.NET DeObfuscator

[Kurapica]

This is a tool to deobfuscate names only in Assemblies, It doesn't deobfuscate control-flow.

[Daniel Pistelli]

Kurapica, I haven't tried it. But how can you deobfuscate names? It's a one way process. You can only rename them to names that can be compiled again after being decompiled. Do you mean that?

[Kurapica]

This tool is supposed to make our life easier when exploring in Reflector, so the deobfuscated assembly in most cases won't run and it's meant to be used in Reflector for analysis only.

What this tool does is that it renames Classes and other member of assembly like Procedures and Fucntion into more understandable names for easier analysis, for example it renames a Class of type Form to "Class10_Form" instead of "xhfkd9oekfpklgpf" as we see in assemblies obfuscated with xenocode or any other obfuscator, I didn't want it to release it at first, but when I added type detection to renaming process it became more useful.

I hope it's useful for every one.

[Daniel Pistelli]

The type renaming method is a good idea.

BUT there are some serious bugs. You rename even special methods (which aren't obfuscated) like cctor, property methods (get/set) etc. These methods need their name to be intact. Otherwise after the renaming you'll have an assembly which can't run. And the decompiling process becomes even more difficult, how you can see from the images:

http://ntoskrnl.pmode.net/name_deobf.jpg

Even if considering only the decompilation process, it gets harder to understand the code when such clear names are missing, not easier.

You should fix this behaviour considering the type flags.

[Kurapica]

Quote:

Otherwise after the renaming you'll have an assembly which can't run

Quote:

so the deobfuscated assembly in most cases won't run and it's meant to be used in Reflector for analysis only.

Thanks for the tips and I will try to fix these issues in next release.

[Daniel Pistelli]

Yes, I read that, but since it depends only on that issue, it can be fixed and assembly will be able to run.

You're welcome.

[dELTA]

CRCETL:
http://www.woodmann.com/collaborative/tools/index.php/.NET_DeObfuscator


Hey Kurapica, thanks for all the nice tools, and welcome to the board.

If it would be in any way possible, could you just add a few extra words of description about the tools you upload (like the very nice description you gave above to Daniel)? That would make them so much more valuable for everyone I think!

[Kurapica]

Thanks for the tips... :-)

I will add more description next times.

[Kurapica]

What's new

1 - Faster algo
2 - Excludes certain members for better renaming
3 - Minor bug fixes

Bug reports are welcome

[dELTA]

Nice. CRCETL entry updated.

Please note that you can (and are very welcome to) update the CRCETL entries for your tools yourself when you release an update, simply press the edit button at the bottom of the tool's page, enter the new info and presto, it's updated!

[squalito]

Hello,

What a great tool !!
Why I didn't find it before doing myself the deobfuscation of xenocode assemblies
Hmm do you manage no printable chars ? (xenocode obfuscation create a lot of non printable chars)

I'v tried it on an assembly created with xenocode and it does a great job, and déobfuscate maybe 90% of the code (not the control flow indeed)

Well thanks a ton for this tool

[Kurapica]

Wow ... :-D
I'm happy some one found it useful !!

Quote:

and déobfuscate maybe 90% of the code

I didn't understand what you meant by 90% because it's supposed to fully rename all members up to 100%

Quote:

Well thanks a ton for this tool

Thanks for the nice words

[squalito]

for example

Quote:

public void Procedure_12(Class_24_Office2007Form ֑, Class_28_Object ֖, string ߏ, string ࢳ { string str; string[] strArray; DateTime time; this.Field_28 = ֑; this.Field_30 = ֖; this.Field_31 = ߏ;

I think defined ressources keep there @@#\ name

[FrankRizzo]

Thanks for the help Kurapica!

[thateam]

Thanks a lot Kurapica !

[thateam]

Please help
doesn't work on this sample.?
http://rapidshare.com/files/164285331/bin.rar.html
Why ? can you help me?
Error : Index was out range.Must be non-negative and less then the size of collection Parameter name index

[Kurapica]

There are two files :

1- HoWaveRull.dll : not an assembly and can't be deobfuscated !
2- HoWaveVGO.dll : this one is an assembly but all its names and code are clear and not obfuscated, I tried to deobfuscate but the tool failed because some items were made invalid to kill reflector and similar tools, it will be added to future updates.