[.NET] ConfuserEx脱壳工具打包

ConfuserEx 1.0.0脱壳步骤
Written by 今夕何夕[W.B.L.E. TeAm]

1.先用UnconfuserEx把主程序Dump出来；
2.使用CodeCracker大牛的ConfuserExStringDecryptor将加密的字符串解密；
3.使用CodeCracker大牛的ConfuserExSwitchKiller将混淆的switch分支结构解密；
4.若步骤3中解密致使程序崩溃，能够尝试ConfuserExUniversalControlFlowRemover这个工具，可是这个工具备bug，不是很推荐；
5.使用ConfuserExProxyCallFixer v2将混淆的函数名解析出来；
6.拖入de4dot去除其余混淆；
7.拖入dnspy应该能看到源码了。html

资源连接参考git

https://gist.github.com/Rottweiler/44fe4461a4552acf303agithub

实战

以炉石兄弟的2017年的最后版本为例app

ConfuserExStringDecryptor.exe获得vrdtoilmab_strdec.exe函数

ConfuserExSwitchKiller.exe获得vrdtoilmab_strdec_deobfuscated.exe工具

ConfuserEx Proxy Call Fixer v2.exe获得vrdtoilmab_strdec_deobfuscated_noproxy.exeui

de4dot处理获得加密

de4dot v3.1.41592.3405 Copyright (C) 2011-2015 de4dot@gmail.com
Latest version and source code: https://github.com/0xd4d/de4dotspa

Detected SmartAssembly 6.9.0.114 (C:\Program Files\de4dot-net35\vrdtoilmab_strdec_deobfuscated_noproxy.exe)
Cleaning C:\Program Files\de4dot-net35\vrdtoilmab_strdec_deobfuscated_noproxy.exe
WARNING: File 'C:\Program Files\de4dot-net35\vrdtoilmab_strdec_deobfuscated_noproxy.exe' contains XAML which isn't supported. Use --dont-rename.
Renaming all obfuscated symbols
Saving C:\Program Files\de4dot-net35\vrdtoilmab_strdec_deobfuscated_noproxy-cleaned.exe
ERROR:
ERROR:
ERROR:
ERROR: Hmmmm... something didn't work. Try the latest version.code

须要用一个特殊版本de4dot-Reactor5.0 https://ci.appveyor.com/project/ViRb3/de4dot-cex/build/artifacts?branch=master

de4dot v3.1.41592.3405 Copyright (C) 2011-2015 de4dot@gmail.com
Latest version and source code: https://github.com/0xd4d/de4dot

More than one obfuscator detected:
ConfuserEx v0.5.0-custom (use: -p crx)
SmartAssembly 6.9.0.114 (use: -p sa)
Detected SmartAssembly 6.9.0.114 (C:\workspace\clu\Downloads\de4dot-cex\vrdtoilmab_strdec_deobfuscated_noproxy.exe)
Cleaning C:\workspace\clu\Downloads\de4dot-cex\vrdtoilmab_strdec_deobfuscated_noproxy.exe
WARNING: File 'C:\workspace\clu\Downloads\de4dot-cex\vrdtoilmab_strdec_deobfuscated_noproxy.exe' contains XAML which isn't supported. Use --dont-rename.
Renaming all obfuscated symbols
Saving C:\workspace\clu\Downloads\de4dot-cex\vrdtoilmab_strdec_deobfuscated_noproxy-cleaned.exe

尝试了一下de4dot-cex，貌似能够一步作完

de4dot v3.1.41592.3405 Copyright (C) 2011-2015 de4dot@gmail.com
Latest version and source code: https://github.com/0xd4d/de4dot

More than one obfuscator detected: ConfuserEx v0.5.0-custom (use: -p crx) SmartAssembly 6.9.0.114 (use: -p sa)Detected SmartAssembly 6.9.0.114 (C:\workspace\clu\Downloads\de4dot-cex\vrdtoilmab.exe)Cleaning C:\workspace\clu\Downloads\de4dot-cex\vrdtoilmab.exeWARNING: File 'C:\workspace\clu\Downloads\de4dot-cex\vrdtoilmab.exe' contains XAML which isn't supported. Use --dont-rename.Renaming all obfuscated symbolsSaving C:\workspace\clu\Downloads\de4dot-cex\vrdtoilmab-cleaned.exe