I am having an exe file that I am trying to deobfuscate and debug using dnspy. The exe file was written in C# and obfuscated with unknown deobfuscate according to de4dot! I tried to all my known methods to procced but still I was not able to fully deobfusticated it.

Analysing the File

- Exeinfo PE

I tried to analysie the file with exeinfope to check which obfustactor was used but I only got [obfus/crypted].

Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 [ Obfus/Crypted- StrongName set ] - EP Token : 06000080 , Overlay : 403900... Nothing discovered

enter image description here

- Dnspy

Opening the file in dnspy but the code wasn't readable, especially the methods and the functions name are in unicode form.

enter image description here

My Attempts:

  1. Tried to deobfustace the file with de4dot, but I get "Detected Unknown Obfuscator" followed by an error.
  2. Tried a modded version of de4dot, and I was able to deobfustacte the exe,but all functions shown as "delegate". The exe file was detected as "Unkown Obfustactor" as well, but managed to cleaned it. enter image description here
  3. Tried to debug the cleaned verison but when I start dnspy I get an exception (System.NullReferenceException) enter image description here

My Questions:

  1. Which obfustactor was used ?
  2. Why all functions are defined as "delgate"?
  3. Why did I get the null exception while debugging


UPDATE 20/08/2020

While looking through the code, I found that all "delegate" calls are referred to a function which takes an intger but I couldn't find any obvious return from this function, what I do think it returns the function and method name but... HOW!! enter image description here

enter image description here

  • I do not know which one specifically, but perhaps one of the deobfuscators aside from de4dot can help? - github.com/NotPrab/.NET-Deobfuscator
    – Col-E
    Aug 20 '20 at 5:49
  • Thanks, but still I haven't accomplished anything with the list, but it's a really good list to keep.. I appreciate it.
    – mo5br
    Aug 20 '20 at 20:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.