1

There is a program that is possibly a RAT, and I would like to view the source code. After opening the .exe in dnSpy, I was able to tell that it was compressed with Fody-Costura. (https://github.com/Fody/Costura) Is there any way to de-compress the file? If so, how?

1

Embedded assemblies needs to be decompressed before they can be used so you can inspect all the code that does that in the assembly. Just go to Costura.AssemblyLoader to check how it is done. below is a extract from a simple example using Costura.Fody.

Assembly executingAssembly = Assembly.GetExecutingAssembly();
if (fullName.EndsWith(".compressed"))
{
    using (Stream manifestResourceStream = executingAssembly.GetManifestResourceStream(fullName))
    {
        using (DeflateStream deflateStream = new DeflateStream(manifestResourceStream, CompressionMode.Decompress))
        {
            MemoryStream memoryStream = new MemoryStream();
            AssemblyLoader.CopyTo(deflateStream, memoryStream);
            memoryStream.Position = 0L;
            return memoryStream;
        }
    }
}

You could modify this code to save decompressed assemblies to disk by adding a line File.WriteAllBytes(fullName.Replace(".compressed", ""), memoryStream.ToArray()); or just extract dlls resources and decompress externally via python or anything else that can do deflate.

2
  • Hi! Thanks for the reply! How should I go about extracting the resources? I found a few resource extractors, but none of them seem to work. – Nqndi Jun 5 at 12:29
  • dnSpy has an option to save reaources. – Paweł Łukasik Jun 5 at 13:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.