0

everyone. I am reversing one .net compiled file, but faced troble. I have detected it's obfuscated property with Exeinfo PE, RDG Packer Detector, Detect It Easy.

ExeinfoPE says it "Microsoft Visual C# / Basic.NET [ Obfus/Crypted ] - EP Token : 00000000" enter image description here

Detect It Easy shows me "library-.NET(v4.0.30319)[-], linker-Microsoft Linker(11.0)[DLL32,console]" enter image description here

RDG Packer Detector notified it "C#Visual Basic .NET Nothing, External Scan(Using DLL) -NoobyProtect SE v1.0.9.8" enter image description here

I have used several .net disassemblers dotPeek, .net Reflector, ILSpy. Their created codes include bugs with parts like as function name, string variable name, etc. For example Three disassembled error containing results of equal part are below.

dotPeek

  string str1 = \u003CModule\u003E.\u200F‏‫‌‎‪‌‭‬‪​​‏‫‏‮‭‫‌‬‪‮‭​‫​‌‍‮‫‮<string>(159408780U);
  StringBuilder stringBuilder = Information.\u200C‭‭‪‍‌‭‏‎‭‎‭‮‏‭‮‎‎‍‭‬‪‪();

.net Reflector

  string str = smethod_2<string>(0x980628c);
  StringBuilder builder = smethod_0();

ILSpy

        string text = <Module>.‏‏‫‌‎‪‌‭‬‪​​‏‫‏‮‭‫‌‬‪‮‭​‫​‌‍‮‫‮<string>(159408780u);
        StringBuilder stringBuilder = Information.‌‭‭‪‍‌‭‏‎‭‎‭‮‏‭‮‎‎‍‭‬‪‪‮();

What is the correct obfuscator of my .net binary file??? If you have experiences with it, then please help me. thanks

miken32
  • 42,008
  • 16
  • 111
  • 154

1 Answers1

0

De4Dot is my go to when trying to reverse engineer obfuscated .NET files. Never heard of "NoobyProtect", but you can give it a try anyways. Might be a fork of one of the supported obfuscators.

Brett Allen
  • 5,297
  • 5
  • 32
  • 62