search

XenocodeRCE / neo-ConfuserEx

Updated ConfuserEX, an open-source, free obfuscator for .NET applications
http://yck1509.github.io/ConfuserEx/
Other
746 stars 89 forks source link

How to remove ConfuserEx signature ? #32

Closed mridah closed 5 years ago

mridah commented 5 years ago

I have replaced all occurances of ConfuserEx from the project, but still hex editor shows ConfuserEx v1.0.0-xxxxxx signature somewhere in the ex, and decompilers re able to identify it's encrypted using ConfuserEx. How can I remove this signature ? @XenocodeRCE

XenocodeRCE commented 5 years ago

Hello,

Can you show me where it shows ConfuserEx v1.0.0-xxx... ?

mridah commented 5 years ago

Hi,

Thanks for the fast reply :) I've attached the screenshots of a Hex editor, showing the signature, and of a software Exeinfo PE which shows that the exe has been encrypted using ConfuserEx. I've replaced ALL occurances of ConfuserEx in the entire solution.

confuserex_0

confuserex_1

XenocodeRCE commented 5 years ago

Hello.

You need to remove the assembly builder info too :

• https://github.com/XenocodeRCE/neo-ConfuserEx/blob/master/Build/UpdateVersion.cs • https://github.com/XenocodeRCE/neo-ConfuserEx/blob/master/GlobalAssemblyInfo.Template.cs

mkaring commented 5 years ago

Maybe it looks for the watermark? I think it always writes the file signature of the ConfuserEx executable into the ConfusedBy attribute.

mridah commented 5 years ago

Thanks @XenocodeRCE , and @mkaring. It's working fine now :+1: