2

enter image description here

I already try de4dot with all dlls and exe and try remove strong name and don't work.

what am I doing wrong?

  • You can't always deobfuscate .NET binaries. If, when the binaries are compiled, the obfuscation implementation modifies the name itself in every place it's referenced, then that (the mangled name) is what the name will be for you, the reverser. – dsasmblr Nov 8 '17 at 15:21
  • What do you think about I try my last shot with IDA ? Can be made? – Luan Barbosa Nov 8 '17 at 15:25
  • 1
    Again, if the name has 100% been changed in the application you've downloaded, then there's nothing for you to recover. It's as if the developer developed the application using those obfuscated names in the first place. Depending on what you want to accomplish, this is where other analysis (static and/or dynamic) comes into play where you have to find your way to the meaning of everything that's obfuscated (well, everything you're interested in, at least). This is by no means a trivial task necessarily, but it's what you have to start considering in the absence of meaningful symbols/names. – dsasmblr Nov 8 '17 at 15:33
  • Thank you very much I'm so obsessed with breaking those names. And I love impossible tasks. You quoted static or dynamic analysis, I just started a cybrary course on RE has a topic just about what you quoted. Thank you very much for the help. If I can not, that's fine. But I will not give up easy. I'm addicted to it. – Luan Barbosa Nov 8 '17 at 15:56
  • 1
    @dsasmblr please consider making these comments as an elaborated answer since it answers the question – Megabeets Nov 9 '17 at 6:51
3

Converting multiple comments of mine to an answer for future readers:

You can't always deobfuscate .NET binaries. If, when the binaries are compiled, the obfuscation implementation modifies the name itself in every place it's referenced, then that (the mangled name) is what the name will be for you, the reverser. It's as if the developer developed the application using those obfuscated names in the first place.

Depending on what you want to accomplish, this is where other analysis (static [studying binaries without executing (running) them] and/or dynamic [studying binaries while they're executing]) comes into play where you have to find your way to the meaning of everything that's obfuscated (well, everything you're interested in, at least). This is by no means a trivial task necessarily, but it's what you have to start considering in the absence of meaningful symbols/names (which is quite commonly the case in unmanaged (non-CLR) binaries that lack symbol names).

  • I figured out what was going on. He has the masked value I have the value masked. It is possible to unmark it.? – Luan Barbosa Nov 9 '17 at 17:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.