1

enter image description here

from previous question i still dont get any info or any process at all... now i asking again with this question is this virtualize code or something? i try many thing and it still didnt work [i unpack this dll from enigma virtual box]

hope someone can guide me from this thing thank you


Update

for someone who still checking this thread

the problem is DLL itself that get obfuscate,the unpack is not hard and this is not il2 file [this is pc desktop game] this obfuscate is undetect even by DIE [my guess is the author just rename the obfuscate that make deobfuscate program like de4dot unable to deobfus ]

and idk how to rename it back because all of the methods are unreadble just like my image post

so im still stuck with this... and i am so busy im sorry if someone who have the same problem didnt get much info except how to unpack [my guess that the author rename the obfuscate because the EVB that the author use also rename it with something else that make DIE undetect packer]

2
  • Before you need to find out which obfuscator / protector / virtualizer is used, some obfuscators like ConfuserEx also emit the same result depending on the options chosen, please provide more information so that I can help.
    – 0x0A
    Apr 23 at 13:07
  • i unpack this Assembly from EXE file [in this case they use Enigma Virtual Box] and this is what i got i try to deConfuserEx too but its still not work so idk much that this any more... and thank you for reply
    – EntryEmb
    Apr 25 at 14:36
1

According to the descriptions provided in the question, Enigma Virtual Box does not necessarily virtualize a code, but rather allows the application's files and records to be consolidated into a single executable file, ie the reason for not being able to analyze is that the new file generated is a loader, already the .Net binary using ConfuserEx can be mostly deobfuscated (When not using mutation or not the latest version in which a manual unpack is needed), you can use tools to do the job for you, see a list of links:

To manually obfuse you need to run it with a debugger until you reach EntryPoint from there, dump it and clean it with de4dot (in the older versions of the confuser).

10
  • but how can i dump it when the EXE file only has PE? i try megadumper before but the result is still the same also thank you for reply as alway
    – EntryEmb
    Apr 27 at 10:37
  • did you mention that he used Engima Virtual Box correct? if yes you need to use an extraction tool for it, from there you will probably get several files, try to extract the resources to see if you can get an IL file.
    – 0x0A
    Apr 27 at 11:01
  • i pretty sure that it is EVB from this ibb.co/K6QxYRS
    – EntryEmb
    Apr 27 at 11:24
  • and this is the file i got ibb.co/mHZSYkv (this is a game EXE file) i forgot to mention this
    – EntryEmb
    Apr 27 at 11:25
  • I will take a look when I have time, if my answer was helpful please accept it so that it reaches more people.
    – 0x0A
    Apr 27 at 18:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.