+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Blackhat Training (https://hackforums.net/forumdisplay.php?fid=405)
+----- Forum: Reverse Engineering (https://hackforums.net/forumdisplay.php?fid=229)
+----- Thread: Agile.net deobfuscation (/showthread.php?tid=6098554)
Agile.net deobfuscation - dragoncurve - Jul 29, 2020
I know there have been plenty of posts about this in the past, but there seems to be no clear way to deobfuscate Agile.net.
de4dot fails straight out of the box:
Detected CliSecure (C:\Program Files (x86)\Control4\Composer\Pro\Terminal.exe)
Cleaning C:\Program Files (x86)\Control4\Composer\Pro\Terminal.exe
Using dynamic method decryption
ERROR:
ERROR:
ERROR:
ERROR: Hmmmm... something didn't work. Try the latest version.
It seems to be struggling to inject something that's monitoring the JIT VM Agile.net installs.
I've tried a stack of methods (XP VMs, netbox, etc.) but nothing comes to fruition.
Is there an easy way to get this unpacked?
RE: Agile.net deobfuscation - dragoncurve - Aug 2, 2020
For those of you who are interested, I managed to modify the de4dot source to make it work for my application. There are a handful of minor tweaks you need to make to some static offsets/strings in de4dot, but it probably changes from app to app (or Agile.NET version).
Anyway, hit me up if you want it and I'll share my Git fork.
RE: Agile.net deobfuscation - VENI - Aug 5, 2020
Hey, ive made a tool to deobfuscate agile.net! Here is the link https://github.com/ribthegreat99OrN0P/Agile.NET-Deobfuscator
I have not yet taken a look at agiles vm and code encryption but here are the steps to deob your program!
1. Download NETBox(Google this)
2. Download JitDumper(https://forum.tuts4you.com/topic/41676-unpack-challenge-agilenet/)
3. Run jitdumper, open your exe and check the box which says 'dump md' then click jit and save it.
4. If jit dump was successful, run the tool i made!
RE: Agile.net deobfuscation - jossethale32 - Nov 7, 2020
can you send me your de4dot-master that you fixed. I mean if you want
RE: Agile.net deobfuscation - knoami - Aug 24, 2021
(Aug 2, 2020 09:12 PM)dragoncurve Wrote: For those of you who are interested, I managed to modify the de4dot source to make it work for my application. There are a handful of minor tweaks you need to make to some static offsets/strings in de4dot, but it probably changes from app to app (or Agile.NET version).
Anyway, hit me up if you want it and I'll share my Git fork.
Hi,
Coud you please share you modified the de4dot?
Thanks in advance
RE: Agile.net deobfuscation - V y r e z . - Sep 3, 2021
I can help regarding this problem, anyone dm me if you want to fix this
RE: Agile.net deobfuscation - fryguy2 - Feb 18, 2022
Anyone figure this out?
Looking for someone that can unlock NinjaTrader 8 indicators.
RE: Agile.net deobfuscation - pat841 - May 11, 2023
I am also looking for someone to decrypt NT8 indicators. Willing to pay, just DM me.
RE: Agile.net deobfuscation - mikyjordan - May 26, 2023
(Aug 2, 2020 09:12 PM)dragoncurve Wrote: For those of you who are interested, I managed to modify the de4dot source to make it work for my application. There are a handful of minor tweaks you need to make to some static offsets/strings in de4dot, but it probably changes from app to app (or Agile.NET version).
Anyway, hit me up if you want it and I'll share my Git fork.
Can you share your exe fixed?
RE: Agile.net deobfuscation - Arturito55 - Jul 2, 2023
(May 26, 2023 03:14 AM)mikyjordan Wrote: Can you share your exe fixed?
I'm also interested
RE: Agile.net deobfuscation - amatory - Nov 4, 2023
@dragoncurve - could you please share your mod to De4dot ?
RE: Agile.net deobfuscation - shrikishan08 - May 27, 2024
Did you get someone to unpack it sir ?
RE: Agile.net deobfuscation - ampf27 - Nov 29, 2025
@VENI Can you share the tool here. Th community would thank that.