Collaborative RCE Tool Library - Deobfuscation Tools (including sub-categories)

Tool Added: .NET Methods Parser

2010-07-18T22:27:24Z

Listed in categories: .NET Deobfuscation Tools

Most recent version:
0.2

Most recent release date:
July 19, 2010

Description:
A simple tool to analyze the "Methods" metadata table.
It has a good error and invalid data handling code so it will open most weird files.

Tool Updated: Malzilla

2010-02-21T13:26:55Z

Listed in categories: Javascript Debuggers, Javascript Deobfuscators

Most recent version:
1.2.0

Most recent release date:
November 2, 2008

Description:
Malware hunting tool. Web pages that contain exploits often use a series of redirects and obfuscated code to make it more difficult for somebody to follow. MalZilla is a useful program for use in exploring malicious pages. It allows you to choose your own user agent and referrer, and has the ability to use proxies. It shows you the full source of webpages and all the HTTP headers. It gives you various decoders to try and deobfuscate javascript aswell.

Tool Updated: Bad Net Opcodes Finder

2010-01-15T13:20:32Z

Listed in categories: .NET Deobfuscation Tools

Most recent version:
0.6 beta

Most recent release date:
December 18, 2009

Description:
A tool used to fix a nasty anti-decompiler trick, the trick is based on using invalid opcodes to make the decompilation process impossible with tools like Reflector.
So you can use this tool to kill these nasty invalid opcodes and see the code again in Reflector, You will find a small video which explains how to use this tool.

Tool Updated: CodeDoctor

2009-11-12T16:24:49Z

Listed in categories: Deobfuscation Tools, IDA Extensions, OllyDbg Extensions, Resource Editors, Unpacking Tools

Most recent version:
0.90

Most recent release date:
November 12, 2009

Description:
<nowiki>CodeDoctor is a plugin for Olly and IDA.

History:
11.11.2009 - 0.90 - initial public release

________________________________________________________________________________
Functions:

1) Deobfuscate

Select instructions in disasm window and execute this command. It will try
to clear the code from junk instructions.

Example:

Original:
00874372 57 PUSH EDI
00874373 BF 352AAF6A MOV EDI,6AAF2A35
00874378 81E7 0D152A41 AND EDI,412A150D
0087437E 81F7 01002A40 XOR EDI,402A0001
00874384 01FB ADD EBX,EDI
00874386 5F POP EDI

Deobfuscated:
00874372 83C3 04 ADD EBX,4

________________________________________________________

2) Deobfuscate - Single Step

This works like previous command, but does one transformation at a time
_______________________________________________________

3) Move NOPs to bottom

Converts this:

00874396 50 PUSH EAX
00874397 90 NOP
00874398 90 NOP
00874399 52 PUSH EDX
0087439A BA 3F976B00 MOV EDX,somesoft.006B973F

to this:

00874396 50 PUSH EAX
00874397 52 PUSH EDX
00874398 BA 3F976B00 MOV EDX,somesoft.006B973F
0087439D 90 NOP
0087439E 90 NOP

Limitations: it breaks all jumps and calls pointing inwards
________________________________________________________

4) Undo / Redo

Undo or Redo last operation (from one of the above functions)

________________________________________________________

5) Retrieve Jumpy function

This will statically parse instructions and follow all jumps. This is useful
for situations, when program jumps here and there and here and there... When
it encounters some instruction, that can't be followed, it stop and copies
all parsed instruction to an allocated place in memory.

Use settings to set some parameters:
Step over calls - if set, it will step over calls, otherwise it will follow them
Step over jccs - dtto, but for Jccs
Deobfuscate - it will deobfuscate instruction, when it encounters Jcc, RET,
JMP reg/exp, CALL reg/exp; useful for multi-branch

Example:

Original:
00874389 /EB 05 JMP SHORT somesoft.00874390
0087438B

Tool Updated: PvLog DeObfuscator Win32

2009-01-26T14:38:18Z

Listed in categories: .NET Deobfuscation Tools, .NET Tools

Most recent version:
1.0

Most recent release date:
November 8, 2008

Description:
PvLog Deobfuscator is a MSIL code optimizer. One side effect of the optimizer is that it can make more readable obfuscated code. PvLog DeObfuscator can also rename the types and names of members to further improve readability. This tool does not require installation: you just need to run the executable. DeObfuscator is also available in 32 and 64 bit, but we recommend you use the version that corresponds to the architecture of the assembly to optimize. The assembly generated by Deobfusctator may not always run because of protective measures implemented in the assembly (protection against code modification), but should be able to load in reflector. NOTE: the attribute that prevents ILDASM is not removed by DeObfuscator... but it could !

Tool Updated: DotNetTools Win32

2009-01-26T14:36:10Z

Listed in categories: .NET Deobfuscation Tools, .NET Tools, .NET Unpackers

Most recent version:
1.0

Most recent release date:
November 8. 2008

Description:
dotNet Tools is a freeware suite that includes dotNet Sniffer, PvLog DeObfuscator and PvLog LicenseManagerKiller. dotNet Sniffer uses the .NET profiler API to save assemblies loaded from memory. PvLog Deobfuscator is a MSIL code optimizer that makes more readable obfuscated code. LicenseManagerKiller is a tool that removes LicenseProvider attributes in the assembly.

Tool Updated: .NET DeObfuscator

2008-06-19T19:11:47Z

Listed in categories: .NET Deobfuscation Tools

Most recent version:
0.5

Most recent release date:
June 11, 2008

Description:
This is a tool to deobfuscate names only in Assemblies, It doesn't deobfuscate control-flow.

This tool is supposed to make our life easier when exploring in Reflector, so the deobfuscated assembly in most cases won't run and it's meant to be used in Reflector for analysis only.

What this tool does is that it renames Classes and other member of assembly like Procedures and Fucntion into more understandable names for easier analysis, for example it renames a Class of type Form to "Class10_Form" instead of "xhfkd9oekfpklgpf" as we see in assemblies obfuscated with xenocode or any other obfuscator, I didn't want it to release it at first, but when I added type detection to renaming process it became more useful.

Tool Added: Windows Script Decoder

2008-06-12T17:58:53Z

Listed in categories: Automated Unpackers, Deobfuscation Tools

Most recent version:
1.8

Most recent release date:
April 10, 2005

Description:
The Windows Script Encoder (screnc.exe) is a Microsoft tool which can be used to encode your scripts (i.e. JScript, ASP pages, VBScript). Yes: encode, not encrypt. The use of this tool is to be able to prevent people from looking at, or modifying, your scripts. Microsoft recommends using the Script Encoder to obfuscate your ASP pages, so in case your server is compromised the hacker would be unable to find out how your ASP applications work.

The Windows Script Decoder is a tool that I wrote which can be used to decode all scripts that have been encoded with the Windows Script Encoder.

Please note that this program was originally written to demonstrate the ease of a cryptoanalysis attack against a tool like the Windows Script Encoder. Nowadays, script encoding is used often to hide malicious scripting commands and the script decoder can be very useful to uncover the original code. Do not use this tool to violate copyright. That's not what it is meant for.

Tool Added: MFC Decorated To Undecorated

2008-04-28T10:28:36Z

Listed in categories: Code Beautifiers

Most recent version:
1.0

Most recent release date:
October 13, 2006

Description:
This is a little application I wrote some times ago and it might come in handy when you need to convert a decorated c++ name into the undecorated version of the same name. You can convert a single name or an entire .def file, I sometimes convert mfc42.def when my preferred disassembler/debugger doesn’t recognise one or more names.

Tool Updated: Pynary

2008-01-15T07:13:58Z

Listed in categories: Deobfuscation Tools, Diff Tools, Exe Analyzers, Executable Diff Tools, Programming Libraries, Reverse Engineering Frameworks

Most recent version:
0.0.1

Most recent release date:

Description:
pynary will become a powerful platform independent framework for binary code analysis.

The initial goal is to the implementation of function signature matching using graph isomorphism and an extensible 'write-your-own-heuristic' model to allow tweaks for particular targets. It will also identify standard library global constants and structure where possible.

Once the initial goal is achieved, a number of cool features are planned:

* stack frame analysis
* un-inliner
* exception handling parsing/analysis
* 'functionally equivalent' matching
* c++ template function matching
* meta-data transfer between IDBs
* c++ class reconstruction (with/without RTTI)
* ...

This project is still in its infancy, and looking for volunteers.

Tool Added: DelForExp

2007-12-26T16:48:39Z

Listed in categories: Code Beautifiers

Most recent version:
2.5

Most recent release date:
2007

Description:
DelForExp is a FREEWARE Delphi source code formatter that really works.
It improves:

* the indentation
* spacing
* capitalization
* use of blank lines of Delphi source code.

To do so the source code is parsed and lots of special constructs are tested. At default, the style of the Borland source code is followed closely, since this is the most widely accepted style. But formatting of Pascal code is much a matter of taste and debate. Therefore, some alternative rules are included. DelForExp is available as Delphi 2/3/4/5/6/7/9/2007 expert. It can optionally process the whole currently opened project.

Tool Added: Lore's Source to HTML Converter

2007-12-26T16:25:19Z

Listed in categories: Code Beautifiers

Most recent version:
3.4b

Most recent release date:
06/01/2005

Description:
Lore's Source to HTML Converter is a free software tool that converts source code of arbitrary programming or markup languages into syntax-highlighted HTML. The key features are:

* Supports arbitrary programming or markup languages. Actually language definitions for C/C++, Java, Java Script, Delphi, LaTex, HTML, Ini files and BibTex exist.
* Project files to easily store options and file lists for your different projects
* Pre- and user defined syntax highlighting styles
* Optimized output: Successive elements with the same color or style are formatted together and not separately
* Fast on the fly conversion
* Extensive syntax highlighting like in commercial compilers or editors. Take a look a the screenshot to get an idea ...

Note, this tool does not actually alter source code so it's not a code beautifier in the traditional sense. It is purely intended to generate a formatted HTML representation of code. "Arbitrary languages" means that you can define your own lexer-style keywords and their associated formatting options. This tool is extremely useful for documenting source code (eg: in tutorials).

Tool Added: PolyStyle

2007-10-18T19:22:53Z

Listed in categories: Code Beautifiers, Javascript Deobfuscators

Most recent version:
3.2zn

Most recent release date:
October 16, 2007

Description:
Very nice and flexible code beautifier, for many languages.