De4dot

de4dot is a .NET deobfuscator, unpacker, and assembly analysis tool. It is designed to remove obfuscation layers, restore metadata, and simplify bytecode control flow to transform protected binaries back into human-readable code.

The project features specialized systems for decrypting strings and constants using both static and dynamic analysis. It identifies specific protection tools through pattern-based detection and strips anti-analysis protections, such as tamper detection and anti-debugging code.

The tool provides a suite of reverse engineering capabilities, including binary wrapper unpacking, symbol renaming, and the repair of invalid intermediate language instructions. It also includes automation for recursive batch processing across directory trees.

Features

Deobfuscation Tools - Provides specialized tools for restoring readability to obfuscated .NET assemblies through the removal of protection layers.
.NET Assembly Deobfuscation - Core purpose is decrypting strings and simplifying control flow in obfuscated .NET code.
Metadata Restoration - Fixes verifiable code and preserves assembly metadata to ensure compatibility with decompilers.
Binary Unpacking - Extracts embedded assemblies from protective outer shells and strips junk classes to expose original bytecode.
Control Flow Simplification - Removes proxy methods and inlines split functions to restore the original logical execution path of the bytecode.
.NET Assembly Analysis - Detects obfuscators and analyzes .NET binary structure without modifying files.
.NET Reverse Engineering - Analyzes protected .NET assemblies by removing obfuscation layers to restore source code.
.NET String Decryption - Identifies and replaces encrypted strings and constants using static and dynamic analysis.
Symbol Restoration - Renames obfuscated symbols to human-readable strings and restores field types to make the binary logic easier to follow.
Control Flow Simplification - Simplifies bytecode control flow by removing proxy methods and inlining split functions.
CIL Simplification - Removes proxy methods and inlines split code to restore original .NET bytecode execution paths.
Bytecode Repair - Corrects buggy intermediate language instructions that cause verification errors to ensure the assembly is structurally sound.
Binary Cleaning - Cleans and fixes buggy intermediate language instructions to ensure compatibility with analysis tools.
Metadata Preservation - Retains critical assembly metadata tokens and signature data to ensure compatibility with specialized analysis tools.
Static Binary Analysis - Reveals original constants and embedded files by analyzing the binary without execution.
Bytecode Repair - Corrects invalid or buggy bytecode instructions to ensure assemblies pass structural verification.
Anti-Analysis Removal - Strips tamper detection and anti-debugging code to enable deeper analysis of instructions.
Binary Pattern Matching - Identifies protection tools by matching specific byte patterns within binary metadata.
Dynamic Binary Decryption - Executes decryption methods from loaded assemblies to replace encrypted calls with plain text.
Dynamic String Decryption - Executes decryption methods from a loaded assembly to replace encrypted string calls with plain-text values.
Malware Analysis - Strips anti-debugging and anti-analysis protections to reveal the actual behavior of programs.
Obfuscated Data Decryption - Decrypts strings, constants, and embedded files using static and dynamic analysis to reveal original values.
Obfuscator Detection - Identifies the specific protection tool used on an assembly by matching byte patterns and structural markers.
Symbol Renamers - Tracks and replaces obfuscated identifiers with human-readable names while maintaining references.
Game Hacking Tools - Deobfuscator and unpacker for .NET assemblies.
Reverse Engineering Tools - Deobfuscates and unpacks .NET assemblies.
Unpacking and Deobfuscation - .NET deobfuscator and unpacker.
Blue Team Tools - .NET deobfuscator.
Deobfuscation - Deobfuscates and unpacks .NET assemblies.

Star-Verlauf

0xd4dde4dotArchived

Name: 0xd4d/de4dot
Author: 0xd4d

View on GitHub

7,426 Stars2,808 ForksC#GPL-3.012 Aufrufe

De4dot

Features

Deobfuscation Tools - Provides specialized tools for restoring readability to obfuscated .NET assemblies through the removal of protection layers.
.NET Assembly Deobfuscation - Core purpose is decrypting strings and simplifying control flow in obfuscated .NET code.
Metadata Restoration - Fixes verifiable code and preserves assembly metadata to ensure compatibility with decompilers.
Binary Unpacking - Extracts embedded assemblies from protective outer shells and strips junk classes to expose original bytecode.
Control Flow Simplification - Removes proxy methods and inlines split functions to restore the original logical execution path of the bytecode.
.NET Assembly Analysis - Detects obfuscators and analyzes .NET binary structure without modifying files.
.NET Reverse Engineering - Analyzes protected .NET assemblies by removing obfuscation layers to restore source code.
.NET String Decryption - Identifies and replaces encrypted strings and constants using static and dynamic analysis.
Symbol Restoration - Renames obfuscated symbols to human-readable strings and restores field types to make the binary logic easier to follow.
Control Flow Simplification - Simplifies bytecode control flow by removing proxy methods and inlining split functions.
CIL Simplification - Removes proxy methods and inlines split code to restore original .NET bytecode execution paths.
Bytecode Repair - Corrects buggy intermediate language instructions that cause verification errors to ensure the assembly is structurally sound.
Binary Cleaning - Cleans and fixes buggy intermediate language instructions to ensure compatibility with analysis tools.
Metadata Preservation - Retains critical assembly metadata tokens and signature data to ensure compatibility with specialized analysis tools.
Static Binary Analysis - Reveals original constants and embedded files by analyzing the binary without execution.
Bytecode Repair - Corrects invalid or buggy bytecode instructions to ensure assemblies pass structural verification.
Anti-Analysis Removal - Strips tamper detection and anti-debugging code to enable deeper analysis of instructions.
Binary Pattern Matching - Identifies protection tools by matching specific byte patterns within binary metadata.
Dynamic Binary Decryption - Executes decryption methods from loaded assemblies to replace encrypted calls with plain text.
Dynamic String Decryption - Executes decryption methods from a loaded assembly to replace encrypted string calls with plain-text values.
Malware Analysis - Strips anti-debugging and anti-analysis protections to reveal the actual behavior of programs.
Obfuscated Data Decryption - Decrypts strings, constants, and embedded files using static and dynamic analysis to reveal original values.
Obfuscator Detection - Identifies the specific protection tool used on an assembly by matching byte patterns and structural markers.
Symbol Renamers - Tracks and replaces obfuscated identifiers with human-readable names while maintaining references.
Game Hacking Tools - Deobfuscator and unpacker for .NET assemblies.
Reverse Engineering Tools - Deobfuscates and unpacks .NET assemblies.
Unpacking and Deobfuscation - .NET deobfuscator and unpacker.
Blue Team Tools - .NET deobfuscator.
Deobfuscation - Deobfuscates and unpacks .NET assemblies.

Open-Source-Alternativen zu De4dot

Ähnliche Open-Source-Projekte, sortiert nach der Anzahl der gemeinsamen Funktionen mit De4dot.

de4dot/de4dot
de4dot/de4dot
7,428Auf GitHub ansehen
de4dot is a .NET deobfuscator and unpacker designed to reverse obfuscation and restore readable code and metadata within .NET assemblies. It functions as a bytecode analyzer that simplifies control flow, strips anti-debugging protections, and extracts original payloads from packed executable wrappers. The project distinguishes itself through a modular deobfuscation pipeline and a sandbox environment used for dynamic string decryption, which executes decryption methods to replace encrypted strings with plain-text values. It can identify specific obfuscation tools through pattern-based binary a
C#
Auf GitHub ansehen7,428
extremecoders-re/pyinstxtractor
extremecoders-re/pyinstxtractor
4,119Auf GitHub ansehen
pyinstxtractor is a PyInstaller executable unpacker and Python bytecode recovery tool. It functions as a helper for decompiling compiled Python binaries by extracting bundled binaries and bytecode from executables created with PyInstaller. The project includes a bytecode decryptor to remove encryption from extracted files and a header repair tool that restores corrupted headers. These capabilities ensure that extracted compiled files are compatible with bytecode decompilation software. The utility covers reverse engineering of Python applications, supporting malware analysis workflows throug
Pythondecompilepycpyc-files
Auf GitHub ansehen4,119
mandiant/flare-floss
mandiant/flare-floss
3,886Auf GitHub ansehen
Flare-floss is a security utility and static binary string extractor designed to uncover hidden text and configuration data within compiled binaries. It functions as an obfuscated string decoder and reverse engineering tool to translate encoded strings into readable text for security auditing. The project employs emulated execution to capture the decrypted state of strings in memory by running small chunks of binary code in a virtual CPU. It further utilizes static analysis disassembly, intermediate representation analysis, and heuristic-based pattern matching to identify and decode strings t
Pythondeobfuscationflaregsoc-2026
Auf GitHub ansehen3,886
hasherezade/pe-sieve
hasherezade/pe-sieve
3,559Auf GitHub ansehen
pe-sieve is a set of diagnostic tools for scanning Windows process memory to identify malicious implants, shellcode, and hooks. It functions as an in-memory implant detector, malware unpacker, and process callstack analyzer designed to locate and dump memory patches and injected code from running processes. The project identifies advanced evasion techniques, such as process hollowing and reflective injection, by verifying portable executable structures in memory. It distinguishes itself by analyzing process callstacks to detect anomalies and redirections and by reconstructing executable heade
C++anti-malwarehookinglibpeconv
Auf GitHub ansehen3,559

Alle 30 Alternativen zu De4dot anzeigen

Häufig gestellte Fragen

Was macht 0xd4d/de4dot?

Was sind die Hauptfunktionen von 0xd4d/de4dot?

Die Hauptfunktionen von 0xd4d/de4dot sind: Deobfuscation Tools, .NET Assembly Deobfuscation, Metadata Restoration, Binary Unpacking, Control Flow Simplification, .NET Assembly Analysis, .NET Reverse Engineering, .NET String Decryption.

Welche Open-Source-Alternativen gibt es zu 0xd4d/de4dot?

Open-Source-Alternativen zu 0xd4d/de4dot sind unter anderem: de4dot/de4dot — de4dot is a .NET deobfuscator and unpacker designed to reverse obfuscation and restore readable code and metadata… extremecoders-re/pyinstxtractor — pyinstxtractor is a PyInstaller executable unpacker and Python bytecode recovery tool. It functions as a helper for… mandiant/flare-floss — Flare-floss is a security utility and static binary string extractor designed to uncover hidden text and configuration… hasherezade/pe-sieve — pe-sieve is a set of diagnostic tools for scanning Windows process memory to identify malicious implants, shellcode,… virustotal/yara — YARA is a pattern matching engine and binary analysis tool used to identify and classify malware samples. It functions… avast-tl/retdec — Retdec is an LLVM-based machine code decompiler and static binary analysis tool designed for binary reverse…