forked from KOLANICH-tools/de4dot
-
Notifications
You must be signed in to change notification settings - Fork 13
String decryption crashes with newer versions of Eazfuscator.NET #25
Copy link
Copy link
Open
Description
When deobfuscating Opus Magnum (obfuscated with Eazfuscator), a binary published Feb 1, 2024 deobfuscates with de4dotEx fine, but one from March 17, 2026 (and since then) fails to decompile. The deobfuscation first crashes when attempting to detect the obfuscator used, in the Agile.NET detector:
de4dotEx v3.5.1.0
ERROR:
ERROR:
ERROR:
ERROR: ------------------------------------------------------------------------------
ERROR: Stack trace:
ERROR: at de4dot.code.deobfuscators.Agile_NET.ProxyCallFixer.FindDelegateCreator() in /Users/patrick/Downloads/de4dotEx/de4dot.code/deobfuscators/Agile_NET/ProxyCallFixer.cs:line 47
ERROR: at de4dot.code.deobfuscators.Agile_NET.Deobfuscator.ScanForObfuscator() in /Users/patrick/Downloads/de4dotEx/de4dot.code/deobfuscators/Agile_NET/Deobfuscator.cs:line 162
ERROR: at de4dot.code.deobfuscators.DeobfuscatorBase.Detect() in /Users/patrick/Downloads/de4dotEx/de4dot.code/deobfuscators/DeobfuscatorBase.cs:line 126
ERROR: at de4dot.code.ObfuscatedFile.DetectObfuscator2(IEnumerable`1 deobfuscators) in /Users/patrick/Downloads/de4dotEx/de4dot.code/ObfuscatedFile.cs:line 269
ERROR: at de4dot.code.ObfuscatedFile.DetectObfuscator(IEnumerable`1 deobfuscators) in /Users/patrick/Downloads/de4dotEx/de4dot.code/ObfuscatedFile.cs:line 257
ERROR: at de4dot.code.ObfuscatedFile.Load(IList`1 deobfuscators) in /Users/patrick/Downloads/de4dotEx/de4dot.code/ObfuscatedFile.cs:line 135
ERROR: at de4dot.cui.FilesDeobfuscator.DotNetFileLoader.Add(IObfuscatedFile file, Boolean skipUnknownObfuscator, Boolean isFromPossibleFiles) in /Users/patrick/Downloads/de4dotEx/de4dot.cui/FilesDeobfuscator.cs:line 211
ERROR: at de4dot.cui.FilesDeobfuscator.DotNetFileLoader.Load()+MoveNext() in /Users/patrick/Downloads/de4dotEx/de4dot.cui/FilesDeobfuscator.cs:line 190
ERROR: at de4dot.cui.FilesDeobfuscator.LoadAllFiles(Boolean onlyScan)+MoveNext() in /Users/patrick/Downloads/de4dotEx/de4dot.cui/FilesDeobfuscator.cs:line 161
ERROR: at System.Collections.Generic.List`1..ctor(IEnumerable`1 collection)
ERROR: at de4dot.cui.FilesDeobfuscator.DeobfuscateAll() in /Users/patrick/Downloads/de4dotEx/de4dot.cui/FilesDeobfuscator.cs:line 128
ERROR: at de4dot.cui.FilesDeobfuscator.DoIt() in /Users/patrick/Downloads/de4dotEx/de4dot.cui/FilesDeobfuscator.cs:line 89
ERROR: at de4dot.cui.Program.Main(String[] args) in /Users/patrick/Downloads/de4dotEx/de4dot.cui/Program.cs:line 124
ERROR:
ERROR:
ERROR: Caught an exception:
ERROR:
ERROR: ------------------------------------------------------------------------------
ERROR: Message:
ERROR: Object reference not set to an instance of an object.
ERROR: Type:
ERROR: System.NullReferenceException
ERROR: ------------------------------------------------------------------------------
Adding an early return in FindDelegateCreator fixes this, and Eazfuscator.NET is properly detected, but when attempting to actually deobfuscate it fails again:
de4dotEx v3.5.1.0
Detected Eazfuscator.NET 3.3.149 - 3.4 (/Users/patrick/Library/Application Support/Steam/steamapps/common/Opus Magnum/Opus Magnum.app/Contents/Resources/Lightning.exe)
Cleaning /Users/patrick/Library/Application Support/Steam/steamapps/common/Opus Magnum/Opus Magnum.app/Contents/Resources/Lightning.exe
WARNING: Can't decrypt strings. Possibly a new Eazfuscator.NET version.
ERROR:
ERROR:
ERROR:
ERROR: ------------------------------------------------------------------------------
ERROR: Stack trace:
ERROR: at de4dot.code.deobfuscators.Eazfuscator_NET.StringDecrypter.Decrypt(Int32 val) in /Users/patrick/Downloads/de4dotEx/de4dot.code/deobfuscators/Eazfuscator_NET/StringDecrypter.cs:line 466
ERROR: at de4dot.code.deobfuscators.Eazfuscator_NET.Deobfuscator.<DeobfuscateBegin>b__18_0(MethodDef method2, MethodSpec gim, Object[] args) in /Users/patrick/Downloads/de4dotEx/de4dot.code/deobfuscators/Eazfuscator_NET/Deobfuscator.cs:line 103
ERROR: at de4dot.code.StaticStringInliner.InlineAllCalls() in /Users/patrick/Downloads/de4dotEx/de4dot.code/StringInliner.cs:line 175
ERROR: at de4dot.code.MethodReturnValueInliner.Decrypt(MethodDef method, List`1 allBlocks) in /Users/patrick/Downloads/de4dotEx/de4dot.code/MethodReturnValueInliner.cs:line 186
ERROR: at de4dot.code.MethodReturnValueInliner.Decrypt(Blocks blocks) in /Users/patrick/Downloads/de4dotEx/de4dot.code/MethodReturnValueInliner.cs:line 174
ERROR: at de4dot.code.deobfuscators.DeobfuscatorBase.DeobfuscateStrings(Blocks blocks) in /Users/patrick/Downloads/de4dotEx/de4dot.code/deobfuscators/DeobfuscatorBase.cs:line 143
ERROR: at de4dot.code.ObfuscatedFile.DeobfuscateStrings(Blocks blocks) in /Users/patrick/Downloads/de4dotEx/de4dot.code/ObfuscatedFile.cs:line 658
ERROR: at de4dot.code.ObfuscatedFile.Deobfuscate(MethodDef method, BlocksCflowDeobfuscator cflowDeobfuscator, MethodPrinter methodPrinter, Boolean isVerbose, Boolean isVV) in /Users/patrick/Downloads/de4dotEx/de4dot.code/ObfuscatedFile.cs:line 630
ERROR: at de4dot.code.ObfuscatedFile.DeobfuscateMethods() in /Users/patrick/Downloads/de4dotEx/de4dot.code/ObfuscatedFile.cs:line 560
ERROR: at de4dot.code.ObfuscatedFile.Deobfuscate() in /Users/patrick/Downloads/de4dotEx/de4dot.code/ObfuscatedFile.cs:line 373
ERROR: at de4dot.cui.FilesDeobfuscator.DeobfuscateAllFiles(IEnumerable`1 allFiles) in /Users/patrick/Downloads/de4dotEx/de4dot.cui/FilesDeobfuscator.cs:line 373
ERROR: at de4dot.cui.FilesDeobfuscator.DeobfuscateAll() in /Users/patrick/Downloads/de4dotEx/de4dot.cui/FilesDeobfuscator.cs:line 130
ERROR: at de4dot.cui.FilesDeobfuscator.DoIt() in /Users/patrick/Downloads/de4dotEx/de4dot.cui/FilesDeobfuscator.cs:line 89
ERROR: at de4dot.cui.Program.Main(String[] args) in /Users/patrick/Downloads/de4dotEx/de4dot.cui/Program.cs:line 124
ERROR:
ERROR:
ERROR: Caught an exception:
ERROR:
ERROR: ------------------------------------------------------------------------------
ERROR: Message:
ERROR: Object reference not set to an instance of an object.
ERROR: Type:
ERROR: System.NullReferenceException
ERROR: ------------------------------------------------------------------------------
Hopefully this is something that can be recreated with an assembly obfuscated with the trial of Eazfuscator, since Opus Magnum is a paid game. I would try myself but I can't get Eazfuscator to run under Crossover on MacOS. I can run any tests as long as they work on MacOS
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
No labels