Skip to content
This repository has been archived by the owner on Dec 8, 2022. It is now read-only.

Exception while decompiling an exe #14

Open
theerfan opened this issue Mar 9, 2020 · 2 comments
Open

Exception while decompiling an exe #14

theerfan opened this issue Mar 9, 2020 · 2 comments
Labels
bug Something isn't working

Comments

@theerfan
Copy link

theerfan commented Mar 9, 2020

When I run:

de4dot-x64 Program.exe

I get:

Array dimensions exceeded supported range.
Array dimensions exceeded supported range.
Detected ConfuserEx v0.6.0 (G:\Blah\de4dot-cex\Debug\Program.exe)
Cleaning G:\Blah\de4dot-cex\Debug\Program.exe

Unhandled Exception: System.ApplicationException: Invalid new target, it's null
at de4dot.blocks.Block.ReplaceLastInstrsWithBranch(Int32 numInstrs, Block target) in G:\Blah\de4dot-cex\de4dot.blocks\Block.cs:line 139
at de4dot.blocks.Block.ReplaceBccWithBranch(Boolean isTaken) in G:\Blah\de4dot-cex\de4dot.blocks\Block.cs:line 154
at de4dot.blocks.cflow.BlockCflowDeobfuscator.de4dot.blocks.cflow.IBranchHandler.HandleNormal(Int32 stackArgs, Boolean isTaken) in G:\Blah\de4dot-cex\de4dot.blocks\cflow\BlockCflowDeobfuscator.cs:line 66
at de4dot.blocks.cflow.BranchEmulator.EmulateBranch(Int32 stackArgs, Boolean isTaken) in G:\Blah\de4dot-cex\de4dot.blocks\cflow\BranchEmulator.cs:line 82
at de4dot.blocks.cflow.BranchEmulator.EmulateBranch(Int32 stackArgs, Bool3 cond) in G:\Blah\de4dot-cex\de4dot.blocks\cflow\BranchEmulator.cs:line 78
at de4dot.blocks.cflow.BranchEmulator.Emulate_Brfalse() in G:\Blah\de4dot-cex\de4dot.blocks\cflow\BranchEmulator.cs:line 238
at de4dot.blocks.cflow.BranchEmulator.Emulate(Instruction instr) in G:\Blah\de4dot-cex\de4dot.blocks\cflow\BranchEmulator.cs:line 65
at de4dot.blocks.cflow.BlockCflowDeobfuscator.Deobfuscate(Block block) in G:\Blah\de4dot-cex\de4dot.blocks\cflow\BlockCflowDeobfuscator.cs:line 54
at de4dot.blocks.cflow.BlockDeobfuscator.Deobfuscate(List1 allBlocks) in G:\Blah\de4dot-cex\de4dot.blocks\cflow\BlockDeobfuscator.cs:line 40 at de4dot.blocks.cflow.BlocksCflowDeobfuscator.Deobfuscate(IEnumerable1 bds, List1 allBlocks) in G:\Blah\de4dot-cex\de4dot.blocks\cflow\BlocksCflowDeobfuscator.cs:line 106 at de4dot.blocks.cflow.BlocksCflowDeobfuscator.Deobfuscate() in G:\Blah\de4dot-cex\de4dot.blocks\cflow\BlocksCflowDeobfuscator.cs:line 90 at de4dot.code.ObfuscatedFile.Deobfuscate(MethodDef method, BlocksCflowDeobfuscator cflowDeobfuscator, MethodPrinter methodPrinter, Boolean isVerbose, Boolean isVV) in G:\Blah\de4dot-cex\de4dot.code\ObfuscatedFile.cs:line 640 at de4dot.code.ObfuscatedFile.DeobfuscateMethods() in G:\Blah\de4dot-cex\de4dot.code\ObfuscatedFile.cs:line 589 at de4dot.code.ObfuscatedFile.Deobfuscate() in G:\Blah\de4dot-cex\de4dot.code\ObfuscatedFile.cs:line 401 at de4dot.cui.FilesDeobfuscator.DeobfuscateAllFiles(IEnumerable1 allFiles) in G:\Blah\de4dot-cex\de4dot.cui\FilesDeobfuscator.cs:line 374
at de4dot.cui.FilesDeobfuscator.DeobfuscateAll() in G:\Blah\de4dot-cex\de4dot.cui\FilesDeobfuscator.cs:line 134
at de4dot.cui.FilesDeobfuscator.DoIt() in G:\Blah\de4dot-cex\de4dot.cui\FilesDeobfuscator.cs:line 91
at de4dot.cui.Program.Main(String[] args) in G:\Blah\de4dot-cex\de4dot.cui\Program.cs:line 118
at de4dot_x64.Program.Main(String[] args) in G:\Blah\de4dot-cex\de4dot-x64\Program.cs:line 23

I had previously checked the file with Detect It Easy to make sure it used ConfuserEx.
I tried running the code via an .exe that Visual Studio compiled from the source code and via the pre-built binaries, both returned the exact same results.

@ViRb3
Copy link
Owner

ViRb3 commented Mar 9, 2020

You would need to upload the binary that you are deobfuscating for anybody to be able to help. It might be a modified ConfuserEx version - Detect It Easy only reads the version metadata which can be faked or simply unchanged. Or it could be a bug in the deobfuscator. Unfortunately I don't have the time to check this right now, but hopefully soon™.

@ViRb3 ViRb3 added the bug Something isn't working label Mar 9, 2020
@theerfan
Copy link
Author

theerfan commented Mar 9, 2020

Ok, thanks. :))
Here's the file:
Program.zip

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

2 participants