devirtualize? or what is this obfuscator? and how to get rid of this

Question

from previous question i still dont get any info or any process at all... now i asking again with this question is this virtualize code or something? i try many thing and it still didnt work [i unpack this dll from enigma virtual box]

hope someone can guide me from this thing thank you

---

Update

for someone who still checking this thread

the problem is DLL itself that get obfuscate,the unpack is not hard and this is not il2 file [this is pc desktop game] this obfuscate is undetect even by DIE [my guess is the author just rename the obfuscate that make deobfuscate program like de4dot unable to deobfus ]

and idk how to rename it back because all of the methods are unreadble just like my image post

so im still stuck with this... and i am so busy im sorry if someone who have the same problem didnt get much info except how to unpack [my guess that the author rename the obfuscate because the EVB that the author use also rename it with something else that make DIE undetect packer]

Answer 1

According to the descriptions provided in the question, Enigma Virtual Box does not necessarily virtualize a code, but rather allows the application's files and records to be consolidated into a single executable file, ie the reason for not being able to analyze is that the new file generated is a loader, already the .Net binary using ConfuserEx can be mostly deobfuscated (When not using mutation or not the latest version in which a manual unpack is needed), you can use tools to do the job for you, see a list of links:

• Enigma Virtual Box
• ConfuserEx-Unpacker
• ConfuserEx-Unpacker-Mod-by-Bed
• Confuser unpack by pc-ret(I didn't find a reliable link)

To manually obfuse you need to run it with a debugger until you reach EntryPoint from there, dump it and clean it with de4dot (in the older versions of the confuser).