+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Blackhat Training (https://hackforums.net/forumdisplay.php?fid=405)
+----- Forum: Reverse Engineering (https://hackforums.net/forumdisplay.php?fid=229)
+----- Thread: Help ][ Unpack / Deobfuscate ConfuserEx Obfuscated DLL (/showthread.php?tid=5998552)
Help ][ Unpack / Deobfuscate ConfuserEx Obfuscated DLL - MetkataTipcheto - Aug 12, 2019
I have a DLL file that is obfuscated with ConfuserEx 1.0.0-custom. Been trying to deobfuscate for some time now, but nothing worked so far. I am not very experienced in reverse engineering, so if anyone can help it will be awesome. Hit me with a pm or reply in the thread i will send you the dll file.
RE: Help ][ Unpack / Deobfuscate ConfuserEx Obfuscated DLL - sneezing panda - Aug 12, 2019
It really shouldn't be that hard to do it. ConfuserEx, even custom, has been pretty well documented on how to get rid of the obfuscation.
Just post the link, no one is going to PM you for it.
RE: Help ][ Unpack / Deobfuscate ConfuserEx Obfuscated DLL - michalmonday - Sep 11, 2019
There are many tutorials about it but great majority of these involve opening the file in dnSpy, setting breakpoint and running the debugger. That works fine for exe files but not for dll files though. Any ideas how to overcome this barrier? @sneezing panda
RE: Help ][ Unpack / Deobfuscate ConfuserEx Obfuscated DLL - kalisto2002 - Sep 17, 2019
Even without running the dll unconfusing files is simple, and well documented.
RE: Help ][ Unpack / Deobfuscate ConfuserEx Obfuscated DLL - michalmonday - Sep 17, 2019
Could you post a link to it?
I used google to find phrases like "deobfuscate confuserex dll", "unconfuse confuserex dll" and I checked at least 7 different pages/tutorials but these either involved deobfuscating an exe file using breakpoints (instead of dll where breakpoints can't be set), or didn't provide any useful advice regarding dlls (except suggesting to use de4dot which helps to some extent but doesn't fully "unconfuse" the file and makes it broken as described in this link).
RE: Help ][ Unpack / Deobfuscate ConfuserEx Obfuscated DLL - andmuchmore - Sep 17, 2019
(Aug 12, 2019 11:29 AM)MetkataTipcheto Wrote: I have a DLL file that is obfuscated with ConfuserEx 1.0.0-custom. Been trying to deobfuscate for some time now, but nothing worked so far. I am not very experienced in reverse engineering, so if anyone can help it will be awesome. Hit me with a pm or reply in the thread i will send you the dll file.
Why not download cawks confuser unpacker and modify it to work with the confuserEx mods added? Or post the DLL and some might be able to help you further
RE: Help ][ Unpack / Deobfuscate ConfuserEx Obfuscated DLL - WORM 19 - Sep 27, 2019
DID YOU FIND ANY WAY TO DEOBFUSCATE IT ?
RE: Help ][ Unpack / Deobfuscate ConfuserEx Obfuscated DLL - D3m0n1um - May 3, 2021
Can someone help me to deobfuscate a DLL file?
RE: Help ][ Unpack / Deobfuscate ConfuserEx Obfuscated DLL - modz2345 - Sep 8, 2022
im trying to learn how unpack .dll but cant find any documents or anything
RE: Help ][ Unpack / Deobfuscate ConfuserEx Obfuscated DLL - cobaltcrypt - Sep 22, 2022
you need dnspy to place breakpoint. I have done it before. String decryption is a painful process unless one of the emulators work or you make it work. Afterwards killswitch to remove control flattening and proxy remover tool. I have them both.