diff --git a/de4dot.code/deobfuscators/Confuser/StringDecrypter.cs b/de4dot.code/deobfuscators/Confuser/StringDecrypter.cs index 542f0cd8..7677503c 100644 --- a/de4dot.code/deobfuscators/Confuser/StringDecrypter.cs +++ b/de4dot.code/deobfuscators/Confuser/StringDecrypter.cs @@ -309,12 +309,15 @@ namespace de4dot.code.deobfuscators.Confuser { if (!findMagic2(method, out magic2)) continue; - if (!localTypes.exists("System.Random")) + if (DotNetUtils.callsMethod(method, "System.Text.Encoding System.Text.Encoding::get_UTF8()")) + version = ConfuserVersion.v10_r42915; + else if (!localTypes.exists("System.Random")) version = ConfuserVersion.v11_r49299; else if (localTypes.exists("System.Collections.Generic.Dictionary`2")) version = ConfuserVersion.v10_r48832; else - version = ConfuserVersion.v10_r42915; + continue; + resource = tmpResource; decryptMethod = method; break;