Latest version 2018.2 isnt supported? about eazfixer

[holly-hacker]

Could you double-check that the program you're deobfuscating is indeed using EazFuscator, and then upload your sample?

[rlaphoenix]

I can confirm its Eaz 2018.2 (Latest Release)
Upload: https://www105.zippyshare.com/v/KOwGRCis/file.html

[holly-hacker]

Alright, that does indeed look like eaz, I'll look into updating eazfixer when I get home.

Though, keep in mind that your program also has virtualization applied. You'll have to run it through a program like eazdevirt first (which I don't think is fully updated).

[holly-hacker]

Found that issue was some naive comparisons on my part. I'm using SigComparer to compare methods to the expected string decrypter, but one of the methods in your target assembly has this code:

\u0008\u2007\u2000.\u0002(1996868267) + \u0006\u2005\u2000.\u0002(16)

My code thinks both of these are encrypted strings, but the second one isnt (even though it has the same signature and method name). Pushing a fix in a few minutes.