Confuserex-unpacker-2 -

ConfuserEx-Unpacker-2 is an open-source tool designed to deobfuscate and unpack .NET applications protected by the ConfuserEx  protector. Developed by KoiHook, it is a successor to earlier unpackers and uses a custom .NET instruction emulator to more reliably handle the complex protection layers of ConfuserEx . Key Features

Basic syntax: confuserex-unpacker-2.exe malware.exe output_clean.exe confuserex-unpacker-2

1. Renaming (Cryptic Symbols): Renames methods, classes, and fields to unprintable or homoglyph characters (\u0001, \u0002). This breaks static analysis.
2. Control Flow Obfuscation: Converts simple if/else and for loops into spaghetti code using switch dispatchers and junk instructions.
3. Constant Encryption: Hides hardcoded strings (URLs, registry keys, mutex names) behind decryption stubs.
4. Anti-Tamper: Encrypts the method bodies and decrypts them at runtime using a key derived from the assembly hash. If you modify a single byte, the binary refuses to run.
5. Resource Encryption: Encrypts embedded resources, including additional payloads.

ConfuserEx-Unpacker-2/cawk-Emulator/.NET-Instruction- ... - GitHub ConfuserEx-Unpacker-2/cawk-Emulator/