful Post:
alekine322 (04-17-2025), Apuromafo (04-16-2025), canopus (05-23-2025), Codeman (05-30-2025), Dr.FarFar (07-01-2025), isdochegal (06-06-2025), Mendax47 (05-26-2025), niculaita (04-17-2025), perseverace (05-25-2025), pnta (06-28-2025), rooster1 (06-02-2025), tonyweb (04-20-2025), traf0 (04-16-2025), wilson bibe (04-16-2025), wx69wx2023 (04-16-2025), zionoobie (05-07-2025)
  #2  
Old 06-28-2025, 01:13
CodeCracker CodeCracker is offline
VIP
 
Join Date: Jun 2011
Posts: 638
Rept. Given: 38
Rept. Rcvd 568 Times in 215 Posts
Thanks Given: 33
Thanks Rcvd at 3,027 Times in 509 Posts
CodeCracker Reputation: 500-699 CodeCracker Reputation: 500-699 CodeCracker Reputation: 500-699 CodeCracker Reputation: 500-699 CodeCracker Reputation: 500-699 CodeCracker Reputation: 500-699
ConfuserEx-Unpacker-fixed3

ConfuserEx-Unpacker-fixed3:
- Added ushort (Uint16) array decryption, added sbyte array decryption;
- Fixed proxies call fixing
- Clean Constant init call in static constructor

If switch obfuscations is still present on some methods run after this ConfuserEx-Unpacker :
ConfuserEx Unpacker v2.0 by ElektroKill
https://at4re.net/f/thread-1431-post-9948.html#pid9948
Attached Files
File Type: rar ConfuserEx-Unpacker-fixed3.rar (1.08 MB, 32 views)
Reply With Quote
The Following 3 Users Gave Reputation+1 to CodeCracker For This Useful Post:
Apuromafo (06-28-2025), Dr.FarFar (07-01-2025), user1 (06-30-2025)
The Following 11 Users Say Thank You to CodeCracker For This Useful Post:
0xd0000 (06-28-2025), alekine322 (07-04-2025), Apuromafo (06-28-2025), blue_devil (06-28-2025), Dr.FarFar (07-01-2025), niculaita (07-04-2025), pnta (06-28-2025), user1 (06-30-2025), user_hidden (06-28-2025), wilson bibe (06-28-2025), Zeokat (06-30-2025)
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



All times are GMT +8. The time now is 02:36.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( 1998 - 2025 )