search

yck1509 / ConfuserEx

An open-source, free protector for .NET applications
http://yck1509.github.io/ConfuserEx/
Other
3.56k stars 1.61k forks source link

Deobfuscating ConfuserEx 0.4.0 - 0.6.0 and custom versions #394

Open dspwhite opened 8 years ago

dspwhite commented 8 years ago

Let's start with the earlier version 0.4.0 first of all. I've heard there are deobfuscators available for it. For example, here.

I was just wondering if advanced usage of the options as detailed here would prevent such deobfuscation? For example the jit mode for Anti Tamper protection being one of them (there are many more).

In other words, how vulnerable would my program be to deobfuscation if I used 0.4.0 and all the advanced parameters? Same question, but with 0.6.0?

To help protect an exe further, you suggested a few ideas to help obfuscation. Would those ideas still be applicable for 0.6?

Unfortunately, I can't compile the source straight off. Is there any chance you could create a unique version (with some very quick changes like simple changes to constants etc., nothing too extravagant) if I paid you say £50 to £100 to do it? Or maybe there's a plugin I can buy for a similar amount?

yck1509 commented 8 years ago

Hi,

Most of the protections focused on defeating newer tools was implemented in v0.5, so If you're using 0.4, these new protection options would not be available to you. However, crackers had been focusing on ConfuserEx for a long time, so I would not consider it very safe to use unmodified ConfuserEx.

You can make modifications to the protection algorithm, as mentioned in the post you referred. This should stop many of the tools from working. If you cannot compile the source, please tell what errors you received.

dspwhite commented 8 years ago

Sure. When I first open the project I get:

R:\ConfuserEx-master\dnlib\src\dnlib.csproj : error : Unable to read the project file 'dnlib.csproj'.

R:\ConfuserEx-master\dnlib\src\dnlib.csproj: The project file could not be loaded. Could not find a part of the path 'R:\ConfuserEx-master\dnlib\src\dnlib.csproj'.

Then when I try to compile I get this mess: http://i.imgur.com/j0pb1Ma.png

yck1509 commented 8 years ago

You'll have to get the dnlib project and put it under the root directory. Also you'll need NuGet to automatically restore the package dependencies ConfuserEx uses.

dspwhite commented 8 years ago

Nuget won't install on my system (I've had problems before where it crashed, and I suspect it's due to requiring a version of VS later than 2010). I would be very grateful if you could compile a "slightly modified" version (as discussed above) for me as long as it supported method exclusion along with the crproj attribute. A "thank you" gift for around £100, maybe £200 or even £300 would be yours - you deserve for making such an ace program in the first place. My email is twinbee42 [at] skytopia.com.

yck1509 commented 8 years ago

If you just want to use crproj and ObfuscationAttribute together, you can just download the latest build from the CI Server. Alternately you can try compiling using the script at /Build/Build.cmd.

dspwhite commented 8 years ago

Yes, I was hoping for that combined with the "slightly modified custom obfuscation" version since I'm having difficulty with compilation of ConfuserEx. But not to worry.

yck1509 commented 8 years ago

I'm afraid I can't take on your offer as my time is quite limited these days. However if you encounter any problems in modifying, please feel free to ask me.

dspwhite commented 8 years ago

I managed to get a VS2010-friendly version of Nuget (it needs to be installed as an extension). I went ahead and got the dnlib project, put the contents into the dnlib folder you provided, and then used Nuget to install the appropriate packages.

Now I get this new mess when I compile: http://i.imgur.com/g5aIxcM.png

For example, I looked for Confuser.Core.dll, but it was nowhere to be seen. What shall I do next? Thanks for your help so far on this.