StringDecryptor

[CodeCracker]

StringDecryptor
Decrypt encrypted string from an .NET assembly.
Supported methods: return type string + Parameters: string, int,int+int,uint,uint+uint, string+int, int+int+int
for int: parameter int
Note:
Doesn't work well with control flow obfuscation: de-obfuscate the file first!

Simple how to use:
Click "..." in the front of "Name of file to decrypt (mandatory)", select a file, click "Load and autodetect" and finally click on "Decrypt strings"

In StringDecryptor v3:
- added a optional textbox: file to load which is assembly to be loaded; file to decrypt and file to load should be compatible
- added "Patch Agile" for being able to decrypt Agile assemblies
- added "decrypt int" for decrypting int constants - will only decrypts methods having as parameter a int
- added parameters to see parameter of added string decrypt methods
- added "only string(int)" to remove all methods which returns a string and don't have an int as parameter
- speed optimization

[chants]

Is there a way to hook the decrypt call and do this at runtime if the control flow obfuscation can't be unraveled? I suppose when you say encrypted, you mean by something that .NET has code to decrypt. So theoretically a hook would say the original string address, the caller address, and after forwarding the payload would have the decypted info too, which could be interesting.

[th3tuga]

Originally Posted by chants

Is there a way to hook the decrypt call and do this at runtime if the control flow obfuscation can't be unraveled? I suppose when you say encrypted, you mean by something that .NET has code to decrypt. So theoretically a hook would say the original string address, the caller address, and after forwarding the payload would have the decypted info too, which could be interesting.

It is already loaded and run in memory. See the description.
But on the fly should be possible through dll injection.

[CodeCracker]

StringDecryptor v3 fixed 1:
- Added exception handler while trying to decrypt string, if something wrong show exception but just once;