How ConfuserEx 2 Renames Symbols and Flattens .NET Namespaces
· 10:19 · Watch on YouTube ↗
Summary
Dr Josh Stroschein demonstrates how ConfuserEx 2 obfuscates .NET binaries by renaming symbols, flattening namespaces, and modifying metadata strings, then shows how DE4Dot can make the output more readable.
Key points
- ConfuserEx 2 renames symbols and moves code into the global namespace, making the program’s original structure harder to understand.
- The obfuscator changes metadata strings, including class, method, and property names; user-defined strings are not covered by the rename protection discussed.
- The entry point and some methods needed for reflective assembly and type loading remain useful places to begin manual analysis.
- Unicode-based symbol names can make analysis clumsy, and the video notes that obfuscation protections can work together.
- DE4Dot cleans the sample and assigns more readable generic names, but does not recover the original symbol names.
Article Details
- Topics
- [00:00] ConfuserEx 2 rename protection and obfuscation workflow
- [02:26] Namespace flattening and structural changes in the binary
- [03:49] .NET metadata tables and obfuscated symbol strings
- [06:27] Obfuscation limitations and analysis clues in reflective loading
- [08:31] Using DE4Dot to clean and rename obfuscated symbols