GitHub - Zypherion-Technologies/UnConfuserEx: A ConfuserEx2 deobfuscator with support for anti tamper, compressor, constants, control flow, and resource recovery.
Source Reddit BlueTeam
Discussion
UnConfuserEx is an open-source tool designed to deobfuscate .NET assemblies protected by ConfuserEx2, a popular obfuscation framework. It supports removal of multiple protection techniques such as anti-tamper, compressors, constants obfuscation, control flow obfuscation, and resource encryption. The tool improves upon previous versions by handling newer ConfuserEx2 variants and edge cases encountered in real-world protected assemblies. It is intended for authorized use in malware analysis, reverse engineering, and software recovery. No direct vulnerability or exploit is described in the provided information.
r/blueteamsec (opens in a new tab)u/AhmedMinegames0 points0 comments
UnConfuserEx is a fork of the original UnConfuserEx made by MadMin3r that improves support for newer ConfuserEx2 samples and a bunch of the protections that come with them. The original project already laid the groundwork for ConfuserEx2 deobfuscation, and this fork builds on that with better handling for the stuff that tends to show up in real-world protected assemblies.
It can deobfuscate things like anti-debug, anti-dump, anti-tamper (including normal, dynamic, and JIT-style variants), compressor stubs, constants, control flow, reference proxies, renamed symbols, resources, and some static cleanup using emulation as well. It also handles a few of the annoying edge cases like arithmetic constant expressions, switch/trampoline control flow, and embedded managed payloads.
It is not a magic bullet, but it is a pretty solid upgrade over older public deobfuscators for samples that use those common ConfuserEx protection shapes.