用de4dot.exe 出现 Detected Unknown Obfuscator
求助，用de4dot.exe 出现 Detected Unknown ObfuscatorD:\War\3H3de4dot>de4dot.exe Cd.exe
de4dot v3.1.41592.3405
Detected Unknown Obfuscator (D:\War\3H3de4dot\Cd.exe)
Cleaning D:\War\3H3de4dot\Cd.exe
Renaming all obfuscated symbols
Saving D:\War\3H3de4dot\Cd-cleaned.exe
ERROR: ResolutionScope is null
Ignored 1 warning/error
Use -v/-vv option or set environment variable SHOWALLMESSAGES=1 to see all messa
ges
文件链接: https://pan.baidu.com/s/1xjV29hMjPE3SDUop6k9MTw 提取码: gvtw 本帖最后由 BlackHatRCE 于 2022-11-2 23:14 编辑
.NET Reactor is a product of Eziriz - https://www.eziriz.com/reactor_features.htmThis software is protected with .NET Reactor 6.x with VM .
I unpacked the Software from all kind of protection setting of .NET Reactor and removed the VM as well.DNR VM is pretty much 1:1 but this software is very complex written so It took a long time to clean the file.
.NET Reactor Unpacking -
1. You can use .NET Reactor Slayer - https://github.com/SychicBoy/NetReactorSlayer
2. Code Virtualization is a relatively new feature of .NET Reactor.
Here is a detailed VM Unpacking over a Sample Unpackme File -->Credits - TobitoFatito -
Analyze to detect the Virtualize Method :
https://i.imgur.com/hZtfeik.png
Start Renaming, Renaming is a really important aspect of this. Following the VM Method call we end up on a big method, where fun begins :
https://i.imgur.com/elGFLe4.png
We see that this method is only called once, which seems like a good place to start :
https://i.imgur.com/Zy23TPW.png
Following that method we reach here, where a binary reader is used to read a resource stream :
https://i.imgur.com/WrDMWzQ.png
After making a Good Devirtualization base, this seems to be the First Stage. (In my case i searched for resources with name length of 37 you might wanna do it differently.)Second stage I'd say is method locating, You simply wanna search for virtualized methods and get their ID and MethodDef.Back to the main method, the first for loop seems to be for method locals, the third seems to be for exception handlers, and the fourth seems to be for VM instruction deserializing :
https://i.imgur.com/k5UwU5F.png
Scrolling a bit more we finally reach the method that executes the instructions :
https://i.imgur.com/i8vVxx7.png
https://i.imgur.com/ZP28QlB.png
ExecuteInstruction method is really important, and its gonna be used for pattern matching stage. I Simply searched for a method with 3200+ instructions and a switch opcode. You might wanna do it differently :
https://i.imgur.com/swbJKtu.png
https://i.imgur.com/eFyyHhy.png
This is how i pattern matched the opcodes :
https://i.imgur.com/4xl67ok.png
And here is an example :
https://i.imgur.com/b5jsK2S.png
After we finish pattern matching the opcodes, its time for VM Method Dissasembling stage.I found that a good way to start is to loop the Decrypt2 variable that was initialized earlier.You will need to figure this out, method locals, exception handlers and vm instructions etc. :
https://i.imgur.com/dcZw0ir.png
After method disassembling stage, its time for vm method recompiling/rebuilding. We convert the .net reactor vm instructions to CIL.I just looped through every vm method instruction and used a switch . :DHere is an example :
https://i.imgur.com/caT0iPU.png
Final Stage is method replacing, where we replace the body of every virtualized method with the translated body :)
That's How you can add a save method :
Ctx . Module . Write ( Ctx . Options . OutPath , new ManagedPEImageBuilder ( new DotNetDirectoryFactory ( MetadataBuilderFlags . PreserveAll ))); Ctx . Options . Logger . Success ( $ "Wrote File At {Ctx.Options. OutPath}" );
de4dot .NET Reactor v6.x Modded by Mobile46
https://www.52pojie.cn/thread-1402864-1-1.html
(出处: 吾爱破解论坛)
de4dot最新版本，VS 2019编译，编译于20201104
https://www.52pojie.cn/thread-1297009-1-1.html
(出处: 吾爱破解论坛)
de4dot最后的版本，VS2019编译，支持.net core3.1,编译于20210120
https://www.52pojie.cn/thread-1354954-1-1.html
(出处: 吾爱破解论坛)
Sound 发表于 2022-9-6 18:10
de4dot .NET Reactor v6.x Modded by Mobile46
https://www.52pojie.cn/thread-1402864-1-1.html
(出处:...
谢谢Sound，都试过了一遍还是不行！ 是不是没有 对软件进行 破解 用detectiteasy结果如图，像这样的程序请教大佬们反混淆应对是什么思路？
zhoushaop 发表于 2022-9-13 17:23
用detectiteasy结果如图，像这样的程序请教大佬们反混淆应对是什么思路？
脱掉reactor,载入sae处理，保证你能看到源代码，，，运行不好说
页:
[1]