ScyllaHide v2020-12-15 releases

 ScyllaHide, gelişmiş bir açık kaynaklı x64 / x86 kullanıcı modu Anti-Debug kitaplığıdır. Hata ayıklamayı gizlemek için kullanıcı modundaki çeşitli işlevleri kancalar. Bu aracın kullanıcı modunda (halka3) kalması amaçlanmıştır.

ScyllaHide, eklentilerle çeşitli hata ayıklayıcıları destekler:

• x64dbg  http://x64dbg.com  veya  https://github.com/x64dbg/x64dbg

PE x64 hata ayıklama, x64dbg ve IDA eklentileriyle tamamen desteklenir.

Özellikleri:

• Anti-Anti-Debug
  • Process Environment Block (PEB)
  • NtSetInformationThread
  • NtSetInformationProcess
  • NtQuerySystemInformation
  • NtQueryInformationProcess
  • NtQueryObject
  • NtYieldExecution
  • NtCreateThreadEx
  • OutputDebugStringA (deprecated since v1.3)
  • BlockInput
  • NtUserFindWindowEx
  • NtUserBuildHwndList
  • NtUserQueryWindow
  • NtSetDebugFilterState
  • NtClose
  • Remove Debug Privileges
  • Hardware Breakpoint Protection (DRx)
  • Timing
  • Raise Exception
• Special
  • DLL Injection
  • Prevent Thread Creation
  • RunPE Unpacker
  • Improved Attach Dialog
• OllyDbg v1 Specific
  • Remove entry point breakpoint
  • Fix Olly Bugs
  • x64 single-step fix
  • Skip Entrypoint outside code
  • Ignore bad PE image
  • Skip compressed code warning
  • Skip ”load dll” warning
  • Break on TLS
  • Advanced CTRL+G
  • Change window caption
  • Special Keyboard Shortcuts
  • Custom Toolbar
  • Exception Problem
• OllyDbg v2 Specific
  • Change window caption
• IDA Specific
  • Server Option
• x64dbg Specific
• TitanEngine Specific

Deobfuscator

 

     NotPrab/.NET-Deobfuscator 

.NET Deobfuscator

Lists of .NET Deobfuscator / Unpacker (Open Source)

General Lists

• Agile

  • AgileStringDecryptor - A dynamic agile string decryptor that relies on invoke.
  • Agile.NET-Deobfuscator - Deobfuscates Agile.NET controlflow, strings, and proxy delegates. Please let me know for new updates or any other problems. Throughout the full source on every line it contains comments so you can easily understand the process behind it. Enjoy!
  • AgileDotNet-StringDeobfuscator - Quickly decrypts strings from Agile.NET (aka AgileDotNet, CliSecure) packed assemblies. Supports multiple modules.

• ArchangelCloak

  • ArchangeIUncloaker - Public ArchangelCloak Deobfuscator

• Atomic

  • Atomic-Deobfuscator - A deobfuscator for Atomic obfuscator

• AutoIt

  • DeobHellper - Yeat Another AutoIt Deobfuscator

• Autori Obfuscator

  • NeonFuscatorDeobfuscator - .NET Deobfuscator for Autori Obfuscator (NeonFuscator)

• Babel

  • BabelDeobfuscator - BabelDeobfuscator is an open-source deobfuscator for BabelObfuscator
  • DeBabelVM - DeBabelVM is a restorer for the Babel Obfuscator - This will restore 'msil encrypt' methods for Babel
  • Babel-Deobfuscator - Babel-Deobfuscator is an open-source deobfuscator for Babel Obfuscator.

• BoxedAppPacker

  • BoxedAppUnpacked - Tool to unpack .net assemblies packed by BoxedAppPacker

• BytePress

  • BytePressDecompressor - Unpacks files compressed by BytePress(https://github.com/roachadam/bytepress)

• Beebyte

  • beeless - BeeByte Deobfuscator. Used it to deobfuscate an Unity3D Game. Alternatively, de4dot works aswell.

• Confuser 1.9

  • ConfuserDeobfuscator - Deobfuscator for Confuser 1.9.0.0 release
  • DeConfuser - This is a deobfuscator for protected confuser assemblies
  • Confuser-Methods-Decryptor - Confuser-Methods-Decryptor

• ConfuserEx

  • NoFuserEx - Free deobfuscator for ConfuserEx.
  • Netguard-Unpacker-Public - Public NetGuard Deobfuscator
  • ClarifierEx - Deobfuscator for ConfuserEx
  • Rzy-Protector-V2-Unpacker - An unpacker (deobfuscator) for the protector (obfuscator) Rzy Protector V2.
  • ConfuserEx-Dynamic-Unpacker - A dynamic confuserex unpacker that relies on invoke for most things
  • ConfuserEx-Unpacker-Mod-By-Bed - Edited copy of cawks confuserex unpacker, support more than your averageprogram
  • ConfuserEx-Unpacker-2 - An Updated ConfuserEx Unpacker Based On Emulation to be more reliable
  • Krawk-Unpacker - Krawk Unpacker
  • EasyPredicateKiller - Replacing and Calling ConfuserEx x86 Predicates
  • ConfuserExSwitchKiller - ConfuserExSwitchKiller
  • ConfuserEx-Anti-Debug-Remover - ConfuserEx-Anti-Debug-Remover
  • ConfuserEx-Static-String-Decryptor - A static String Decryptor Based Off Instruction Emulator
  • ConfuserEx-Static-String-Decryptor - it will decrypt strings statically from a non modded confuserex with or without cflow doesnt really matter
  • ConfuserEx-Resources-Decryptor - This tool can decrypt encrypted resources from ConfuserEx and replace them
  • ConfuserExResourceReplace - ConfuserExResourceReplace
  • ConfuserExTools - ConfuserEx unpacking tools basic support for ConfuserEx (AntiTamper, ReferenceProxy, Constants)
  • Unscrambler - Universal unpacker and fixer for a number of modded ConfuserEx protections

• Crypto Obfuscator

  • Crypto-Deobfuscator - A Deobfuscator for Crypto Obfuscator

• De4dot

  • de4dot - .NET deobfuscator and unpacker.
  • de4dot-cex - de4dot deobfuscator with full support for vanilla ConfuserEx

• DotnetPatcher

  • DNPDeobfuscator - Open-source deobfuscator for dotnetpatcher (https://bitbucket.org/3dotdev/dotnet-patcher/src/)
  • Deobf-DotNetPathcer - an basic deobfuscator for last version (at the moment) dotnetpatcher (v4.5.9.0) https://bitbucket.org/3DotDev/dotnet-patcher

• DotNetCompressor

  • DotNetCompressorDecompressor - Decompresses files compressed with https://github.com/TotalTechGeek/DotNetCompressor

• DotRefiner

  • DotRefiner-Deobfuscator - Static DotRefiner Deobfuscator

• DotWall

  • DotWall-Deobfuscator - Deobfuscator for DotWall
  • Dotwall-deobfuscator - A very simple deobfuscator for DotWall Obfuscator

• Dumper

  • ExtremeDumper - .NET Assembly Dumper
  • Nemesis - A customizable process dumper.
  • MegaDumper - Dump native and .NET assemblies
  • KsDumper - Dumping processes using the power of kernel space !

• Eazfuscator

  • EazFixer - A deobfuscation tool for Eazfuscator.
  • eazdevirt -Devirtualizer for Eazfuscator.NET

• Fixer / Replacer / Simplifier / Remover

  • AssemblyRebuilderOld - [Obsolete] Fixup .Net Assembly dumped, if it can't work.
  • AssemblyFixer - Fix assembly pe header and metadata errors
  • RzyFixer - A .NET Unpacker tool, with many features. Using dnlib assembly & cui for the design.
  • CalliFixer - Here is a little program that remove calli protection from files, easy to use & easy to understand. Using the dnlib assembly.
  • Base64Encoding-Fixer - Little tool that i made cuse i'm bored rn, fix the string encryption protection (the one which encrypt strings to base64 made by forgothisname). Using dnlib assembly.
  • DoubleParseFixer - Little program that i made to fix Double Parse obfuscation. Using dnlib assembly.
  • SizeOf-Fixer -Fix the sizeof of assembly
  • SuperCalculator - Helpful tool which handle most operations used in obfuscation
  • Mathematical-Operation-Simplifier -Mathematical Operation Simplifier for .NET Applications
  • SizeOf-Replacer - SizeOf Replacer for .NET Applications
  • Junk-Remover - .NET attributes cleaner/Junk remover (nops).
  • PointMutationRemover - Does exactly what the title says, removes Point Mutations. Only supported with 2D points at the moment.
  • Universal-Math-Fixer - This calculator load all methods from mscorlib.dll and checks equivalence with the method from the instruction
  • SimpleMathCleaner - Simple Math Cleaner with invoke method for generic use
  • AntiDecompiler-Cleaner - An exception occurred when decompiling this method
  • AntiInvokeDetection - most string deobfuscators use Invoke to pick up the strings, however some obfuscators are using "GetCallingAssembly" to check if the method is being executed by another assembly
  • Excess-Nop-Remover - Remove excess nop opcodes
  • Universal-Proxy-Remover - A simple and universal .NET proxy remover
  • ProxyCall-Remover - Deobfuscator for remove proxy calls methods

• ILProtector

  • ILProtectorUnpacker - ILProtector Unpacker Script
  • ILUnpacker - A simple unpacker for ILProtector. Supported versions <= 2.0.21.4.
  • ILUnpacker - Different approach on unpacking ILProtector (Latest)

• KoiVM

  • OldRod - An automated KoiVM devirtualisation utility
  • Rhydon - Rhydon

• MemeVM

  • MemeDevirtualizer - Devirtualizer for MemeVM (MindSystem)
  • MemeVM-Devirt - A devirtualizer for MemeVM (CursedSheep)
  • MemeVMDevirt - devirtualizer for memevm (MageLand29)

• NashaVM

  • Deoxys - Deoxys is a Devirtualization utility for NashaVM, a Virtual Machine which runtime was made in C++/CLI
  • TheBear - .NET Devirtualizer for NashaVM that Gabtiex made for nothing.

• Noisette Obfuscator

  • Noisette-Deobfuscator - A Deobfuscator for Noisette Obfuscator

• NETReactor

  • Krypton - .Net Reactor Devirtualizer
  • .NET-Reactor-String-Decryptor - .NET-Reactor-String-Decryptor
  • .NetReactorCfCleaner - A control flow cleaner for .net reactor 6x
  • .NETReactor_6.3.0.0_Only_Strings - Example deobfuscate .NET Reactor 6.3.0.0 strings(ONLY STRINGS)

• Obfuscar

  • DeObfuscar - An open source deobfuscator for 'Obfuscar'
  • DeObfuscar-Static - Static Obfuscar Deobfuscator

• OrangeHeap

  • OrangeHeap-Deobfuscator - Deobfuscates an Assembly protected with Orangeheap

• Patcher

  • .NET-Virtualized-App-Patcher - This is a universal Patcher that I coded for Virtualized Applications. Protected by KoiVM/EazVM/AgileVM. The project idea wasn't mine at all it was by xsilent and Tobito and they released a txt that contains the tracer, uh I asked time for some infos and ended up coding my version.
  • JIT-Freezer - This program is used to suspend applications with a native layer in order to dump them (Only .NET)
  • Venturi77CallHijacker - KoiVM,EazVM,AgileVM Patcher.
  • Harmony - A library for patching, replacing and decorating .NET and Mono methods during runtime
  • JitUnpacker-Framework - A jit hook and unpacker framework
  • dnpatch - dnpatch is the ultimate library for all your .NET patching needs. It offers automated assembly patching, signature scanning and last but but not least bypassing of obfuscators by its ability to find methods in renamed/obfuscated types. Since the stars on GitHub exploded in a few days, dnpatch has been extended by a couple of projects. The most important one is dnpatch.deobfuscation which integrates de4dot directly into dnpatch. Also there is dnpatch.script, which gives you the ability to write patchers with pure JSON! The library itself uses dnlib (see next part).
  • EazRemoveTrial - After protected with Eazfuscator trial version then drag your protected file into EazRemoveTrial.exe, So you can use it forever not for 7 days, Working with lastest version

• Renamer

  • simple-deobfuscator - simple-deobfuscator
  • BB-Deob - BeeByte Deobfuscator simply renames all the classes/fields/methods/params to readable strings that can be understood. AS I know BB Obfuscator only renames classes and etc, so it should be fully reversable at that point.

• Panda

  • Panda-Deobfuscator - Panda Deobfuscator

• Phoenix Obfuscator

  • PhoenixDeobfuscator - PhoenixDeobfuscator is an open-source deobfuscator for PhoenixObfuscator
  • Phoenix-Protector-Strings-Decryptor - A strings decryptor for Phoenix Protector (Illuzion9999)
  • Phoenix-String-Decryptor - A simple tool which decrypts strings protected with Phoenix Protector (Jomtek)

• Protect.NET

  • ProtectNotNet - Decrypts Protect.NET encrypted strings

• String Decryptor

  • StackYenoDeobfuscator - String decryptor relying on the stack. Made for teach
  • StringDecryptorBase - Complete basic string decryptor to help new reversers. The code is commented
  • Deobfuscation-Tutorials - String Deobfuscation Tutorials by TheProxy
  • DynamicStringDecrypter - Decrypts strings dynamically, using https://github.com/Washi1337/AsmResolver
  • OutStringDecrypter - OutStringDecrypter

• Skater.Net Obfuscator

  • Skater.NetDeobfuscator - Deobfuscator for RustemSoft Skater.Net Obfuscator

• SpecterObfuscator

  • SpecterObfuscator-Deobfuscator - a deobfuscator for https://github.com/NepErwin/SpecterObfuscator

• VMP.NET

  • VMP.NET-Kill - This program allows you to bypass CRC checking, anti-debugging and anti-VM. Doesn't work when the app is packaged.

• Themida .NET

  • Themida-Unpacker-for-.NET - Themida Unpacker for .NET

• Yano

  • YanoDeobfuscator - YanoDeobfuscator is an open-source deobfuscator for YanoObfuscator

Contributing

Pull requests are welcome. For major changes, please open an issue first to discuss what you would like to change

Olly Notlar

Olly hata mesajı başındaki 55 push başlıyoruz

f7 call ile içine gireriz

Ollydbg script dump eder bizde ana programı Import REC ile yeni bulunan 

OEP ile IAT AutoSerach----- Get Import  -----  FixDump edilir ve dump edilmiş exenin üzerine kayıt edilir

Program debug edilir hata mesajına kadar gelinir ve hata mesajında debugger pause edilir. Hata mesajı stringlerde aratılır

Sonra çift tık F8 yani tek tek trace edilir F7 Call ların içine girilir ve F8 ile devam edilir

Çoklu lisans seçeneklerinde lisans stirnglerinden yukarı doğru kodları tradığımızda JE ve JMP komutlarını NOP layarak burayı aşabiliriz

Dump edilen progeam çalışmaz ise aynı dump eden programın Rebuild özelliği kullanılır

Karşılaştırma yapılan varsayılan CALL presödörünü içine girip 55 ile başlayan kodları aşağıdaki kodlar ile değiştiriyoruz

XOR EAX, EAX

MOV AL, 1

RET

Sonra 

Copy to executable --- All Modicifiations---- copy all-----save file

MOVSX EAX, BYTE PTR DS:[EDI+3]  =   İsmin 4 karakterini alıyor

MOVSX EDX, BYTE PTR DS:[EDI+1]  =   İsmin 2 karakterini alıyor

ADD EAX, EDX                                           İKİSİNİ TOPLUYOR 

MOVSX EDX, BYTE PTR DS:[EDI]            İSMİN İLK KARAKTERİ ALINIYOR

ADD EAX, EDX                                             ONUDA TOPLANIYOR

SHL EDX, 5                   SOLA YER DEĞİŞTİR EDX DEĞER YER DEĞİŞTİRİYOR

ADD EDX, AEAX           EDX İLE EDX TOPLA

SHL EDX, 2         YİNE EDX TEKİ DEĞER YER DEĞİŞTİRDİ SOLA DOĞRU

CMP EDX, ECX  ECX İLR EDX KARŞILAŞTIR

JNZ  JE KARŞIĞI

JNZ  JMP KARŞIĞI

ConfuserEX Mod (Bed's Protector)