EXETOOLS FORUM  

Go Back   EXETOOLS FORUM > General > Community Tools

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 07-21-2013, 18:23
wilson bibe wilson bibe is offline
VIP
 
Join Date: Nov 2012
Posts: 419
Rept. Given: 468
Rept. Rcvd 437 Times in 179 Posts
Thanks Given: 265
Thanks Rcvd at 110 Times in 59 Posts
wilson bibe Reputation: 400-499 wilson bibe Reputation: 400-499 wilson bibe Reputation: 400-499 wilson bibe Reputation: 400-499 wilson bibe Reputation: 400-499
Improve .NET Deobfuscator

Short Description:
iMPROVE .NET it's a deobfuscator for packers that de4dot can't unpack. Current supported packers:

-DotBundle (only main exe and dlls unpacking)
-ExePack.NET
-.NetZ .NET Packer
-Macrobject Obfuscator .NET 2009
-.netshrink

Thanks to the author of this tool.....

WEB:http://sourceforge.net/projects/improvenetdeobf/

Searched in forum with the words iMPROVE, improve, and iMPROVE .NET Deobfuscator, nothing found.
Reply With Quote
The Following 9 Users Gave Reputation+1 to wilson bibe For This Useful Post:
an0rma1 (07-22-2013), BAHEK (07-22-2013), Dreamer (07-22-2013), emo (07-23-2013), giv (07-21-2013), LordCoder (07-23-2013), the_beginner (07-21-2013), XorRanger (07-22-2013), zeuscane (07-22-2013)
  #2  
Old 07-22-2013, 02:37
Dreamer's Avatar
Dreamer Dreamer is offline
Family
 
Join Date: May 2012
Posts: 588
Rept. Given: 615
Rept. Rcvd 658 Times in 256 Posts
Thanks Given: 117
Thanks Rcvd at 57 Times in 31 Posts
Dreamer Reputation: 37
LordCoder rocks
Reply With Quote
The Following 2 Users Gave Reputation+1 to Dreamer For This Useful Post:
LordCoder (08-14-2013), wilson bibe (07-22-2013)
  #3  
Old 07-23-2013, 14:54
LordCoder LordCoder is offline
TEAM REiS
 
Join Date: May 2013
Location: TEAM REiS
Posts: 55
Rept. Given: 39
Rept. Rcvd 238 Times in 36 Posts
Thanks Given: 1
Thanks Rcvd at 11 Times in 5 Posts
LordCoder Reputation: 200-299 LordCoder Reputation: 200-299 LordCoder Reputation: 200-299
Added .NET Spin obfuscator.
Reply With Quote
The Following 4 Users Gave Reputation+1 to LordCoder For This Useful Post:
chessgod101 (07-24-2013), demon_da (07-26-2013), giv (07-23-2013), wilson bibe (07-23-2013)
  #4  
Old 07-23-2013, 18:16
wilson bibe wilson bibe is offline
VIP
 
Join Date: Nov 2012
Posts: 419
Rept. Given: 468
Rept. Rcvd 437 Times in 179 Posts
Thanks Given: 265
Thanks Rcvd at 110 Times in 59 Posts
wilson bibe Reputation: 400-499 wilson bibe Reputation: 400-499 wilson bibe Reputation: 400-499 wilson bibe Reputation: 400-499 wilson bibe Reputation: 400-499
A good tool that you developed LordCoder, I used in the obsfuscators dotbundle and netz, all files deobfuscated.
Reply With Quote
The Following User Gave Reputation+1 to wilson bibe For This Useful Post:
LordCoder (08-14-2013)
  #5  
Old 07-23-2013, 19:03
giv's Avatar
giv giv is offline
VIP
 
Join Date: Jan 2011
Location: Romania
Posts: 1,650
Rept. Given: 801
Rept. Rcvd 1,280 Times in 558 Posts
Thanks Given: 208
Thanks Rcvd at 417 Times in 127 Posts
giv Reputation: 1100-1299 giv Reputation: 1100-1299 giv Reputation: 1100-1299 giv Reputation: 1100-1299 giv Reputation: 1100-1299 giv Reputation: 1100-1299 giv Reputation: 1100-1299 giv Reputation: 1100-1299 giv Reputation: 1100-1299
Hey LC...you are making good steps in the path that ded4dot did.
Congrats....
Reply With Quote
  #6  
Old 07-23-2013, 20:03
LordCoder LordCoder is offline
TEAM REiS
 
Join Date: May 2013
Location: TEAM REiS
Posts: 55
Rept. Given: 39
Rept. Rcvd 238 Times in 36 Posts
Thanks Given: 1
Thanks Rcvd at 11 Times in 5 Posts
LordCoder Reputation: 200-299 LordCoder Reputation: 200-299 LordCoder Reputation: 200-299
Thanks to all. That's what I want. I'm coding more deobfuscators soon I publish an update.
Reply With Quote
The Following 3 Users Gave Reputation+1 to LordCoder For This Useful Post:
giv (07-24-2013), K3nny (07-24-2013), wilson bibe (07-23-2013)
  #7  
Old 07-24-2013, 17:00
LordCoder LordCoder is offline
TEAM REiS
 
Join Date: May 2013
Location: TEAM REiS
Posts: 55
Rept. Given: 39
Rept. Rcvd 238 Times in 36 Posts
Thanks Given: 1
Thanks Rcvd at 11 Times in 5 Posts
LordCoder Reputation: 200-299 LordCoder Reputation: 200-299 LordCoder Reputation: 200-299
New update to v0.1.2

What's new?

-DotWall obfuscator added
-Solved some detection errors

Download at: https://sourceforge.net/projects/improvenetdeobf/files/latest/download
Source it's on the Source Code directory.
Reply With Quote
The Following 14 Users Gave Reputation+1 to LordCoder For This Useful Post:
alekine322 (08-04-2013), Av0id (07-31-2013), besoeso (07-24-2013), demon_da (07-26-2013), giv (07-24-2013), IWarez (07-27-2013), korosh (07-25-2013), nikkapedd (07-25-2013), ontryit (08-15-2013), quygia128 (08-07-2013), sendersu (07-24-2013), uranus64 (07-25-2013), zeuscane (07-24-2013)
  #8  
Old 07-31-2013, 19:55
Av0id Av0id is offline
VIP
 
Join Date: Jan 2006
Posts: 399
Rept. Given: 112
Rept. Rcvd 111 Times in 69 Posts
Thanks Given: 0
Thanks Rcvd at 3 Times in 3 Posts
Av0id Reputation: 100-199 Av0id Reputation: 100-199
ould you take a look at obfuscar? not so hard, but time consuming
Reply With Quote
  #9  
Old 08-01-2013, 17:15
LordCoder LordCoder is offline
TEAM REiS
 
Join Date: May 2013
Location: TEAM REiS
Posts: 55
Rept. Given: 39
Rept. Rcvd 238 Times in 36 Posts
Thanks Given: 1
Thanks Rcvd at 11 Times in 5 Posts
LordCoder Reputation: 200-299 LordCoder Reputation: 200-299 LordCoder Reputation: 200-299
@Av0id Thanks for the obfuscator I will take a look. Could you give me an example obfuscated? I don't knwo how to use it :P

Last edited by LordCoder; 08-01-2013 at 17:23.
Reply With Quote
  #10  
Old 08-01-2013, 18:57
wilson bibe wilson bibe is offline
VIP
 
Join Date: Nov 2012
Posts: 419
Rept. Given: 468
Rept. Rcvd 437 Times in 179 Posts
Thanks Given: 265
Thanks Rcvd at 110 Times in 59 Posts
wilson bibe Reputation: 400-499 wilson bibe Reputation: 400-499 wilson bibe Reputation: 400-499 wilson bibe Reputation: 400-499 wilson bibe Reputation: 400-499
Quote:
Originally Posted by LordCoder View Post
@Av0id Thanks for the obfuscator I will take a look. Could you give me an example obfuscated? I don't knwo how to use it :P
Hello LordCoder in attached the obfuscator
BR
Attached Files
File Type: rar Obfuscar_1.5.4.rar (351.2 KB, 41 views)
Reply With Quote
  #11  
Old 08-01-2013, 20:02
LordCoder LordCoder is offline
TEAM REiS
 
Join Date: May 2013
Location: TEAM REiS
Posts: 55
Rept. Given: 39
Rept. Rcvd 238 Times in 36 Posts
Thanks Given: 1
Thanks Rcvd at 11 Times in 5 Posts
LordCoder Reputation: 200-299 LordCoder Reputation: 200-299 LordCoder Reputation: 200-299
Thanks @wilson bibe. And how to use it? Because I drag and drop an example exe and it says it needs a project. I put a project but I can't find the obfuscated exe. Anyone knows how to obfuscate an assembly with Obfuscar?

And other question if someone knows something about NET-Twister obfuscator please explain me what's it. Thanks
Reply With Quote
  #12  
Old 08-01-2013, 21:35
wilson bibe wilson bibe is offline
VIP
 
Join Date: Nov 2012
Posts: 419
Rept. Given: 468
Rept. Rcvd 437 Times in 179 Posts
Thanks Given: 265
Thanks Rcvd at 110 Times in 59 Posts
wilson bibe Reputation: 400-499 wilson bibe Reputation: 400-499 wilson bibe Reputation: 400-499 wilson bibe Reputation: 400-499 wilson bibe Reputation: 400-499
Quote:
Originally Posted by LordCoder View Post
Thanks @wilson bibe. And how to use it? Because I drag and drop an example exe and it says it needs a project. I put a project but I can't find the obfuscated exe. Anyone knows how to obfuscate an assembly with Obfuscar?

And other question if someone knows something about NET-Twister obfuscator please explain me what's it. Thanks
Hello LordCoder
I believe that this obfuscator obfucate the code used in the VS to generate an exe file, and when you compile this code the result is an exe file obfuscated. I'm not sure but I believe that should be the principle
Reply With Quote
  #13  
Old 08-07-2013, 05:59
wilson bibe wilson bibe is offline
VIP
 
Join Date: Nov 2012
Posts: 419
Rept. Given: 468
Rept. Rcvd 437 Times in 179 Posts
Thanks Given: 265
Thanks Rcvd at 110 Times in 59 Posts
wilson bibe Reputation: 400-499 wilson bibe Reputation: 400-499 wilson bibe Reputation: 400-499 wilson bibe Reputation: 400-499 wilson bibe Reputation: 400-499
LordCoder upadated his toll to version v.0.1.3, link in the post#1,
Thanks LordCoder
Reply With Quote
  #14  
Old 08-14-2013, 17:42
LordCoder LordCoder is offline
TEAM REiS
 
Join Date: May 2013
Location: TEAM REiS
Posts: 55
Rept. Given: 39
Rept. Rcvd 238 Times in 36 Posts
Thanks Given: 1
Thanks Rcvd at 11 Times in 5 Posts
LordCoder Reputation: 200-299 LordCoder Reputation: 200-299 LordCoder Reputation: 200-299
New Version 0.1.4 with some interesting and useful news:

Quote:
-Symbol renaming improved: now it only renames invalid and obfuscated names.
-New clean detection: before detection was bad. Now used some detections from native obfuscators.
-Added Phoenix Protector (thanks to Mr. eXoDia for saying me about this obfuscator).
-Clean code (deleted un-useful code and now it's a fast clean).
Av0id for next version I will add the obfuscar requested.

Click here to download: https://sourceforge.net/projects/improvenetdeobf/files/latest/download
Reply With Quote
The Following 6 Users Gave Reputation+1 to LordCoder For This Useful Post:
ahmadmansoor (08-14-2013), alekine322 (08-15-2013), Av0id (08-14-2013), besoeso (08-14-2013), nikkapedd (08-21-2013), XorRanger (08-14-2013)
  #15  
Old 08-14-2013, 21:16
LordCoder LordCoder is offline
TEAM REiS
 
Join Date: May 2013
Location: TEAM REiS
Posts: 55
Rept. Given: 39
Rept. Rcvd 238 Times in 36 Posts
Thanks Given: 1
Thanks Rcvd at 11 Times in 5 Posts
LordCoder Reputation: 200-299 LordCoder Reputation: 200-299 LordCoder Reputation: 200-299
@Av0id For the obfuscar you can use the "Unknown Packer". This will rename all needed to see the code. You can use also the de4dot.
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
de4dot - Deobfuscator for .NET mdj Community Tools 183 07-22-2017 10:59
How to improve the FTP (2 simple things) Rhodium General Discussion 4 04-20-2004 16:13


All times are GMT +8. The time now is 05:31.


��ICP��05004977��
Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX