I want to test malware that wrote in .NET 4.5 and obfuscated by Confuser 1.9.
I have tried to open it with .NET Reflector, ILSpy and dotpeek, but all of them can't open it.
How can I debug (and modify) it? There is a special tool for that?
4
-
1The whole point of obfuscators is to make decompilation harder. Have you tried ildasm?– svickNov 23, 2015 at 14:11
-
@svick, yes it failed to.. Only IDA Pro succeeded to show me the MSIL but it can't debug or modify it.– Raz HalalyNov 23, 2015 at 14:40
-
There is a project github.com/UbbeLoL/ConfuserDeobfuscator . I didn;t use it personally, but it worth a try.– w sNov 23, 2015 at 15:55
-
@ws when I try to load the project it crashed :P...– Raz HalalyNov 23, 2015 at 16:18
Add a comment
|
1 Answer
Try http://de4dot.com its a powerful .net deobfuscator. I've authored a serie of tutorials dubbed "demystifying dot net reverse engineering" google it, its a great point of start if you are new on .net RE.
Here is an article on how to deal with obfuscated assemblies http://resources.infosecinstitute.com/reverse-engineering-obfuscated-assemblies/
And this is directly related to what you asked for : [.NET] Decrypt Confuser 1.9 methods : http://fr.scribd.com/doc/207710371/NET-Decrypt-Confuser-1-9-Methods#scribd
Good luck
-
de4dot does not list Confuser under Supported Obfuscators: github.com/de4dot/de4dot– ElmueJan 9, 2021 at 20:08