http://reversing.kr/download.php?n=14
Purpose: Show flag in form
File name: CSHOP.exe
File type: Portable Executable 32 .NET Assembly
Using dnSpy to decompile the file. Go to function Main(), we can see that it has run the frmMain()
Go to frmMain, some variable names were obfuscated. We using de4dot to deobfuscate this file.
After deobfuscating, we notice functions: btnStart_Click() and InitializeComponent()
Location of labels are arranged in a row and are changed after the event btnStart_Click() but size of btnStart equal (0,0)
Change the size to (50, 50) and recompile file (we need save file before run again). We got flag !
Flag: P4W6RP6SES
Blog ATTT 