UnpackHub — .NET Reverse Engineering
1.34K subscribers
40 photos
5 links
Download Telegram
🔄 [EN] DNGuard Deobfuscator Updated — Now Supports v4.9.1!
🚀 Smarter, faster, and ready for the latest DNGuard protections!

We’ve just released a major update to our DNGuard deobfuscator — now fully compatible with DNGuard v4.9.1, including its advanced virtualization layers and latest obfuscation techniques.

🆕 What’s New:
- ✅ Full support for DNGuard 4.9.1
- ⚡️ Enhanced HVM2 unpacking — better handling of new virtualization patterns
- 🔎 Advanced IL analyzer — restores more protected method bodies
- 🧠 Improved string decryption — supports new obfuscation variants
- 📁 Better support for embedded resources
- 🔁 Smarter metadata restoration for heavily scrambled assemblies
- 🔄 Auto-detection of Application/Library mode

💡 Performance Upgrades:
- 🧪 Up to 40% faster devirtualization
- 🛡 More stable engine for large and complex targets
- 🔧 Higher overall compatibility across DNGuard-protected .NET apps

Join us at
@unpackhub — reverse engineering never sleeps!

---

🔄 [中文] DNGuard 解混淆器更新:支持 v4.9.1!
🚀 解包更准、更快,全面兼容最新版保护!

我们刚刚发布了 DNGuard 解混淆器的重大更新版本,现已完整支持 DNGuard v4.9.1,覆盖其最新虚拟化引擎和混淆机制。

🆕 更新亮点:
- ✅ 完整支持 DNGuard 4.9.1
- ⚡️ HVM2 解包引擎强化,适配新版虚拟化模式
- 🔎 IL 分析逻辑升级,恢复更多方法体
- 🧠 字符串解密增强,支持更多混淆变种
- 📁 嵌入资源支持更全面(图标、图片等)
- 🔁 元数据还原更智能,应对高度混淆程序集
- 🔄 自动识别 Application / Library 模式

💡 性能同步提升:
- 🧪 解混淆速度提升最高 40%
- 🛡 面向大型复杂目标更稳定
- 🔧 更广泛兼容 DNGuard 所有主流版本

关注我们频道
@unpackhub,获取第一手逆向工具更新资讯!
🧭 [EN] Guiding You Through Obfuscated Navigation Graphs

Some protections rewire program flow via indirect jumps and synthetic graphs. We map these into readable flowcharts.

🛠 Now Featuring:

-
🧭 Graph simplification
-
🧩 Block classification
-
🖼 Interactive CFG previews (in dev build)

---

📩 [中文] 解读混淆控制流图结构
部分混淆通过间接跳转与伪控制流图干扰分析。我们对这些结构进行了可视化建模。

🛠 新特性包括:

-
🧭 控制流图简化算法
-
🧩 基本块智能分类
-
🖼 可交互式 CFG 预览(开发版)
Please open Telegram to view this post
VIEW IN TELEGRAM
💣 [EN] Detecting Bomb Payloads in Obfuscated Assemblies

Some obfuscators plant logic bombs that trigger only in reverse engineering environments. Our scanners now flag these conditions early.

🚨 Detection Includes:

-
⚠️ Debugger-aware conditions
-
🧠 CPU & VM fingerprint checks
-
💥 Delayed exception triggers

---

📩 [中文] 探测隐藏炸弹逻辑
某些混淆器在代码中植入反调试炸弹,我们的检测器现可提前识别这些行为。

🚨 识别项包括:

-
⚠️ 调试环境检测逻辑
-
🧠 虚拟机/硬件特征识别
-
💥 延迟异常触发机制
Please open Telegram to view this post
VIEW IN TELEGRAM
🌐 [EN] Deobfuscator Web Portal — Coming Soon

We’re working on a browser-based interface for running unpackers online. It’ll support drag-and-drop analysis, live feedback, and more.

🖥 Planned Features:

-
📂 Upload obfuscated binaries
-
🔍 Run in-browser unpacking
-
📝 Live result annotations & patches

---

📩 [中文] 即将上线:在线解混淆平台!
我们正在开发基于网页的解混淆工具,支持上传分析并实时反馈。

🖥 功能预览:

-
📂 拖拽上传受保护程序
-
🔍 浏览器中直接解混淆
-
📝 实时注释与补丁建议
Please open Telegram to view this post
VIEW IN TELEGRAM
🧠 [EN] Decompiler Resistance: Metadata Field Encryption Tactics

Some protectors now encrypt not just strings, but field and type names in metadata — causing null or corrupted decompiler
outputs. Our reader decodes metadata blobs and remaps field symbols.

🔐 How We Handle It:

-
📦 Decoding encrypted metadata blobs
-
🧭 Reconstructing field/type name references
-
🔬 Inline metadata normalization

---

📩 [中文] 元数据加密新招:字段与类型名称保护机制
部分混淆器不仅加密字符串,还对字段与类型名进行加密,导致反编译器输出异常。

🔐 我们的处理方式:

-
📦 解密元数据中的加密段
-
🧭 还原字段与类型名称引用
-
🔬 实现元数据结构规范化
Please open Telegram to view this post
VIEW IN TELEGRAM
🔓 [EN] New Deobfuscator: Babel Obfuscator
🔥 We now support unpacking Babel-protected .NET assemblies!

Our new tool cracks through Babel Obfuscator and recovers IL code with high fidelity. Works with recent builds and both public & private forks.

🛠 Key Features:
- 🔄 Control flow reconstruction
- 📜 String decryption
- 🧬 Metadata restoration
- 🧩 Resource unpacking

Tested on real-world samples. Now available.

Join us at
@unpackhub for more deobfuscation power!

---

🔓 [中文] Babel 解混淆工具上线!
🔥 现在我们可以完整解包 Babel 混淆保护的 .NET 程序!

新工具支持 Babel 的主流版本与私有 fork,能稳定还原 IL、控制流和字符串。

🛠 核心功能:
- 🔄 控制流还原
- 📜 字符串解密
- 🧬 元数据恢复
- 🧩 资源提取

即日起开放使用。
关注
@unpackhub 获取工具下载与案例分析!
🚀 [EN] Big Update: ConfuserEx Forks Unpacker
✅ Now supports custom ConfuserEx forks with complex protections

We added support for ConfuserEx variants with renamed structures, dynamic encryption, and layered protection.

🛠 Improvements:
- 🔐 Dynamic string resolver
- 🧠 Signature-based devirtualization
- 📚 Robust metadata mapping

Now even the wildest forks are breakable.
Join
@unpackhub to stay ahead.

---

🚀 [中文] ConfuserEx Fork 版本支持上线!
✅ 支持多种定制 ConfuserEx 混淆器!

我们更新了解包器,现在支持多个魔改版 ConfuserEx,包括复杂加密和多层保护。

🛠 更新亮点:
- 🔐 动态字符串解密引擎
- 🧠 签名驱动的解虚拟化技术
- 📚 元数据全面映射

再复杂的 fork,我们也能搞定。
加入
@unpackhub 跟进新技术!
🧪 [EN] Obfuscator Lab Test: Eazfuscator.NET
🔍 Deep dive into control flow, resource protection, and anti-tamper

We reverse engineered the latest
Eazfuscator.NET and mapped its full protection scheme.

🧬 We now offer:
- 🔐 Anti-tamper bypass
- 📦 Resource recovery
- 🧠 IL unflattening

Real samples. Real success.
Reverse with us —
@unpackhub.

---

🧪 [中文] 解构 Eazfuscator.NET:深入逆向!
🔍 控制流、资源保护、反篡改机制全面分析

我们深入分析了最新版本的 Eazfuscator.NET,并开发了解包方案。

🛠 核心点包括:
- 🔐 反篡改绕过
- 📦 内嵌资源提取
- 🧠 IL 解扁平化

真实案例实测成功。
关注
@unpackhub 获取工具与教程!
🔬 [EN] Deep Dive: What Makes VMProtect So Hard
💣 Custom virtual opcodes, JIT hooks, and crazy flow logic

We explain why VMProtect is still one of the hardest protections to reverse — and how our tool solves it.

🧠 Covered:
- 🧱 VM architecture
- 🔍 Opcode translation
- 🪝 Anti-hooking tech

Want the full breakdown?
@unpackhub is where the knowledge drops.

---

🔬 [中文] 为什么 VMProtect 如此难以解包?
💣 自定义指令 + JIT Hook + 疯狂控制流

我们将深入讲解 VMProtect 的技术壁垒,以及我们是如何逐一破解的。

🧠 内容包含:
- 🧱 虚拟机架构分析
- 🔍 指令表重构
- 🪝 反 Hook 技术解析

想了解更多技术内幕?
锁定
@unpackhub,干货持续更新!
🧠 [EN] New Feature: Control Flow Graph Export
🔍 Now you can export CFGs from deobfuscated .NET assemblies for analysis or visualization.

🛠 Highlights:
- JSON-based CFG output
- Works on all recovered methods

Great for research, malware analysis, or auditing.

---

🧠 [中文] 新功能上线:控制流图导出
🔍 解混淆后的 .NET 方法现可导出为控制流图(CFG),便于分析与可视化。

🛠 特点:
- 输出 JSON 格式 CFG
- 全方法支持,无遗漏

适用于逆向研究、恶意样本分析、代码审计。
🛡 [EN] Anti-Tamper Bypass Module Added
🔥 Our tool now defeats popular .NET anti-tamper implementations

No more broken IL or runtime crashes.

🛠 Supported:
- Static and dynamic anti-tamper
- Section checksum tricks
- Resource signature checks

---

🛡 [中文] 支持反篡改绕过!
🔥 现已支持主流 .NET 反篡改方案的解包(ConfuserEx、Eazfuscator、DNGuard)

无崩溃,无错误 IL,还原真实结构!

🛠 支持类型:
- 静态与动态反篡改方案
- PE 校验和处理
- 内嵌资源签名检查绕过
🌀 [EN] NEW: Dynamic Decryption Emulator

Includes:
- Multi-layer string resolution
- Dynamic proxy call eval
- No need to run the sample

---

🌀 [中文] 动态字符串解密上线

无需实际执行样本,静态完成还原!

支持:
- 多层字符串恢复
- 动态代理调用求值
- 自动识别混淆器特征
📦 [EN] Resource Dumper Added
🧩 Now you can dump embedded DLLs, images, and encrypted blobs from protected .NET binaries.

---

📦 [中文] 内嵌资源提取功能上线
🧩 自动提取 DLL、图标、图片、内嵌加密数据等资源
🔄 [EN] Unflattening Engine Enhanced
🧠 Major improvements to our control flow unflattening logic

Results:
- Better decompiled output
- Works across VM obfuscators
- Cleaner control structure

---

🔄 [中文] 控制流还原引擎升级
🧠 控制流“解扁平”模块全面优化,输出更清晰 IL 与源码结构!

效果提升:
- 支持虚拟机混淆控制流
- 输出结构清晰,便于反编译
- 更易读的逻辑结构
📁 [EN] Archive Scan Mode
📂 Scan and unpack nested .NET assemblies inside ZIP, RAR, or installer bundles

Use case:
- Malware dumps
- Cracked software packs
- Packed self-extractors

---

📁 [中文] 批量扫描解包模式上线!
📂 支持自动扫描压缩包(ZIP、RAR、安装包)中的 .NET 样本并解混淆!

适用场景:
- 恶意代码打包
- 破解工具包
- 自解压封装程序
🧩 [EN] Obfuscator Detector v2
🔎 Automatically identifies protection schemes before unpacking

Supports:
- Multi-layer nesting detection

---

🧩 [中文] 混淆器识别引擎 V2
🔎 解包前自动识别混淆器类型与嵌套层级

支持:
- 多层嵌套检测
🛠 [EN] .NET Native + IL Mixed Mode Support
🧬 We now unpack binaries using mixed-mode (IL + native) code

Perfect for:
- Commercial protectors with native stubs
- IL-native bridging samples

---

🛠 [中文] 支持 .NET Native / IL 混合模式!
🧬 解包同时支持 IL 与 Native 混合代码结构

适用于:
- 商业混淆器带原生段保护
- Native 桥接 IL 的复杂样本
📈 [EN] Case Study: Cracking a 4-layer ConfuserEx Chain
💡 We unpacked a malware sample protected by 4 nested ConfuserEx layers

Process:
- VM stub resolution
- Proxy call flattening
- Decryption + resource unpacking

---

📈 [中文] 案例分析:解混淆 4 层嵌套 ConfuserEx
💡 一个恶意样本被 4 层 ConfuserEx 混淆保护,我们成功还原!

过程包括:
- 虚拟机 stub 分析
- 多层代理调用解构
- 字符串解密 + 资源提取
📢 [EN] Channel Activity Suspended (Indefinitely)
⚠️ Due to unforeseen legal circumstances, our channel owner — and lead developer of the .NET deobfuscation tools — is temporarily stepping away from all public activities.

Reason:
- Ongoing legal investigation tied to alleged "unauthorized software analysis"
- Restrictions imposed by local law enforcement
- No timeline for return

BUT — our tooling remains alive:
✅ We still provide private sales of all our deobfuscators
✅ Full support for VMProtect, ConfuserEx, Babel,
Agile.NET, Eazfuscator, DNGuard, and more
✅ Business as usual — just no public channel updates for now

---

📢 [中文] 频道暂停更新(期限未定)
⚠️ 由于不可预期的法律原因,我们的频道负责人 —— 同时也是核心解混淆工具的开发者 —— 暂时中止所有公开活动。

原因如下:
- 正在接受“非法软件分析活动”的调查
- 本地执法机构限制其网络行为
- 恢复时间暂未可知

但工具服务仍在继续:
✅ 所有解混淆工具仍可私下购买
✅ 完整支持 VMProtect, ConfuserEx、Babel、Agile.NET、Eazfuscator、DNGuard 等方案
✅ 售后与支持一切照旧,仅暂停公开发布
⚡️ [EN] THE RETURN OF UNPACKHUB — STRIKING BACK HARD ⚡️
💥 Like a bolt from the blue — WE'RE BACK. After months of silence, legal noise, and shutdowns...
@unpackhub RETURNS to the deobfuscation battlefield, STRONGER than ever.

🧩 Major core engine rewrites
🔬 New analysis techniques (entropy-based mapping, dynamic call resolution, anti-VM layers)
🧠 ML-powered signature recognition module for unknown junk code
🚀 FULL support for all modern obfuscators:

✅ ConfuserEx / ConfuserEx2
✅ Babel .NET
✅
Eazfuscator.NET (latest builds)
✅
Agile.NET (with control flow recovery!)
✅ .NET Reactor
✅ Obfuscar
✅ DNGuard
✅ VMProtect
✅ Xerin
✅ Custom/private obfuscators? — we got them too.

🛡 Anti-Tamper / Anti-De4dot bypass
🎯 Control Flow flattening recovery
🔓 String encryption reversal (AES, XOR chain, delegate proxy)
🧪 IL-to-C# accurate mapping + recompiler integration

We never stopped. We just leveled up.

💬 Buy the tools — contact:
@hvhmode
👑 Private builds / custom loaders / runtime analyzers available.

---

⚡️ [中文] UNPACKHUB 强势回归 ⚡️
💥 如同晴天霹雳 ——
@unpackhub 霸气归来!沉寂几月、风波不断,我们正式重启混淆逆向战线,回归即巅峰!

🔧 解混淆核心引擎全面重构
🔍 新增熵值识别 / 动态调用还原 / 虚拟机层拆解
🧠 引入机器学习算法,识别未知垃圾代码
📦 支持全系列 .NET 混淆器:

✅ ConfuserEx / ConfuserEx2
✅ Babel
✅ Eazfuscator.NET(最新版)
✅ Agile.NET(控制流恢复!)
✅ .NET Reactor / Obfuscar / DNGuard / VMProtect / Xerin
✅ 私有/定制混淆器亦支持!

🧱 支持 Anti-Tamper/Anti-De4dot 绕过
📌 控制流扁平化恢复
🔑 字符串加密解密(AES、XOR链、委托代理)
🧬 IL 映射精准还原,可与反编译器整合输出

我们从未离开,只是在升级!

💬 购买工具请联系:
@hvhmode
👑 提供私定制、自动分析器、运行时还原等高级服务。