Reverse engineering analysis

[bigbily09]

kapag ba ung .exe is encrypted using like confuser pwede ba ito idecrypt to see strings?

and if possible is there a way to see what encryption software is used?

example 123.exe language c++ encryptor used confuser

 

[itsmaxxcz]

kung .net app tapos confuser/confuserex gamit, possible makita or ma-recover yung ibang strings gamit deobfuscator or .net tools, pero hindi lagi clean result. minsan obfuscated lang siya, minsan encrypted strings talaga tapos runtime lang dine-decrypt, kaya need mo muna malaman kung anong klaseng protection ginamit. pero kung c++ yung 123.exe, usually hindi confuser yan kasi pang .net mostly ang confuser/confuserex. sa c++ mas common yung packer/protector like upx, themida, vmprotect, enigma, asprotect, or custom packer. pwede mong i-check gamit tools like detect it easy or peid style tools para may idea kung anong compiler/packer/protector ang ginamit, pero hindi rin 100 percent accurate lalo na pag custom or modified yung protector.

 

[bigbily09]

kung .net app tapos confuser/confuserex gamit, possible makita or ma-recover yung ibang strings gamit deobfuscator or .net tools, pero hindi lagi clean result. minsan obfuscated lang siya, minsan encrypted strings talaga tapos runtime lang dine-decrypt, kaya need mo muna malaman kung anong klaseng protection ginamit. pero kung c++ yung 123.exe, usually hindi confuser yan kasi pang .net mostly ang confuser/confuserex. sa c++ mas common yung packer/protector like upx, themida, vmprotect, enigma, asprotect, or custom packer. pwede mong i-check gamit tools like detect it easy or peid style tools para may idea kung anong compiler/packer/protector ang ginamit, pero hindi rin 100 percent accurate lalo na pag custom or modified yung protector.

yes i tried using detect it easy. showing vmprotect. i try using VMPStatic pero di sya na dedecode there string encrypted pden