Exetools  

Go Back   Exetools > General > General Discussion

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 09-01-2025, 23:03
Nooboy Nooboy is offline
Friend
 
Join Date: Aug 2025
Posts: 6
Rept. Given: 0
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 4
Thanks Rcvd at 1 Time in 1 Post
Nooboy Reputation: 0
unpack Confuser.Core 1.6.0

Does anyone know how to unpack Confuser.Core 1.6.0+447341964f?
I've tried many methods, but none of them work. Is there a public tool for this?

Why can't I find .FREE in the module?

any suggestions,Thanks.
Reply With Quote
  #2  
Old 09-06-2025, 05:32
ENCLU ENCLU is offline
Friend
 
Join Date: Oct 2024
Location: In an enclave
Posts: 4
Rept. Given: 0
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 14
Thanks Rcvd at 10 Times in 2 Posts
ENCLU Reputation: 0
Hello! Have you tried de4dot? If so, what results did you get from there?
Reply With Quote
  #3  
Old 09-07-2025, 11:19
Nooboy Nooboy is offline
Friend
 
Join Date: Aug 2025
Posts: 6
Rept. Given: 0
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 4
Thanks Rcvd at 1 Time in 1 Post
Nooboy Reputation: 0
1.dump
2.fix dump
3.ConfuserEx-Unpacker-v2.0 &Constants Decrypter
4.de4dot


ConfuserEx-Unpacker-v2.0 prompts an error
[$] Loading Module...
[$] Loading References...
[$] Detected: Confuser.Core 1.6.0+447341964f
[$] Anti Tamper Detected
[$] Anti Tamper Removed Successfully
[$] Cleaned Control Flow on 272 Methods
[$] Fixed proxy calls: 6749
[$] Removed proxy methods: 944
[$] Cleaned Control Flow on 2 Methods
[$] Cleaned Control Flow on 2 Methods
[$] Patched 5 Anti Invokes
[$] Cleaned Control Flow on 2 Methods
Error:
Could not load file or assembly 'DEMO123456, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null'. This assembly was compiled for a different processor.
at System.Reflection.RuntimeAssembly.nLoadImage(Byte[] rawAssembly, Byte[] rawSymbolStore, Evidence evidence, StackCrawlMark& stackMark, Boolean fIntrospection, Boolean fSkipIntegrityCheck, SecurityContextSource securityContextSource)
at System.Reflection.Assembly.Load(Byte[] rawAssembly)
at Unpacker.Core.Deobfuscators.Resource.ResourceDeobfuscator.Deobfuscate(UnpackerContext context) in D:\Documents\Visual Studio 2017\Projects\GitHub\ConfuserEx-Unpacker\Unpacker.Core\Deobfuscators\Resource\ResourceDeobfuscator.cs:line 40
at Unpacker.Core.UnpackerEngine.Run(UnpackerParameters parameters) in D:\Documents\Visual Studio 2017\Projects\GitHub\ConfuserEx-Unpacker\Unpacker.Core\UnpackerEngine.cs:line 38
Error:
Object reference not set to an instance of an object.
at Unpacker.Core.Utils.FindInstructionsNumber(MethodDef method, OpCode opCode, Object operand) in D:\Documents\Visual Studio 2017\Projects\GitHub\ConfuserEx-Unpacker\Unpacker.Core\Helpers\Utils.cs:line 33
at Unpacker.Core.Deobfuscators.AntiDebugDeobfuscator.Deobfuscate(UnpackerContext context) in D:\Documents\Visual Studio 2017\Projects\GitHub\ConfuserEx-Unpacker\Unpacker.Core\Deobfuscators\AntiDebugDeobfuscator.cs:line 18
at Unpacker.Core.UnpackerEngine.Run(UnpackerParameters parameters) in D:\Documents\Visual Studio 2017\Projects\GitHub\ConfuserEx-Unpacker\Unpacker.Core\UnpackerEngine.cs:line 38
[$] Removed 1 Attributes
[$] Cleaning unused methods...
[$] Writing Module...
[$] Saving Module...
Reply With Quote
The Following User Says Thank You to Nooboy For This Useful Post:
niculaita (09-12-2025)
  #4  
Old 11-02-2025, 23:12
CodeCracker CodeCracker is offline
VIP
 
Join Date: Jun 2011
Posts: 905
Rept. Given: 68
Rept. Rcvd 661 Times in 278 Posts
Thanks Given: 64
Thanks Rcvd at 3,820 Times in 717 Posts
CodeCracker Reputation: 500-699 CodeCracker Reputation: 500-699 CodeCracker Reputation: 500-699 CodeCracker Reputation: 500-699 CodeCracker Reputation: 500-699 CodeCracker Reputation: 500-699
Quote:
Could not load file or assembly 'DEMO123456, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null'. This assembly was compiled for a different processor.
This is a 32 bits/64 bits mismatch... Can you share the target?
Reply With Quote
Reply

Tags
confuser.core 1.6.0


Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



All times are GMT +8. The time now is 01:50.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )