[.NET] ConfuserEx脫殼工具打包

[.NET] ConfuserEx脫殼工具打包

 ConfuserEx 1.0.0脫殼步驟
        Written by 今夕何夕[W.B.L.E. TeAm]

1.先用UnconfuserEx把主程序Dump出來；
2.使用CodeCracker大牛的ConfuserExStringDecryptor將加密的字符串解密；
3.使用CodeCracker大牛的ConfuserExSwitchKiller將混淆的switch分支結構解密；
4.若步驟3中解密導致程序崩潰，可以嘗試ConfuserExUniversalControlFlowRemover這個工具，但是這個工具有bug，不是很推薦；
5.使用ConfuserExProxyCallFixer v2將混淆的函數名解析出來；
6.拖入de4dot去除其他混淆；
7.拖入dnspy應該能看到源碼了。

 

資源鏈接參考

https://gist.github.com/Rottweiler/44fe4461a4552acf303a

 

實戰

以爐石兄弟的2017年的最后版本為例

ConfuserExStringDecryptor.exe得到vrdtoilmab_strdec.exe

ConfuserExSwitchKiller.exe得到vrdtoilmab_strdec_deobfuscated.exe

ConfuserEx Proxy Call Fixer v2.exe得到vrdtoilmab_strdec_deobfuscated_noproxy.exe

de4dot處理得到   

de4dot v3.1.41592.3405 Copyright (C) 2011-2015 [e-mail]
Latest version and source code: https://github.com/0xd4d/de4dot

Detected SmartAssembly 6.9.0.114 (C:\Program Files\de4dot-net35\vrdtoilmab_strdec_deobfuscated_noproxy.exe)
Cleaning C:\Program Files\de4dot-net35\vrdtoilmab_strdec_deobfuscated_noproxy.exe
WARNING: File 'C:\Program Files\de4dot-net35\vrdtoilmab_strdec_deobfuscated_noproxy.exe' contains XAML which isn't supported. Use --dont-rename.
Renaming all obfuscated symbols
Saving C:\Program Files\de4dot-net35\vrdtoilmab_strdec_deobfuscated_noproxy-cleaned.exe
ERROR:
ERROR:
ERROR:
ERROR: Hmmmm... something didn't work. Try the latest version.

 需要用一個特殊版本de4dot-Reactor5.0  https://ci.appveyor.com/project/ViRb3/de4dot-cex/build/artifacts?branch=master

de4dot v3.1.41592.3405 Copyright (C) 2011-2015 [e-mail]
Latest version and source code: https://github.com/0xd4d/de4dot

More than one obfuscator detected:
ConfuserEx v0.5.0-custom (use: -p crx)
SmartAssembly 6.9.0.114 (use: -p sa)
Detected SmartAssembly 6.9.0.114 (C:\workspace\clu\Downloads\de4dot-cex\vrdtoilmab_strdec_deobfuscated_noproxy.exe)
Cleaning C:\workspace\clu\Downloads\de4dot-cex\vrdtoilmab_strdec_deobfuscated_noproxy.exe
WARNING: File 'C:\workspace\clu\Downloads\de4dot-cex\vrdtoilmab_strdec_deobfuscated_noproxy.exe' contains XAML which isn't supported. Use --dont-rename.
Renaming all obfuscated symbols
Saving C:\workspace\clu\Downloads\de4dot-cex\vrdtoilmab_strdec_deobfuscated_noproxy-cleaned.exe

 

 

嘗試了一下de4dot-cex，貌似可以一步做完

de4dot v3.1.41592.3405 Copyright (C) 2011-2015 [e-mail]
Latest version and source code: https://github.com/0xd4d/de4dot

More than one obfuscator detected:
ConfuserEx v0.5.0-custom (use: -p crx)
SmartAssembly 6.9.0.114 (use: -p sa)
Detected SmartAssembly 6.9.0.114 (C:\workspace\clu\Downloads\de4dot-cex\vrdtoilmab.exe)
Cleaning C:\workspace\clu\Downloads\de4dot-cex\vrdtoilmab.exe
WARNING: File 'C:\workspace\clu\Downloads\de4dot-cex\vrdtoilmab.exe' contains XAML which isn't supported. Use --dont-rename.
Renaming all obfuscated symbols
Saving C:\workspace\clu\Downloads\de4dot-cex\vrdtoilmab-cleaned.exe