[.NET] ConfuserEx脫殼工具打包

ConfuserEx 1.0.0脫殼步驟
Written by 今夕何夕[W.B.L.E. TeAm]

1.先用UnconfuserEx把主程序Dump出來；
2.使用CodeCracker大牛的ConfuserExStringDecryptor將加密的字符串解密；
3.使用CodeCracker大牛的ConfuserExSwitchKiller將混淆的switch分支結構解密；
4.若步驟3中解密緻使程序崩潰，能夠嘗試ConfuserExUniversalControlFlowRemover這個工具，可是這個工具備bug，不是很推薦；
5.使用ConfuserExProxyCallFixer v2將混淆的函數名解析出來；
6.拖入de4dot去除其餘混淆；
7.拖入dnspy應該能看到源碼了。html

資源連接參考git

https://gist.github.com/Rottweiler/44fe4461a4552acf303agithub

實戰

以爐石兄弟的2017年的最後版本爲例app

ConfuserExStringDecryptor.exe獲得vrdtoilmab_strdec.exe函數

ConfuserExSwitchKiller.exe獲得vrdtoilmab_strdec_deobfuscated.exe工具

ConfuserEx Proxy Call Fixer v2.exe獲得vrdtoilmab_strdec_deobfuscated_noproxy.exeui

de4dot處理獲得加密

de4dot v3.1.41592.3405 Copyright (C) 2011-2015 de4dot@gmail.com
Latest version and source code: https://github.com/0xd4d/de4dotspa

Detected SmartAssembly 6.9.0.114 (C:\Program Files\de4dot-net35\vrdtoilmab_strdec_deobfuscated_noproxy.exe)
Cleaning C:\Program Files\de4dot-net35\vrdtoilmab_strdec_deobfuscated_noproxy.exe
WARNING: File 'C:\Program Files\de4dot-net35\vrdtoilmab_strdec_deobfuscated_noproxy.exe' contains XAML which isn't supported. Use --dont-rename.
Renaming all obfuscated symbols
Saving C:\Program Files\de4dot-net35\vrdtoilmab_strdec_deobfuscated_noproxy-cleaned.exe
ERROR:
ERROR:
ERROR:
ERROR: Hmmmm... something didn't work. Try the latest version.code

須要用一個特殊版本de4dot-Reactor5.0 https://ci.appveyor.com/project/ViRb3/de4dot-cex/build/artifacts?branch=master

de4dot v3.1.41592.3405 Copyright (C) 2011-2015 de4dot@gmail.com
Latest version and source code: https://github.com/0xd4d/de4dot

More than one obfuscator detected:
ConfuserEx v0.5.0-custom (use: -p crx)
SmartAssembly 6.9.0.114 (use: -p sa)
Detected SmartAssembly 6.9.0.114 (C:\workspace\clu\Downloads\de4dot-cex\vrdtoilmab_strdec_deobfuscated_noproxy.exe)
Cleaning C:\workspace\clu\Downloads\de4dot-cex\vrdtoilmab_strdec_deobfuscated_noproxy.exe
WARNING: File 'C:\workspace\clu\Downloads\de4dot-cex\vrdtoilmab_strdec_deobfuscated_noproxy.exe' contains XAML which isn't supported. Use --dont-rename.
Renaming all obfuscated symbols
Saving C:\workspace\clu\Downloads\de4dot-cex\vrdtoilmab_strdec_deobfuscated_noproxy-cleaned.exe

嘗試了一下de4dot-cex，貌似能夠一步作完

de4dot v3.1.41592.3405 Copyright (C) 2011-2015 de4dot@gmail.com
Latest version and source code: https://github.com/0xd4d/de4dot

More than one obfuscator detected: ConfuserEx v0.5.0-custom (use: -p crx) SmartAssembly 6.9.0.114 (use: -p sa)Detected SmartAssembly 6.9.0.114 (C:\workspace\clu\Downloads\de4dot-cex\vrdtoilmab.exe)Cleaning C:\workspace\clu\Downloads\de4dot-cex\vrdtoilmab.exeWARNING: File 'C:\workspace\clu\Downloads\de4dot-cex\vrdtoilmab.exe' contains XAML which isn't supported. Use --dont-rename.Renaming all obfuscated symbolsSaving C:\workspace\clu\Downloads\de4dot-cex\vrdtoilmab-cleaned.exe