Confuser 1.X

[J4yRich]

http://farm9.staticflickr.com/8599/29426620652_6c62995c43_o.png

Can you for me tutorial unpack it ?

[SlowLogicBoy]

It's not that easy to unpack confuser. You can try using NoFuserEx or if it's really Confuser not ConfuserEx try using de4dot However you will need to do some research by yourself, cause most of the tutorials are for specific cases. To give you some hints:

• I use dnSpy to debug .exe set breakpoints, where it loads and decrypts packed module (usualy it's called koi), then I save it from memory (I haven't found exactly where it decrypts it completely I just bruteforce it)
• you will need to edit PE, set main module and entry point etc... for saved module.
• de4dot for cleaning saved module
• Read some papers from here these gave me a kick start on reverse engineering .net.

[J4yRich]

Can you help me handle it ? Please send for me your email.

[SlowLogicBoy]

Well I don't have an email I could give you. You can ask something in this issue if project owners do not mind.

[maithanhtan]

Hi J4yRich , can you share the tools in image. Thanks

[SlowLogicBoy]

@maithanhtan https://github.com/horsicq/Detect-It-Easy

[longlostbro]

@SlowLogicBoy what about those cases where it isn't called koi?

[SlowLogicBoy]

@longlostbro then modify your tools to handle the other name.