Skip to content

System.BadImageFormatException during tampering deobfuscation #12

@GrimSmiler

Description

@GrimSmiler

hey!

when trying to run this command:
.\NoFuserEx.exe "AE.Net.Mail.dll" --dont-constants --dont-cflow --dont-proxy-calls --dont-remove-junk-methods --dont-resources --dont-rename

I get the following error:

Unhandled Exception: System.BadImageFormatException: Invalid IMAGE_COR20_HEADER.cb value
   at dnlib.DotNet.MD.ImageCor20Header..ctor(IImageStream reader, Boolean verify) in D:\THESIS\98-Deobfuscation\NoFuserEx-master\NoFuserEx-master\dnlib\src\DotNet\MD\ImageCor20Header.cs:line 127
   at dnlib.DotNet.MD.MetaDataCreator.Create(IPEImage peImage, Boolean verify) in D:\THESIS\98-Deobfuscation\NoFuserEx-master\NoFuserEx-master\dnlib\src\DotNet\MD\MetaDataCreator.cs:line 176
   at dnlib.DotNet.MD.MetaDataCreator.Load(IPEImage peImage) in D:\THESIS\98-Deobfuscation\NoFuserEx-master\NoFuserEx-master\dnlib\src\DotNet\MD\MetaDataCreator.cs:line 105
   at dnlib.DotNet.MD.MetaDataCreator.Load(Byte[] data) in D:\THESIS\98-Deobfuscation\NoFuserEx-master\NoFuserEx-master\dnlib\src\DotNet\MD\MetaDataCreator.cs:line 49
   at dnlib.DotNet.ModuleDefMD.Load(Byte[] data, ModuleCreationOptions options) in D:\THESIS\98-Deobfuscation\NoFuserEx-master\NoFuserEx-master\dnlib\src\DotNet\ModuleDefMD.cs:line 188
   at NoFuserEx.Deobfuscator.Deobfuscators.AntiTamperDeobfuscator.Deobfuscate(AssemblyManager assemblyManager) in D:\THESIS\98-Deobfuscation\NoFuserEx-master\NoFuserEx-master\NoFuserEx\NoFuserEx\Deobfuscator\Deobfuscators\AntiTamperDeobfuscator.cs:line 47
   at NoFuserEx.Deobfuscator.DeobfuscatorManager.Start() in D:\THESIS\98-Deobfuscation\NoFuserEx-master\NoFuserEx-master\NoFuserEx\NoFuserEx\Deobfuscator\DeobfuscatorManager.cs:line 57
   at NoFuserEx.Program.Main(String[] args) in D:\THESIS\98-Deobfuscation\NoFuserEx-master\NoFuserEx-master\NoFuserEx\NoFuserEx\Program.cs:line 28

The obfuscations applied to the dll are the following:

  • constants
  • ref proxy
  • anti debug
  • anti dump
  • rename
  • ctrl flow
  • anti tamper

I attached the project file for the ConfuserEx, original and obfuscated dlls
bug.zip

What could be the cause of this and what can be done to fix this issue?

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions