5

Hello,

I am having an exe file that I am trying to deobfuscate and debug using dnspy. The exe file was written in C# and obfuscated with unknown deobfuscate according to de4dot! I tried to all my known methods to procced but still I was not able to fully deobfusticated it.

Analysing the File

- Exeinfo PE

I tried to analysie the file with exeinfope to check which obfustactor was used but I only got [obfus/crypted].

Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 [ Obfus/Crypted- StrongName set ] - EP Token : 06000080 , Overlay : 403900... Nothing discovered

enter image description here

- Dnspy

Opening the file in dnspy but the code wasn't readable, especially the methods and the functions name are in unicode form.

enter image description here

My Attempts:

  1. Tried to deobfustace the file with de4dot, but I get "Detected Unknown Obfuscator" followed by an error.
  2. Tried a modded version of de4dot, and I was able to deobfustacte the exe,but all functions shown as "delegate". The exe file was detected as "Unkown Obfustactor" as well, but managed to cleaned it. enter image description here
  3. Tried to debug the cleaned verison but when I start dnspy I get an exception (System.NullReferenceException) enter image description here

My Questions:

  1. Which obfustactor was used ?
  2. Why all functions are defined as "delgate"?
  3. Why did I get the null exception while debugging

Thanks...

UPDATE 20/08/2020

While looking through the code, I found that all "delegate" calls are referred to a function which takes an intger but I couldn't find any obvious return from this function, what I do think it returns the function and method name but... HOW!! enter image description here

enter image description here

Improve this question
6
  • I do not know which one specifically, but perhaps one of the deobfuscators aside from de4dot can help? - github.com/NotPrab/.NET-Deobfuscator
    – Col-E
    Commented Aug 20, 2020 at 5:49
  • Thanks, but still I haven't accomplished anything with the list, but it's a really good list to keep.. I appreciate it.
    – mo5br
    Commented Aug 20, 2020 at 20:15
  • I have the same problem, I have tried many tools, but after deobfuscation, the program doesn't work
    – mike bria
    Commented Dec 1, 2021 at 7:50
  • This looks like a crypto obfuscator assembly, get in touch with me and i might be able to run a tool i developed to deob this kind of obfuscated code.
    – Mastercodeon
    Commented Apr 27, 2022 at 7:36
  • 2
    Can you take a TTD trace of the app launching? docs.microsoft.com/en-us/windows-hardware/drivers/debugger/… This could be used to analyze what is going on, but it may or may not work, and needs some familiarity with windbg and the sos/sosex extensions to use effectively
    – chentiangemalc
    Commented Apr 27, 2022 at 7:51

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.