I want to test malware that wrote in .NET 4.5 and obfuscated by Confuser 1.9.

I have tried to open it with .NET Reflector, ILSpy and dotpeek, but all of them can't open it.

How can I debug (and modify) it? There is a special tool for that?

  • 1
    The whole point of obfuscators is to make decompilation harder. Have you tried ildasm? – svick Nov 23 '15 at 14:11
  • @svick, yes it failed to.. Only IDA Pro succeeded to show me the MSIL but it can't debug or modify it. – nrofis Nov 23 '15 at 14:40
  • There is a project github.com/UbbeLoL/ConfuserDeobfuscator . I didn;t use it personally, but it worth a try. – w s Nov 23 '15 at 15:55
  • @ws when I try to load the project it crashed :P... – nrofis Nov 23 '15 at 16:18

Try http://de4dot.com its a powerful .net deobfuscator. I've authored a serie of tutorials dubbed "demystifying dot net reverse engineering" google it, its a great point of start if you are new on .net RE.

Here is an article on how to deal with obfuscated assemblies http://resources.infosecinstitute.com/reverse-engineering-obfuscated-assemblies/

And this is directly related to what you asked for : [.NET] Decrypt Confuser 1.9 methods : http://fr.scribd.com/doc/207710371/NET-Decrypt-Confuser-1-9-Methods#scribd

Good luck


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.