Reverse Engineering RET Homepage RET Members Reverse Engineering Projects Reverse Engineering Papers Reversing Challenges Reverser Tools RET Re-Search Engine Reverse Engineering Forum Reverse Engineering Links

Go Back   Reverse Engineering Team Board > Reverse Engineering Board > .NET Reverse Engineering
FAQ Members List Calendar Search Today's Posts Mark Forums Read

Reply
 
Thread Tools Display Modes
  #1  
Old 09-21-2011, 11:06 PM
0xd4d 0xd4d is offline
Junior Member
 
Join Date: Sep 2011
Posts: 2
Default de4dot - Deobfuscator for .NET

This is a .NET deobfuscator.

Source code: https://bitbucket.org/0xd4d/de4dot
Binaries: https://bitbucket.org/0xd4d/de4dot/downloads

It currently supports the following .NET obfuscators:
  • Babel.NET
  • CliSecure / Agile.NET
  • CodeFort
  • CodeVeil
  • CodeWall
  • Crypto Obfuscator
  • DeepSea
  • Dotfuscator
  • Eazfuscator.NET
  • Goliath.NET
  • ILProtector
  • MPRESS
  • .NET Reactor
  • MaxtoCode
  • Rummage
  • Skater.NET
  • SmartAssembly
  • Spices.Net
  • Xenocode

It has partial support for other obfuscators, but the result might not be runnable.

Depending on obfuscator, it will do one or more of the following:
  • Rename obfuscated symbols
  • Deobfuscate control flow
  • Decrypt strings
  • Decrypt and dump embedded assemblies
  • Decrypt resources
  • Decrypt methods
  • Fix proxy calls
  • Inline methods
  • Remove error reporting code (added exception handlers)
  • Restore field and method arg types
  • Get rid of added obfuscator classes and methods

Last edited by 0xd4d : 12-12-2012 at 03:45 PM.
Reply With Quote
  #2  
Old 09-22-2011, 04:39 AM
diodolo diodolo is offline
Member
 
Join Date: Sep 2011
Posts: 7
Default

Thank you for your great work. I tested on .exe obfuscated with Eazfuscator.NET many other deobfuscator fails your deobfuscator work greatly. The new .exe generated crash when run, but with Reflector I can see the code without problem. Is it normal?

EDIT
Sorry I don't see this feature
Quote:
* Deobfuscated files are runnable
Can I help you to resolve the problem?

Last edited by diodolo : 09-22-2011 at 05:17 AM.
Reply With Quote
  #3  
Old 09-23-2011, 04:58 AM
diodolo diodolo is offline
Member
 
Join Date: Sep 2011
Posts: 7
Default

I see just now. The Class0 load a resource with GetManifestResourceStream and decrypt it with many XOR and GetPublicKeyToken. But I don't understand very well.
After the resource is decrypted load into a Dictionary which resolve the strings.
Reply With Quote
  #4  
Old 09-23-2011, 11:43 AM
cimmerian cimmerian is offline
Junior Member
 
Join Date: Aug 2011
Posts: 2
Default

Tested on .net 1.1. app with dotfuscator and deobfuscated result seems to be very good. Besides runs 100%.

Very good job!

Thank u!
Reply With Quote
  #5  
Old 09-30-2011, 11:50 AM
newbieinetrnet newbieinetrnet is offline
Member
 
Join Date: Sep 2011
Posts: 8
Default

I downloaded it but I don't know how to use it ! Can anybody help me, please ?
Reply With Quote
  #6  
Old 09-30-2011, 04:53 PM
diodolo diodolo is offline
Member
 
Join Date: Sep 2011
Posts: 7
Default

[Please DO NOT quote whole messages, it is unnecessary]

Thank you for it. I tried on my application and works very great.
Do you continue the development? Have you other obfuscator to improve?

Last edited by Git : 09-30-2011 at 04:57 PM.
Reply With Quote
  #7  
Old 09-30-2011, 10:10 PM
newbieinetrnet newbieinetrnet is offline
Member
 
Join Date: Sep 2011
Posts: 8
Default

I can't run exe after I deobfuscate program

http://www.mediafire.com/?h5t808fxtmh6gl0
Reply With Quote
  #8  
Old 10-03-2011, 09:16 AM
bugmenot2 bugmenot2 is offline
Junior Member
 
Join Date: Jan 2011
Posts: 2
Default

Nice Tool dude! Keep it up and up to date.

Greatz
Reply With Quote
  #9  
Old 10-05-2011, 12:24 PM
Arix1 Arix1 is offline
Junior Member
 
Join Date: Oct 2011
Posts: 1
Default

Hi, thanks for your work.

I cannot run a decompiled .NET 1.1 assembly, more precisely, the *.exe file: http://www.mediafire.com/?axqc11m463es9qu.

Good luck onwards.
Reply With Quote
  #10  
Old 11-16-2011, 02:55 AM
Marton Marton is offline
Member
 
Join Date: Nov 2011
Posts: 7
Default

I can't save on a DLL with Reflector, it says "Value does not fall within the expected range". When I try to unobfuscate it with your protector, it says: "Ignoring assembly with native code". Here is the file: http://www.mediafire.com/?3iqtjd3q3jsm9rr
Is it an unknown obfuscator? If not, is there a way to remove the native code for getting de4dot to work?
TIA
Reply With Quote
Reply


Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Forum Jump





Powered by vBulletin® Version 3.6.4
Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.