diff --git a/de4dot.code/deobfuscators/Confuser/Deobfuscator.cs b/de4dot.code/deobfuscators/Confuser/Deobfuscator.cs index 3bf3eea0..0223ab60 100644 --- a/de4dot.code/deobfuscators/Confuser/Deobfuscator.cs +++ b/de4dot.code/deobfuscators/Confuser/Deobfuscator.cs @@ -286,7 +286,7 @@ namespace de4dot.code.deobfuscators.Confuser { if (unpacker != null && unpacker.Detected) { if (options.DecryptMainAsm) { decryptState |= DecryptState.CanDecryptMethods | DecryptState.CanUnpack; - var mainInfo = unpacker.unpackMainAssembly(); + var mainInfo = unpacker.unpackMainAssembly(true); newFileData = mainInfo.data; realAssemblyInfo = mainInfo.realAssemblyInfo; embeddedAssemblyInfos.AddRange(unpacker.getEmbeddedAssemblyInfos()); @@ -296,7 +296,7 @@ namespace de4dot.code.deobfuscators.Confuser { } else { decryptState &= ~DecryptState.CanUnpack; - mainAsmInfo = unpacker.unpackMainAssembly(); + mainAsmInfo = unpacker.unpackMainAssembly(false); embeddedAssemblyInfos.AddRange(unpacker.getEmbeddedAssemblyInfos()); return false; } @@ -395,7 +395,9 @@ namespace de4dot.code.deobfuscators.Confuser { void dumpEmbeddedAssemblies() { if (mainAsmInfo != null) { - DeobfuscatedFile.createAssemblyFile(mainAsmInfo.data, mainAsmInfo.asmSimpleName + "_real", mainAsmInfo.extension); + var asm = module.Assembly; + var name = asm == null ? module.Name : asm.Name.Name; + DeobfuscatedFile.createAssemblyFile(mainAsmInfo.data, name + "_real", mainAsmInfo.extension); addResourceToBeRemoved(mainAsmInfo.resource, string.Format("Embedded assembly: {0}", mainAsmInfo.asmFullName)); } foreach (var info in embeddedAssemblyInfos) { diff --git a/de4dot.code/deobfuscators/Confuser/Unpacker.cs b/de4dot.code/deobfuscators/Confuser/Unpacker.cs index b6fbfc67..d3686a58 100644 --- a/de4dot.code/deobfuscators/Confuser/Unpacker.cs +++ b/de4dot.code/deobfuscators/Confuser/Unpacker.cs @@ -397,13 +397,13 @@ namespace de4dot.code.deobfuscators.Confuser { return null; } - public EmbeddedAssemblyInfo unpackMainAssembly() { + public EmbeddedAssemblyInfo unpackMainAssembly(bool createAssembly) { if (mainAsmResource == null) return null; var info = createEmbeddedAssemblyInfo(mainAsmResource, decrypt(mainAsmResource)); var asm = module.Assembly; - if (asm != null && entryPointToken != 0 && info.kind == ModuleKind.NetModule) { + if (createAssembly && asm != null && entryPointToken != 0 && info.kind == ModuleKind.NetModule) { info.extension = DeobUtils.getExtension(module.Kind); info.kind = module.Kind;