confuserex issue

[greenozon]

if it's OK to have some samples/issues here? , else pls close
I've some nice set of c-ex binaries ;)

goal: just test new addon (c-ex), nothing else

de4dot.exe AutoStarter.exe -p crx -v

de4dotEx v3.2.0.0

Deobfuscating control flow: System.Byte[] <Module>::​‍‌‎‮‮‌‎‭‫‌‌‎‎‏‬‬‌‎‌‬‬‎‎‫‮(System.Byte[]) (06000006)
  Could not deobfuscate 06000006
Detected ConfuserEx  (c:\Prg\dotnetki\de4d_git\de4dotEx\Release\net48\AutoStarter.exe)
Cleaning c:\Prg\dotnetki\de4d_git\de4dotEx\Release\net48\AutoStarter.exe
Deobfuscating methods
Deobfuscating System.Void <Module>::.cctor() (06000001)
  Removed 2 unused local(s)
  Removed 46 dead instruction(s)
Deobfuscating System.Void <Module>::‍‮‮​‭‭‌‏‌​‮‏‍‬‏‮‌‫‍‮‮‬‫​‌‏‮() (06000002)
ERROR:
ERROR:
ERROR:
ERROR: ------------------------------------------------------------------------------
ERROR: Stack trace:
ERROR:    at de4dot.code.deobfuscators.ConfuserEx.ControlFlowFixer.ProcessBlock(List`1 switchCaseBlocks, Block block, Block switchBlock)
ERROR:    at de4dot.code.deobfuscators.ConfuserEx.ControlFlowFixer.DeobfuscateSwitchBlock(List`1 methodBlocks, Block switchBlock)
ERROR:    at de4dot.code.deobfuscators.ConfuserEx.ControlFlowFixer.Deobfuscate(List`1 methodBlocks)
ERROR:    at de4dot.blocks.cflow.BlocksCflowDeobfuscator.Deobfuscate(IEnumerable`1 bds, List`1 allBlocks)
ERROR:    at de4dot.blocks.cflow.BlocksCflowDeobfuscator.Deobfuscate()
ERROR:    at de4dot.code.ObfuscatedFile.Deobfuscate(MethodDef method, BlocksCflowDeobfuscator cflowDeobfuscator, MethodPrinter methodPrinter, Boolean isVerbose, Boolean isVV)
ERROR:    at de4dot.code.ObfuscatedFile.DeobfuscateMethods()
ERROR:    at de4dot.code.ObfuscatedFile.Deobfuscate()
ERROR:    at de4dot.cui.FilesDeobfuscator.DeobfuscateAllFiles(IEnumerable`1 allFiles)
ERROR:    at de4dot.cui.FilesDeobfuscator.DeobfuscateAll()
ERROR:    at de4dot.cui.FilesDeobfuscator.DoIt()
ERROR:    at de4dot.cui.Program.Main(String[] args)
ERROR:
ERROR:
ERROR: Caught an exception:
ERROR:
ERROR: ------------------------------------------------------------------------------
ERROR: Message:
ERROR:   CRITICAL ERROR: STACK VALUE UNKNOWN
ERROR: Type:
ERROR:   System.Exception
ERROR: ------------------------------------------------------------------------------
ERROR:
ERROR: Try the latest version!

AutoStarter.zip

[meck-gd]

Looks like either a custom variant of ConfuserEx was used here or another obfuscator was applied on top of it. The methods contain two switches instead of one. The ControlFlowFixer code is not equipped to deal with this and it's probably not entirely trivial to fix.