DeSmart - Deobfuscator

[rongchaua]

Version 1.0.0.6 ist out
- Support SA 3.2
- I don't know if it work with version < 3.2. It is nice if someone can share me an assembly which be protected by SA 2.x
- I have tested with this file http://reteam.org/board/showthread.php?t=1386
- Some strings still encrypted after deobfuscating. I don't know why .
- Link to download tool: http://rongchaua.net/tools-mainmenu-...-smartassembly

[Kurapica]

Nice tool my friend...

[high6]

Originally Posted by rongchaua

- Some strings still encrypted after deobfuscating. I don't know why .

In case you missed it in the other thread.

Originally Posted by high6

Also would be cool if you made it options in desmart. So that you can choose the decrypt string and/or anti control flow and/or renaming.

Also something I added to my code.

Instruction GetNext(Instruction ins)
        {
            ins = ins.Next;
            while (ins != null && (ins.OpCode == OpCodes.Br || ins.OpCode == OpCodes.Br_S))
            {
                ins = ins.Operand as Instruction;
            }
            return ins;
        }

Because control flow obfuscation is applied after string encryption so sometimes you get.

ldc 435
br somewhere
call stringdecrypt

[rongchaua]

Hi high6,
thank for your help. But the problem don't lie at the flow control because I fixed the flow control before decrypting strings.
It lies at the decrypt function because this function does not work with some Id. It works with most of Ids, but not with all IDs.
I think the decrypt routine of SA has errors. However I am not sure. And I do not intend to check that. .
For example: You can try your old code with this assembly http://reteam.org/board/showthread.php?t=1386 . The Id 33e8 will not be accepted although it is used in this function

private static bool Method_02(bool flag1)
{
    DateTime time = DateTime.Parse("2009-02-22T00:00:00");
    if ((DateTime.Now <= time) && (DateTime.Now >= time.AddDays(-21.0)))
    {
        return true;
    }
    string name = Assembly.GetExecutingAssembly().GetName().Name;
    string message = string.Format(Class_04.Method_00(0x33e8), name, time.ToString("D"));
    if (flag1)
    {
        throw new Exception(message);
    }
    Class_02 mainForm = new Class_02(message, "{smartassembly} License Exception", "error");
    Method_00();
    Application.Run(mainForm);
    return false;
}

[high6]

Hm, my version decrypts all the strings fine, I checked for all references to the decrypt call and there arent any after running mine.

Also that string is

"\'{0}\' has been built with an evaluation version of {{smartassembly}}, which has expired on {1}.\n\nYou need to purchase a license of {{smartassembly}}."

I posted my code in the other thread. Do you think it has something to do with your deobfuscating method?

[jerry828]

thank rongchaua for this good tool

[rongchaua]

Version 1.0.0.7 ist out:
[1.0.0.7] : Bugfix in decrypting string. It works now better.

Regards.
rca.

[Kurapica]

Well done rongchaua !! yourr tools are excellent.

[sirp]

love em too always very usefull and time saving

[RFTO]

Am I the only one where this doesn't work?

Issues:
Breaks any .exe I use it on, "Error system.typeinitialization". ALL VERSIONS
Doesn't decrypt strings in a few versions
Freezes up sometimes towards the end (Seems to be fixed in 1.0.0.7 though)

It is still nice, but I thought I would bring the issues to your attention.

I don't have a specific application to give you, as these are problems that always occur.