Anvilpoint CyberOps - Hacker for Hire ◆ ProxiesFood: Unlimited Residential Proxy ◆ Cheap KYC Verifications & Openups ◆ Spoof Call and Spoof SMS set any caller ◆
Home Upgrade Search Memberlist Extras Hacker Tools Award Goals Help Wiki Contact
Hack Forums Hacks, Exploits, and Various Discussions Blackhat • Red Team • Offensive Security Blackhat Training Reverse Engineering › Help ][ Unpack / Deobfuscate ConfuserEx Obfuscated DLL

New Reply 

Help ][ Unpack / Deobfuscate ConfuserEx Obfuscated DLL
MetkataTipcheto
MetkataTipcheto Offline
[n00b@HF:]
*
Registered
Posts:
19
Threads:
7
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Aug 12, 2019 11:29 AM
I have a DLL file that is obfuscated with ConfuserEx 1.0.0-custom. Been trying to deobfuscate for some time now, but nothing worked so far. I am not very experienced in reverse engineering, so if anyone can help it will be awesome. Hit me with a pm or reply in the thread i will send you the dll file.
sneezing panda
sneezing panda Away
<3's SeaNanners™
***
HF Ub3r
Posts:
2,818
Threads:
255
Credibility:
000
Popularity:
300
βytes:
β 464.97
Game XP:
1,250
Aug 12, 2019 12:46 PM
It really shouldn't be that hard to do it. ConfuserEx, even custom, has been pretty well documented on how to get rid of the obfuscation.

Just post the link, no one is going to PM you for it.
michalmonday
michalmonday Offline
[user@HF:]
*
Registered
Posts:
227
Threads:
13
Credibility:
100
Popularity:
16
βytes:
β 0
Game XP:
0
Sep 11, 2019 06:00 AM
There are many tutorials about it but great majority of these involve opening the file in dnSpy, setting breakpoint and running the debugger. That works fine for exe files but not for dll files though. Any ideas how to overcome this barrier? @sneezing panda
kalisto2002
kalisto2002 Offline
[n00b@HF:]
*
Registered
Posts:
25
Threads:
5
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Sep 17, 2019 12:09 PM
Even without running the dll unconfusing files is simple, and well documented.
michalmonday
michalmonday Offline
[user@HF:]
*
Registered
Posts:
227
Threads:
13
Credibility:
100
Popularity:
16
βytes:
β 0
Game XP:
0
Sep 17, 2019 02:58 PM
Could you post a link to it?

I used google to find phrases like "deobfuscate confuserex dll", "unconfuse confuserex dll" and I checked at least 7 different pages/tutorials but these either involved deobfuscating an exe file using breakpoints (instead of dll where breakpoints can't be set), or didn't provide any useful advice regarding dlls (except suggesting to use de4dot which helps to some extent but doesn't fully "unconfuse" the file and makes it broken as described in this link).
andmuchmore
andmuchmore Offline
[user@HF:]
**
HF l33t
Posts:
490
Threads:
22
Credibility:
600
Popularity:
96
βytes:
β 0
Game XP:
1
Sep 17, 2019 04:00 PM
(Aug 12, 2019 11:29 AM)MetkataTipcheto Wrote:  I have a DLL file that is obfuscated with ConfuserEx 1.0.0-custom. Been trying to deobfuscate for some time now, but nothing worked so far. I am not very experienced in reverse engineering, so if anyone can help it will be awesome. Hit me with a pm or reply in the thread i will send you the dll file.

Why not download cawks confuser unpacker and modify it to work with the confuserEx mods added? Or post the DLL and some might be able to help you further
WORM 19
WORM 19 Offline
[n00b@HF:]
*
Registered
Posts:
7
Threads:
4
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Sep 27, 2019 02:24 AM
DID YOU FIND ANY WAY TO DEOBFUSCATE IT ?
D3m0n1um
D3m0n1um Offline
[n00b@HF:]
*
Registered
Posts:
1
Threads:
0
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
46
May 3, 2021 08:41 AM (This post was last modified: May 3, 2021 10:19 AM by D3m0n1um.)
Can someone help me to deobfuscate a DLL file?
modz2345
modz2345 Offline
[n00b@HF:]
*
Registered
Posts:
2
Threads:
1
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Sep 8, 2022 10:50 PM
im trying to learn how unpack .dll but cant find any documents or anything
cobaltcrypt
cobaltcrypt Offline
[n00b@HF:]
*
HF l33t
Posts:
75
Threads:
7
Credibility:
000
Popularity:
16
βytes:
β 0
Game XP:
0
Sep 22, 2022 02:37 PM (This post was last modified: Sep 25, 2022 05:33 PM by cobaltcrypt.)
you need dnspy to place breakpoint. I have done it before. String decryption is a painful process unless one of the emulators work or you make it work. Afterwards killswitch to remove control flattening and proxy remover tool. I have them both.
Next Oldest | Next Newest
New Reply 


Possibly Related Threads...
Thread / Author Replies Views Last Post
by snoopy717Apr 7, 2026 03:34 PM 1 123 Apr 7, 2026 03:34 PM
Last Post: notagh0st
by snqqyjApr 3, 2026 09:58 AM 2 99 Apr 3, 2026 09:58 AM
Last Post: DramaKing
by IRDumpMar 5, 2026 02:10 AM 4 644 Mar 5, 2026 02:10 AM
Last Post: snoopy717