Exetools  

Go Back   Exetools > General > Community Tools

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 08-21-2024, 16:17
CodeCracker CodeCracker is offline
VIP
 
Join Date: Jun 2011
Posts: 529
Rept. Given: 30
Rept. Rcvd 474 Times in 170 Posts
Thanks Given: 24
Thanks Rcvd at 2,341 Times in 416 Posts
CodeCracker Reputation: 400-499 CodeCracker Reputation: 400-499 CodeCracker Reputation: 400-499 CodeCracker Reputation: 400-499 CodeCracker Reputation: 400-499
StringDecryptor

StringDecryptor
Decrypt encrypted string from an .NET assembly.
Supported methods: return type string + Parameters: string, int,int+int,uint,uint+uint, string+int, int+int+int
for int: parameter int
Note:
Doesn't work well with control flow obfuscation: de-obfuscate the file first!

Simple how to use:
Click "..." in the front of "Name of file to decrypt (mandatory)", select a file, click "Load and autodetect" and finally click on "Decrypt strings"

In StringDecryptor v3:
- added a optional textbox: file to load which is assembly to be loaded; file to decrypt and file to load should be compatible
- added "Patch Agile" for being able to decrypt Agile assemblies
- added "decrypt int" for decrypting int constants - will only decrypts methods having as parameter a int
- added parameters to see parameter of added string decrypt methods
- added "only string(int)" to remove all methods which returns a string and don't have an int as parameter
- speed optimization
Attached Files
File Type: rar StringDecryptor_v3.rar (30.2 KB, 6 views)

Last edited by CodeCracker; 08-21-2024 at 16:25.
Reply With Quote
The Following 9 Users Say Thank You to CodeCracker For This Useful Post:
chants (08-21-2024), Doit (08-22-2024), kienmanowar (08-21-2024), MarcElBichon (08-21-2024), pnta (08-24-2024), tonyweb (08-25-2024), uCare (08-28-2024), uranus64 (08-21-2024), wilson bibe (08-21-2024)
  #2  
Old 08-21-2024, 18:33
chants chants is offline
VIP
 
Join Date: Jul 2016
Posts: 807
Rept. Given: 42
Rept. Rcvd 50 Times in 31 Posts
Thanks Given: 715
Thanks Rcvd at 1,113 Times in 514 Posts
chants Reputation: 51
Is there a way to hook the decrypt call and do this at runtime if the control flow obfuscation can't be unraveled? I suppose when you say encrypted, you mean by something that .NET has code to decrypt. So theoretically a hook would say the original string address, the caller address, and after forwarding the payload would have the decypted info too, which could be interesting.
Reply With Quote
  #3  
Old 08-21-2024, 21:05
th3tuga th3tuga is offline
Friend
 
Join Date: Oct 2023
Posts: 30
Rept. Given: 0
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 0
Thanks Rcvd at 16 Times in 10 Posts
th3tuga Reputation: 0
Quote:
Originally Posted by chants View Post
Is there a way to hook the decrypt call and do this at runtime if the control flow obfuscation can't be unraveled? I suppose when you say encrypted, you mean by something that .NET has code to decrypt. So theoretically a hook would say the original string address, the caller address, and after forwarding the payload would have the decypted info too, which could be interesting.
It is already loaded and run in memory. See the description.
But on the fly should be possible through dll injection.
Reply With Quote
The Following User Says Thank You to th3tuga For This Useful Post:
chants (08-22-2024)
  #4  
Old 08-21-2024, 23:10
CodeCracker CodeCracker is offline
VIP
 
Join Date: Jun 2011
Posts: 529
Rept. Given: 30
Rept. Rcvd 474 Times in 170 Posts
Thanks Given: 24
Thanks Rcvd at 2,341 Times in 416 Posts
CodeCracker Reputation: 400-499 CodeCracker Reputation: 400-499 CodeCracker Reputation: 400-499 CodeCracker Reputation: 400-499 CodeCracker Reputation: 400-499
StringDecryptor v3 fixed 1

StringDecryptor v3 fixed 1:
- Added exception handler while trying to decrypt string, if something wrong show exception but just once;
Attached Files
File Type: rar StringDecryptor_v3_fixed1.rar (30.5 KB, 13 views)
Reply With Quote
The Following User Gave Reputation+1 to CodeCracker For This Useful Post:
niculaita (08-22-2024)
The Following 8 Users Say Thank You to CodeCracker For This Useful Post:
chants (08-22-2024), Doit (08-22-2024), MarcElBichon (08-22-2024), niculaita (08-22-2024), pnta (08-24-2024), tonyweb (08-25-2024), uranus64 (08-22-2024), wilson bibe (08-22-2024)
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



All times are GMT +8. The time now is 16:21.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( 1998 - 2024 )