From Collaborative RCE Tool Library

Jump to: navigation, search

de4dot

Tool name: de4dot
Rating: 0.0 (0 votes)
Author: 0xd4d                        
Website: https://bitbucket.org/0xd4d/de4dot/
Current version: 2.0.3
Last updated: January 12, 2013
Direct D/L link: https://bitbucket.org/0xd4d/de4dot/downloads
License type: GPLv3
Description: de4dot is an open source (GPLv3) .NET deobfuscator and unpacker written in C#. It will try its best to restore a packed and obfuscated assembly to almost the original assembly. Most of the obfuscation can be completely restored (eg. string encryption), but symbol renaming is impossible to restore since the original names aren't (usually) part of the obfuscated assembly.

Features:
-Inline methods. Some obfuscators move small parts of a method to another static method and calls it.
-Decrypt strings statically or dynamically
-Decrypt other constants. Some obfuscators can also encrypt other constants, such as all integers, all doubles, etc.
-Decrypt methods statically or dynamically
-Remove proxy methods. Many obfuscators replace most/all call instructions with a call to a delegate. This delegate in turn calls the real method.
-Rename symbols. Even though most symbols can't be restored, it will rename them to human readable strings. Sometimes, some of the original names can be restored, though.
-Devirtualize virtualized code
-Decrypt resources. Many obfuscators have an option to encrypt .NET resources.
-Decrypt embedded files. Many obfuscators have an option to embed and possibly encrypt/compress other assemblies.
-Remove tamper detection code
-Remove anti-debug code
-Control flow deobfuscation. Many obfuscators modify the IL code so it looks like spaghetti code making it very difficult to understand the code.
-Restore class fields. Some obfuscators can move fields from one class to some other obfuscator created class.
-Convert a PE exe to a .NET exe. Some obfuscators wrap a .NET assembly inside a Win32 PE so a .NET decompiler can't read the file.
-Removes most/all junk classes added by the obfuscator.
-Fixes some peverify errors. Many of the obfuscators are buggy and create unverifiable code by mistake.
-Restore the types of method parameters and fields

Supported obfuscators/packers:
Agile.NET (aka CliSecure)
Babel.NET
CodeFort
CodeVeil
CodeWall
CryptoObfuscator
DeepSea Obfuscator
Dotfuscator
.NET Reactor
Eazfuscator.NET
Goliath.NET
ILProtector
MaxtoCode
MPRESS
Rummage
Skater.NET
SmartAssembly
Spices.Net
Xenocode
Related URLs:
Wiki:
https://bitbucket.org/0xd4d/de4dot/wiki/Home


RSS feed Feed containing all updates for this tool.

You are welcome to add your own useful notes about this tool, for others to see!



If you find that any information for the tool above is missing, outdated or incorrect, please edit it!
(please also edit it if you think it fits well in some additional category, since this can also be controlled)


Views
Category Navigation Tree
   Code Coverage Tools  (13)
   Code Ripping Tools  (2)
   Helper Tools  (3)
   Hex Editors  (13)
   Memory Patchers  (7)
   Packers  (20)
   Profiler Tools  (11)
   String Finders  (10)
   Tool Hiding Tools  (7)
   Tracers  (22)
   Needs New Category  (3)