Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

System.BadImageFormatException during tampering deobfuscation #12

Open
GrimSmiler opened this issue Dec 15, 2016 · 6 comments
Open

System.BadImageFormatException during tampering deobfuscation #12

GrimSmiler opened this issue Dec 15, 2016 · 6 comments

Comments

@GrimSmiler
Copy link

hey!

when trying to run this command:
.\NoFuserEx.exe "AE.Net.Mail.dll" --dont-constants --dont-cflow --dont-proxy-calls --dont-remove-junk-methods --dont-resources --dont-rename

I get the following error:

Unhandled Exception: System.BadImageFormatException: Invalid IMAGE_COR20_HEADER.cb value
   at dnlib.DotNet.MD.ImageCor20Header..ctor(IImageStream reader, Boolean verify) in D:\THESIS\98-Deobfuscation\NoFuserEx-master\NoFuserEx-master\dnlib\src\DotNet\MD\ImageCor20Header.cs:line 127
   at dnlib.DotNet.MD.MetaDataCreator.Create(IPEImage peImage, Boolean verify) in D:\THESIS\98-Deobfuscation\NoFuserEx-master\NoFuserEx-master\dnlib\src\DotNet\MD\MetaDataCreator.cs:line 176
   at dnlib.DotNet.MD.MetaDataCreator.Load(IPEImage peImage) in D:\THESIS\98-Deobfuscation\NoFuserEx-master\NoFuserEx-master\dnlib\src\DotNet\MD\MetaDataCreator.cs:line 105
   at dnlib.DotNet.MD.MetaDataCreator.Load(Byte[] data) in D:\THESIS\98-Deobfuscation\NoFuserEx-master\NoFuserEx-master\dnlib\src\DotNet\MD\MetaDataCreator.cs:line 49
   at dnlib.DotNet.ModuleDefMD.Load(Byte[] data, ModuleCreationOptions options) in D:\THESIS\98-Deobfuscation\NoFuserEx-master\NoFuserEx-master\dnlib\src\DotNet\ModuleDefMD.cs:line 188
   at NoFuserEx.Deobfuscator.Deobfuscators.AntiTamperDeobfuscator.Deobfuscate(AssemblyManager assemblyManager) in D:\THESIS\98-Deobfuscation\NoFuserEx-master\NoFuserEx-master\NoFuserEx\NoFuserEx\Deobfuscator\Deobfuscators\AntiTamperDeobfuscator.cs:line 47
   at NoFuserEx.Deobfuscator.DeobfuscatorManager.Start() in D:\THESIS\98-Deobfuscation\NoFuserEx-master\NoFuserEx-master\NoFuserEx\NoFuserEx\Deobfuscator\DeobfuscatorManager.cs:line 57
   at NoFuserEx.Program.Main(String[] args) in D:\THESIS\98-Deobfuscation\NoFuserEx-master\NoFuserEx-master\NoFuserEx\NoFuserEx\Program.cs:line 28

The obfuscations applied to the dll are the following:

  • constants
  • ref proxy
  • anti debug
  • anti dump
  • rename
  • ctrl flow
  • anti tamper

I attached the project file for the ConfuserEx, original and obfuscated dlls
bug.zip

What could be the cause of this and what can be done to fix this issue?

@undebel
Copy link
Owner

undebel commented Dec 15, 2016

It has anti dump and anti tamper, it is not supported.

@thquantv1
Copy link

any idea for that error? or any solution?

@thquantv1
Copy link

untitled

@GrimSmiler
Copy link
Author

GrimSmiler commented Oct 24, 2017 via email

@thquantv1
Copy link

any way to change title of Main Form
I need to change some label text
Try with Pe Explorer(only logo and description) and OllyDBG(can not open) but not

@yanghoxom
Copy link

i see in readme support Anti-tamper and Anti-dumper. but in this issues, you say no ?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

4 participants