Tools:
cff_patched by kao
MegaDumper (ex DotnetDumper) http://forum.tuts4yo...umper-10/page-3
ConfuserMethodsDecryptor http://forum.tuts4yo...thodsdecryptor/
ModuleToAssembly http://forum.tuts4yo...etoassembly-10/

Universal Fixer http://forum.tuts4yo...niversal-fixer/
and Hacked Reflector

Step1: Dumping the .NET module called "___.netmodule"
Start MegaDumper (ex DotnetDumper)
Select the option Main->Dumping Options->Don't restore file name
since we want only addresses this time!
Go on Main->Process Manager and select Confuser_UnpackMe.exe
Click on Start!
Now we watch for a memcpy with the source MZ (since it is an exe);
First Source: 01D905F0  MZ?
Go on the process Confuser_UnpackMe.exe; right click and choose Net Dump
after that we choose  "Go to Location" and we go under the Dump directory
Open the file rawdump_01D905F0.dll under CFF Explorer
and look under Module table - we should find "___.netmodule"
Nop is not this one.
We again click Continue for several time since no new Source with MZ finded
MegaDumper stops for several times with no apparent reason (don't know why!)
just click Continue

The last MZ before the application start is the right one:
memcpy reached:
Value of EBP:0012EA9C
Old ESP: 0012ED00
Return Address: 79493D82
Source: 01C25248  MZ?
len: (hex) 00038200
Destination: 02C20000

Go on the process Confuser_UnpackMe.exe; right click and choose Net Dump
Load rawdump_01C25248.dll under CFF Explorer
and yes this has two modules - first one called "___.netmodule"
so this is the right file.
We rename this file to "___.netmodule"
and we place it under same directory with Confuser_UnpackMe.exe

Step2: Restoring MSIL of "___.netmodule" with ConfuserMethodsDecryptor
This is Framework 4.0 so we must have Confuser_Methods_Decryptor.exe.config
under ConfuserMethodsDecryptor.exe directory.
Simple select Confuser_UnpackMe.exe and "___.netmodule"
and click on Decrypt.

Step3: Convert "___.netmodule" to a module using Module ModuleToAssembly
Once again select Confuser_UnpackMe.exe and "____decryptedmethods.netmodule"
and click on Convert.

Step4: Let's see if it runs: no it doesn't: we open the file in CFF Explorer
and go at Nt Headers->File Headers; double click on Characteristics member
and unmark "File is a DLL".
We also go under Optional Header and we set Subsystem to 02 (Windows GUI).

Step5: Fix the file ____decryptedmethods_assembly.exe
with Universal Fixer so we could load it under Hacked Reflector.
We load the file under Reflector and we search for "GetHINSTANCE"
using CodeSearch plugin for Reflector.
We finded two methods the one we want is the smallest wich has 3 exception handlers.
real token: 060000AC

This is the anti-tamper method, also the method wich decrypt methods!
We go under CFF Explorer at index 172 (=AC in hex)
and at RVA of method which is in this case is 0000D4B8
and we change from 1B30 to 062A (a simply return).
And job doned: the program runs!