Reverse Engineering RET Homepage RET Members Reverse Engineering Projects Reverse Engineering Papers Reversing Challenges Reverser Tools RET Re-Search Engine Reverse Engineering Forum Reverse Engineering Links

Go Back   Reverse Engineering Team Board > Reverse Engineering Board > .NET Reverse Engineering
FAQ Members List Calendar Search Today's Posts Mark Forums Read

Reply
 
Thread Tools Display Modes
  #1  
Old 09-12-2008, 10:54 AM
LibX LibX is offline
Administrator
 
Join Date: Feb 2007
Location: The Netherlands
Posts: 118
Default DotFuckScator v1.0

DotFuckScator is a reversing engineering tool used to remove string encryption
from dotfuscator protected files

If the original file was strong name signed DotFuckScator will create a new keypair
and re-sign the file with this pair, be carefull since file depending on this file will
need to be edited manualy to support the new strong name signature.
You can use RE-Sign for this and the editor of your choice

Also if you like the file re-signed with a specific key place your key in the same
folder as the file you are about to process and rename it to DotFuckScator.snk
now DotFuckScator will use this key for the re-sign process.



Check the reteam.org tool page for the download link
Reply With Quote
  #2  
Old 09-13-2008, 05:19 AM
UFO-Pu55y UFO-Pu55y is offline
Senior Member
 
Join Date: Jan 2007
Posts: 87
Default

lool ! nice work again.
I especially like the name of this tool
and I'm sure 'they' will love it aswell
Reply With Quote
  #3  
Old 09-19-2008, 02:28 PM
high6 high6 is offline
Member
 
Join Date: Sep 2008
Posts: 14
Default

LibX can you update this to work with the latest dotfuscator? Or do you know how the newest encryption work?

Because with my own tool and this I get a ton of half decrypted strings.

I have the encrypted string.

\uf285\uf087\ufe89\ud98b\ufd8d\uf58f\ue091

which decodes to

txtuser

but my tool and yours decodes it as

txt癳ser

I think it has something to do with the flag at the end of the user string. Because if you change the flag from 1 to 0 it causes the program to decrypt to that too.
Reply With Quote
  #4  
Old 09-22-2008, 09:25 AM
LibX LibX is offline
Administrator
 
Join Date: Feb 2007
Location: The Netherlands
Posts: 118
Default

Quote:
Originally Posted by high6 View Post
I think it has something to do with the flag at the end of the user string. Because if you change the flag from 1 to 0 it causes the program to decrypt to that too.
I see the problem but iam not sure what ur trying to tell me in the last part, could u explain this please?
Reply With Quote
  #5  
Old 09-22-2008, 11:12 AM
LibX LibX is offline
Administrator
 
Join Date: Feb 2007
Location: The Netherlands
Posts: 118
Default

Ok check lastest release of DotFuckScator its fixed
Thx for the bugreport

Regards
LibX // RETeam
Reply With Quote
  #6  
Old 09-23-2008, 05:07 PM
high6 high6 is offline
Member
 
Join Date: Sep 2008
Posts: 14
Default

Quote:
Originally Posted by LibX View Post
Ok check lastest release of DotFuckScator its fixed
Thx for the bugreport

Regards
LibX // RETeam
How did you fix it? I am curious to how you did, I can't figure it out.

Edit:

Hmm it gives me a

"Object reference not set to an instance of an object"

when I tried it.

Last edited by high6 : 09-23-2008 at 05:10 PM.
Reply With Quote
Reply


Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Forum Jump





Powered by vBulletin® Version 3.6.4
Copyright ©2000 - 2023, Jelsoft Enterprises Ltd.