Is there a way to decompress a Fody-Costura generated exe in c#?

Question

There is a program that is possibly a RAT, and I would like to view the source code. After opening the .exe in dnSpy, I was able to tell that it was compressed with Fody-Costura. (https://github.com/Fody/Costura) Is there any way to de-compress the file? If so, how?

Answer 1

Embedded assemblies needs to be decompressed before they can be used so you can inspect all the code that does that in the assembly. Just go to Costura.AssemblyLoader to check how it is done. below is a extract from a simple example using Costura.Fody.

Assembly executingAssembly = Assembly.GetExecutingAssembly();
if (fullName.EndsWith(".compressed"))
{
    using (Stream manifestResourceStream = executingAssembly.GetManifestResourceStream(fullName))
    {
        using (DeflateStream deflateStream = new DeflateStream(manifestResourceStream, CompressionMode.Decompress))
        {
            MemoryStream memoryStream = new MemoryStream();
            AssemblyLoader.CopyTo(deflateStream, memoryStream);
            memoryStream.Position = 0L;
            return memoryStream;
        }
    }
}

You could modify this code to save decompressed assemblies to disk by adding a line File.WriteAllBytes(fullName.Replace(".compressed", ""), memoryStream.ToArray()); or just extract dlls resources and decompress externally via python or anything else that can do deflate.

Answer 2

I had success using the Fody-Costura-Decompress tool.

You would need to build the solution from source. it has a simple GUI for choosing your file and decompressing it.