+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [.NET] Confuser 1.9 deobfuscator (Opensource) (/showthread.php?tid=3753385)
Pages: Pages
1
2
Confuser 1.9 deobfuscator (Opensource) - ubbelol - Sep 14, 2013
So this is something I've worked on for a while. But lost interest lately, and have a few other projects that I really want to work on. But anyway, this is a deobfuscator for Confuser 1.9 (release). It's my first project using dnlib instead of Cecil, so some things may be sloppy due to me not knowing the library that well.
It can deobfuscate most files on Maximum setting, but there are bugs that sometimes causes it to crash. It can also unpack files from the Compressor packer, but there's no compatibility for files using packer + obfuscation.
Things that needs to be worked on:
-- Better detection for some methods
-- Bug fixes with maximum obfuscated files
-- Compatibility with packer + obfuscation
-- Might be bugs with mtd/ctor proxy resolver + anti-tamper
-- Support for latest Confuser build, not just release
Since I'm not gonna work much on this project for a while at least, I thought I'd put it up on github in case someone else wants to continue work on it.
https://github.com/UbbeLoL/ConfuserDeobfuscator
* - Tastylicous - Sep 14, 2013
Wow that's great, thanks for sharing 🤝
* - Thr - Sep 14, 2013
I might continue your work by forking the project ;) great work!
* - ubbelol - Sep 14, 2013
(Sep 14, 2013 06:44 AM)Thr Wrote: I might continue your work by forking the project ;) great work!
Thanks. I'd love to see someone fork the project. :)
* - TheBarret - Sep 14, 2013
I vouch for this guy any day, he knows his stuff and what he's talking about.
Great work buddy!
* - Thr - Sep 14, 2013
Just looked over all of the source. I haven't used dnlib as well. It'll be a fun experience ;)
* - SHlicmlp - Sep 14, 2013
Nice release, you certainly know what you're doing :P Thanks for sharing.
* - Invicta - Sep 14, 2013
I see every program on HF being cracked now. 🤣
* - Hexology - Sep 14, 2013
Very nice job, but I have a quick question, this isn't a big deal or anything but why don't people post the c# programs in the c# section?
* - ubbelol - Sep 15, 2013
(Sep 14, 2013 05:37 PM)Hexology Wrote: Very nice job, but I have a quick question, this isn't a big deal or anything but why don't people post the c# programs in the c# section?
I was considering it, but I felt that Confuser applies to both VB and C#. The real point of this project isn't too deobfuscate applications but to teach people HOW to do it and what the protections actually do.
If a mod feels that my opinion is wrong then you're free to move it to C#. :p
* - nuk - Sep 15, 2013
WOW! HQ Coder to say the least. Very awesome work homie.... One of the best shares to date in the .NET section. Keepin' my eye out for releases from you :)
* - Thr - Sep 15, 2013
(Sep 15, 2013 05:21 AM)UbbeLoL Wrote: I was considering it, but I felt that Confuser applies to both VB and C#. The real point of this project isn't too deobfuscate applications but to teach people HOW to do it and what the protections actually do.
If a mod feels that my opinion is wrong then you're free to move it to C#. :p
I agree that this should be posted in the VB/.NET section instead of the C# section, as this doesn't really apply to just C# but to the entirety of the .NET framework (anything using the JIT compiler).
* - MrMazika - Sep 15, 2013
good Very nice job, but I have a quick question, this isn't a big deal or anything but why don't people post the c# programs in the c# section?
* - Anon?M ID - Sep 15, 2013
sounds pretty awesome. i'll take a look to this later. btw thanks for the share
* - stefsot - Sep 15, 2013
You really like making deobfuscators.
Always loved your work.
Thank you.