deobfuscate procedure for confuser and confuserex

Viewed 25

I am trying to deobfuscate an exe which was protected by confuser and confuserex.enter image description here

i have tried de4dot and unconfuser but not working.

.octor is as follows

static <Module>()
{
    <Module>.\u202D\u202E\u206C\u202B\u200E\u200B\u202D\u206E\u200B\u200D\u206D\u206A\u206A\u206D\u200D\u206D\u202B\u202D\u202B\u202E\u202C\u202D\u200D\u206E\u202C\u200F\u200B\u200E\u206E\u206D\u200D\u200D\u206F\u206C\u206D\u202E\u206D\u202E\u200E\u202E\u202E();
    <Module>.\u200F\u206F\u200E\u200E\u202C\u206F\u206B\u202C\u200D\u206C\u206F\u206B\u200E\u200B\u206C\u206B\u206B\u202E\u206E\u200E\u200C\u200E\u206C\u202D\u202D\u202C\u202E\u202C\u202D\u200F\u206C\u206F\u200C\u202C\u206F\u200C\u206C\u206D\u200E\u202E();
    for (;;)
    {
        IL_0A:
        uint num = 1109210288U;
        for (;;)
        {
            uint num2;
            switch ((num2 = (num ^ 2085094670U)) % 5U)
            {
            case 0U:
                <Module>.\u206A\u200D\u202A\u206B\u200B\u200B\u200C\u200D\u200E\u202B\u200F\u200C\u202B\u202E\u202B\u200F\u200B\u202D\u206B\u202C\u202D\u200E\u202A\u206C\u200E\u206F\u206E\u206E\u206C\u202E\u200F\u200E\u202B\u200F\u206F\u200E\u206D\u200F\u200C\u206D\u202E();
                num = (num2 * 2826792407U ^ 1872845315U);
                continue;
            case 1U:
                <Module>.\u202A\u200E\u206E\u202E\u206C\u200E\u206D\u200C\u200F\u200E\u202B\u202E\u202A\u206A\u202E\u200B\u206F\u202C\u206C\u206D\u202C\u202D\u206D\u206E\u206A\u202C\u202B\u200C\u200C\u202D\u206F\u206F\u206C\u206A\u202C\u200C\u206C\u206D\u202D\u206B\u202E();
                num = (num2 * 556437799U ^ 402973224U);
                continue;
            case 2U:
                <Module>.\u206F\u206E\u206F\u200D\u202E\u206A\u206A\u202E\u202D\u202E\u200B\u206D\u200D\u206E\u202C\u200D\u206C\u202D\u200E\u206A\u206F\u200C\u206B\u206E\u200F\u202E\u200F\u200E\u202C\u200E\u200F\u206A\u200C\u202A\u200E\u206B\u200D\u206F\u200F\u202D\u202E();
                num = (num2 * 3544115464U ^ 948857759U);
                continue;
            case 3U:
                goto IL_0A;
            }
            return;
        }
    }
}

and entry point is :

[STAThread]
private static void \u206A\u200B\u202E\u200F\u206A\u206B\u200C\u202C\u206A\u202B\u206D\u202E\u202A\u200B\u206A\u206E\u206E\u206A\u206A\u200E\u206F\u202A\u206F\u206C\u202E\u200D\u200C\u206E\u200C\u202E\u206A\u200E\u206C\u202E\u200F\u206D\u202D\u200C\u202A\u200F\u202E()
{
    /*

An exception occurred when decompiling this method (0600005D)

ICSharpCode.Decompiler.DecompilerException: Error decompiling System.Void ‭‬‪‎‎‪‍‍‍‮‏‏‫‭‭‭‪‎‪‬‪‪‮::​‮‏‌‬‫‮‪​‎‪‮‍‌‌‮‎‮‏‭‌‪‏‮()

---> System.OverflowException: Arithmetic operation resulted in an overflow. at ICSharpCode.Decompiler.ILAst.ILAstBuilder.StackSlot.ModifyStack(StackSlot[] stack, Int32 popCount, Int32 pushCount, ByteCode pushDefinition) in D:\a\dnSpy\dnSpy\Extensions\ILSpy.Decompiler\ICSharpCode.Decompiler\ICSharpCode.Decompiler\ILAst\ILAstBuilder.cs:line 47 at ICSharpCode.Decompiler.ILAst.ILAstBuilder.StackAnalysis(MethodDef methodDef) in D:\a\dnSpy\dnSpy\Extensions\ILSpy.Decompiler\ICSharpCode.Decompiler\ICSharpCode.Decompiler\ILAst\ILAstBuilder.cs:line 387 at ICSharpCode.Decompiler.ILAst.ILAstBuilder.Build(MethodDef methodDef, Boolean optimize, DecompilerContext context) in D:\a\dnSpy\dnSpy\Extensions\ILSpy.Decompiler\ICSharpCode.Decompiler\ICSharpCode.Decompiler\ILAst\ILAstBuilder.cs:line 269 at ICSharpCode.Decompiler.Ast.AstMethodBodyBuilder.CreateMethodBody(IEnumerable1 parameters, MethodDebugInfoBuilder& builder) in D:\a\dnSpy\dnSpy\Extensions\ILSpy.Decompiler\ICSharpCode.Decompiler\ICSharpCode.Decompiler\Ast\AstMethodBodyBuilder.cs:line 112 at ICSharpCode.Decompiler.Ast.AstMethodBodyBuilder.CreateMethodBody(MethodDef methodDef, DecompilerContext context, AutoPropertyProvider autoPropertyProvider, IEnumerable1 parameters, Boolean valueParameterIsKeyword, StringBuilder sb, MethodDebugInfoBuilder& stmtsBuilder) in D:\a\dnSpy\dnSpy\Extensions\ILSpy.Decompiler\ICSharpCode.Decompiler\ICSharpCode.Decompiler\Ast\AstMethodBodyBuilder.cs:line 88 --- End of inner exception stack trace --- at ICSharpCode.Decompiler.Ast.AstMethodBodyBuilder.CreateMethodBody(MethodDef methodDef, DecompilerContext context, AutoPropertyProvider autoPropertyProvider, IEnumerable`1 parameters, Boolean valueParameterIsKeyword, StringBuilder sb, MethodDebugInfoBuilder& stmtsBuilder) in D:\a\dnSpy\dnSpy\Extensions\ILSpy.Decompiler\ICSharpCode.Decompiler\ICSharpCode.Decompiler\Ast\AstMethodBodyBuilder.cs:line 92 at ICSharpCode.Decompiler.Ast.AstBuilder.<>c__DisplayClass90_0.b__0() in D:\a\dnSpy\dnSpy\Extensions\ILSpy.Decompiler\ICSharpCode.Decompiler\ICSharpCode.Decompiler\Ast\AstBuilder.cs:line 1519 */; }

0 Answers
Related