Unknown Obfuscator

[thanhlouis]

I'm seeking assistance in deobfuscating this file. It seems to be protected by an unknown or unsupported obfuscator that de4dot cannot currently handle.

Download Link: https://gofile.io/d/K6mLyY

⚠️ Warning: This file contains malware/is highly suspicious. Please handle it with caution in a secured sandbox environment.

Issue: de4dot fails to detect or clean the assembly correctly.

I would appreciate it if you could take a look when you have time. Thank you

[meck-gd]

The storage stream names state "Protected By Crank". This doesn't seem to be a publicly known protector. The code looks quite messy, it starts out by parsing the PE header and manipulating the PE in memory. There may also be native code in play at some point.

[meck-gd]

It's ConfuserEx with some crypter on top of it.

Dump it as follows:

1. Open in 32-bit dnSpy.
2. Find in first cctor call:

   	for (uint num14 = 0U; num14 < num3; num14 += 1U)
   	{
   		*ptr3 ^= array[(int)(num13 & 15U)];
   		array[(int)(num13 & 15U)] = (array[(int)(num13 & 15U)] ^ *(ptr3++)) + 1035675673U;
   		num13 += 1U;
   	}
   	Module module2 = typeof(<Module>).Module;
   

   Set breakpoint at the Module module2 line. This is after it has decrypted the assembly.
3. Run, breakpoint should be hit.
4. Find the next return, inside a FullyQualifiedName check. Right-click on return -> set next instruction. This skips a bunch of anti-dump stuff. Press F11 twice until you are in the next cctor call - dnSpy should load a new assembly, which is now decrypted.
5. Save the assembly.

The dump still fails to be deobfuscated with de4dotEx atm, even when specifying -p crx. Could be because it's a modified ConfuserEx or because advanced options have been used.

[meck-gd]

@thanhlouis Release 3.5.1 now supports deobfuscating the dumped binary. When saving the module in dnSpy, make sure to tick "Preserve all MD Tokens", "Preserve Heap Offsets" and "Preserve Extra Signature Data".

[thanhlouis]

Worked. Thank you !!