Thread: Deobfuscation of .Net Reactor : app exit
View Single Post
  #1  
Old 02-10-2017, 06:01
tusk tusk is offline
Friend
  
Join Date: Jun 2016
Posts: 36
Rept. Given: 0
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 9
Thanks Rcvd at 19 Times in 12 Posts
tusk Reputation: 0
Question Deobfuscation of .Net Reactor : app exit
Hi guys,

I'm working on a target which is obfuscated with .Net Reactor 4.8/4.9
I used de4dot and got my cleaned assembly.

After studying the code (dnspy), I modified the IL where I needed... so far so good. Debugging, working ok.

The strange part is then when I launch the app, it will then exit before the end of the initial load.
So I went further and I found 4 different places where this happens. The code is very similar in every 4 places (lots of "__Dereference")... I have no idea what it's doing to be honest!

Do you guys think this could be related to a bad deobfuscation ?
(i will copy an exemple of the code)
Last edited by tusk; 02-10-2017 at 06:24.
Reply With Quote