StringDecryptor

[CodeCracker]

StringDecryptor
Decrypt encrypted string from an .NET assembly.
Supported methods: return type string + Parameters: string, int,int+int,uint,uint+uint, string+int, int+int+int
for int: parameter int
Note:
Doesn't work well with control flow obfuscation: de-obfuscate the file first!

Simple how to use:
Click "..." in the front of "Name of file to decrypt (mandatory)", select a file, click "Load and autodetect" and finally click on "Decrypt strings"

In StringDecryptor v3:
- added a optional textbox: file to load which is assembly to be loaded; file to decrypt and file to load should be compatible
- added "Patch Agile" for being able to decrypt Agile assemblies
- added "decrypt int" for decrypting int constants - will only decrypts methods having as parameter a int
- added parameters to see parameter of added string decrypt methods
- added "only string(int)" to remove all methods which returns a string and don't have an int as parameter
- speed optimization

[chants]

Is there a way to hook the decrypt call and do this at runtime if the control flow obfuscation can't be unraveled? I suppose when you say encrypted, you mean by something that .NET has code to decrypt. So theoretically a hook would say the original string address, the caller address, and after forwarding the payload would have the decypted info too, which could be interesting.

[th3tuga]

Originally Posted by chants

Is there a way to hook the decrypt call and do this at runtime if the control flow obfuscation can't be unraveled? I suppose when you say encrypted, you mean by something that .NET has code to decrypt. So theoretically a hook would say the original string address, the caller address, and after forwarding the payload would have the decypted info too, which could be interesting.

It is already loaded and run in memory. See the description.
But on the fly should be possible through dll injection.

[CodeCracker]

StringDecryptor v3 fixed 1:
- Added exception handler while trying to decrypt string, if something wrong show exception but just once;

[CodeCracker]

StringDecryptor v3 fixed 2:
- Added 64 bits assemblies support, released as AnyCpu.

[Ghl]

I used String Decryptor V.2 for exe file encrypted but the file didn't decrypted completely.Please inform true procedure for decryption by V.3. , share link.Thx

[Ghl]

Hi Codecracker. Please share on Workupload the last versions of String decryptor and eazfixer tools .Thank you

[Go2Crck]

Originally Posted by Ghl

Hi Codecracker. Please share on Workupload the last versions of String decryptor and eazfixer tools .Thank you

He posts the latest versions of his tools on the Tuts4You forum. You can freely download them there!

[Ghl]

Can you share that link for this topic files? Thx

[hungba193]

Originally Posted by CodeCracker

StringDecryptor v3 fixed 2:
- Added 64 bits assemblies support, released as AnyCpu.

I need this but unfortunately can't download it. Anyway thanks for sharing

[sendersu]

https://www.sendspace.com/file/uj4ewc
(c) from https://forum.tuts4you.com/topic/31329-stringdecryptor/

[Ghl]

Hi code cracker. I tried to decrypt with String Decryptors Version1,2,3,Eaz then deobfuscate by de4dot and Eaz decryptor had better result but didn't decrypt all methods. Is there a way or decryptor to decrypt all methods?
Thx.

[CodeCracker]

Originally Posted by Ghl

Hi code cracker. I tried to decrypt with String Decryptors Version1,2,3,Eaz then deobfuscate by de4dot and Eaz decryptor had better result but didn't decrypt all methods. Is there a way or decryptor to decrypt all methods?
Thx.

Hi. Can you post target files and also please post methods which can't be decrypted decompiled code.

[CodeCracker]

StringDecryptor v4:
- Added instance (no static) string decryption method
- Added "Static only" checkbox to decrypt only static string decryption methods
- Added "Only proper Used" - to remove methods which are not properly called
- Added "Copy Selected" and "Copy All" in context menu to copy to clipboard methods information
Release as 32 bits