Skip to main content

Tag: dnspy

KipodAfterFree2019 Package2

Package2 [re, 20p, 27 solves] TLDR; obfuscated .Net binary which was decrypting hardcoded, encrypted password with hardcoded key. I used avaliable deobfuscator, did some reversing, found encypted password and hardcoded key and wrote simple python script that decrypted it. To decompile this binary I used dnSpy. When I loaded it to the decompiler I saw that function and variables names are obfustaced and consists of unicode characters like \u200C\u200B\u202E\u206C\u202C\u202B\u202D.... After looking around for a bit I found interesting thing in binary metadata: