I want to test malware that wrote in .NET 4.5 and obfuscated by Confuser 1.9.

I have tried to open it with .NET Reflector, ILSpy and dotpeek, but all of them can't open it.

How can I debug (and modify) it? There is a special tool for that?

  • 1
    The whole point of obfuscators is to make decompilation harder. Have you tried ildasm?
    – svick
    Nov 23, 2015 at 14:11
  • @svick, yes it failed to.. Only IDA Pro succeeded to show me the MSIL but it can't debug or modify it.
    – nrofis
    Nov 23, 2015 at 14:40
  • There is a project github.com/UbbeLoL/ConfuserDeobfuscator . I didn;t use it personally, but it worth a try.
    – w s
    Nov 23, 2015 at 15:55
  • @ws when I try to load the project it crashed :P...
    – nrofis
    Nov 23, 2015 at 16:18

1 Answer 1


Try http://de4dot.com its a powerful .net deobfuscator. I've authored a serie of tutorials dubbed "demystifying dot net reverse engineering" google it, its a great point of start if you are new on .net RE.

Here is an article on how to deal with obfuscated assemblies http://resources.infosecinstitute.com/reverse-engineering-obfuscated-assemblies/

And this is directly related to what you asked for : [.NET] Decrypt Confuser 1.9 methods : http://fr.scribd.com/doc/207710371/NET-Decrypt-Confuser-1-9-Methods#scribd

Good luck


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.