DeSmart - Deobfuscator

[rongchaua]

Hi all,
I have just finished an obfuscator for {SmartAssembly}. I need some tests for it. You can download it here. Please login to view content.

http://rongchaua.net/tools-mainmenu-...-smartassembly

I have tested it with crackme of LibX. It can restore all of source code in readable form.
http://rongchaua.net/Web/Tmp/TestRun_patch.zip

If you have a file obfuscated with {SA} and no time to test, then upload it somewhere and give me link. I need more files to test this tool.

@Kurapica and UFO: It will be great if you can send me a file packed with the newest version of {SA}. I can not bring {SA} run on my machine. .

Regards.
rongchaua.

[Kurapica]

This is cool shit !!

I always wanted to code this shit but I'm too lazy as you know !!

Anyway this is something I coded and used SA 3.0 to protect.

http://www.filesend.net/download.php...8b9d3ec644448e

Enjoy

[rongchaua]

@Kurapica:Thank for you file. I have tested your file with my tools. I think I should make some mirror improvements.
@all: I am waiting more files obfuscated with {SA}.

[Kurapica]

This is another target for you rongchaua !

It's a DLL file not exe

Enjoy...

[MOID]

Good:

• String decryption.
• Renaming. I like that it has button1_Click, is that automatic?

Bad:

• Control flow deobfuscation

Sometimes control flow deobfuscation doesn't work and leaves obfuscated code (for instance Namespace_02.Class_02.ctor), sometimes it leaves broken code! For example Namespace_02.Class_02.Method_02 in your version:

public static byte[] Method_02()
{
    // This item is obfuscated and can not be translated.
    byte[] destinationArray = new byte[Field_08.Length];
    Array.Copy(Field_08, destinationArray, Field_08.Length);
    int num = 0;
    if (num >= destinationArray.Length)
    {
        return destinationArray;
    }
}

Good version:

public static byte[] Method_2()
{
    byte[] destinationArray = new byte[Field_8.Length];
    Array.Copy(Field_8, destinationArray, Field_8.Length);
    for (int i = 0; i < destinationArray.Length; i++)
    {
        destinationArray[i] = (byte) (destinationArray[i] ^ 0x40);
    }
    return destinationArray;
}

Here's my deobfuscated version of LibX's crackme, with my control flow deobfuscator and Kurapica's renamer:
http://rapidshare.com/files/110427787/my_TestRun.exe

[rongchaua]

I have updated some mirror improvement. It still can not make all functions into readable form but it now actual status. I did my best. .
Regards.

[rongchaua]

Version 1.0.0.4 is out. See link above.
Restore up to 99% source code to readable form.
Support {SA} version 1,2,3.

[Kurapica]

Thanks for the update.

Why should I register to download !! It's annoying ???!!

would be nice if you post here or on FileSend.net

[rongchaua]

Hi Kurapica,
I don't want that too. Please read this post to understand why I must activate Login section.

http://rongchaua.net/blog/Reverse_En...CA_Yes_it_does

Regards.

[rongchaua]

Version 1.0.0.5 is out.
- Add Update Function.
- Use same GUI as the other.
- Fix mirror bugs.