De4dot

Features

Deobfuscation Tools - Provides specialized tools for restoring readability to obfuscated .NET assemblies through the removal of protection layers.
.NET Assembly Deobfuscation - Core purpose is decrypting strings and simplifying control flow in obfuscated .NET code.
Metadata Restoration - Fixes verifiable code and preserves assembly metadata to ensure compatibility with decompilers.
Binary Unpacking - Extracts embedded assemblies from protective outer shells and strips junk classes to expose original bytecode.
Control Flow Simplification - Removes proxy methods and inlines split functions to restore the original logical execution path of the bytecode.
.NET Assembly Analysis - Detects obfuscators and analyzes .NET binary structure without modifying files.
.NET Reverse Engineering - Analyzes protected .NET assemblies by removing obfuscation layers to restore source code.
.NET String Decryption - Identifies and replaces encrypted strings and constants using static and dynamic analysis.
Symbol Restoration - Renames obfuscated symbols to human-readable strings and restores field types to make the binary logic easier to follow.
Control Flow Simplification - Simplifies bytecode control flow by removing proxy methods and inlining split functions.
CIL Simplification - Removes proxy methods and inlines split code to restore original .NET bytecode execution paths.
Bytecode Repair - Corrects buggy intermediate language instructions that cause verification errors to ensure the assembly is structurally sound.
Binary Cleaning - Cleans and fixes buggy intermediate language instructions to ensure compatibility with analysis tools.
Metadata Preservation - Retains critical assembly metadata tokens and signature data to ensure compatibility with specialized analysis tools.
Static Binary Analysis - Reveals original constants and embedded files by analyzing the binary without execution.
Bytecode Repair - Corrects invalid or buggy bytecode instructions to ensure assemblies pass structural verification.
Anti-Analysis Removal - Strips tamper detection and anti-debugging code to enable deeper analysis of instructions.
Binary Pattern Matching - Identifies protection tools by matching specific byte patterns within binary metadata.
Dynamic Binary Decryption - Executes decryption methods from loaded assemblies to replace encrypted calls with plain text.
Dynamic String Decryption - Executes decryption methods from a loaded assembly to replace encrypted string calls with plain-text values.
Malware Analysis - Strips anti-debugging and anti-analysis protections to reveal the actual behavior of programs.
Obfuscated Data Decryption - Decrypts strings, constants, and embedded files using static and dynamic analysis to reveal original values.
Obfuscator Detection - Identifies the specific protection tool used on an assembly by matching byte patterns and structural markers.
Symbol Renamers - Tracks and replaces obfuscated identifiers with human-readable names while maintaining references.
Game Hacking Tools - Deobfuscator and unpacker for .NET assemblies.
Reverse Engineering Tools - Deobfuscates and unpacks .NET assemblies.
Unpacking and Deobfuscation - .NET deobfuscator and unpacker.
Deobfuscation - Deobfuscates and unpacks .NET assemblies.

Open-source alternatives to De4dot

Similar open-source projects, ranked by how many features they share with De4dot.

de4dot/de4dot
de4dot/de4dot
7,428View on GitHub
de4dot is a .NET deobfuscator and unpacker designed to reverse obfuscation and restore readable code and metadata within .NET assemblies. It functions as a bytecode analyzer that simplifies control flow, strips anti-debugging protections, and extracts original payloads from packed executable wrappers. The project distinguishes itself through a modular deobfuscation pipeline and a sandbox environment used for dynamic string decryption, which executes decryption methods to replace encrypted strings with plain-text values. It can identify specific obfuscation tools through pattern-based binary a
C#
View on GitHub7,428
extremecoders-re/pyinstxtractor
extremecoders-re/pyinstxtractor
4,119View on GitHub
pyinstxtractor is a PyInstaller executable unpacker and Python bytecode recovery tool. It functions as a helper for decompiling compiled Python binaries by extracting bundled binaries and bytecode from executables created with PyInstaller. The project includes a bytecode decryptor to remove encryption from extracted files and a header repair tool that restores corrupted headers. These capabilities ensure that extracted compiled files are compatible with bytecode decompilation software. The utility covers reverse engineering of Python applications, supporting malware analysis workflows throug
Pythondecompilepycpyc-files
View on GitHub4,119
mandiant/flare-floss
mandiant/flare-floss
3,886View on GitHub
Flare-floss is a security utility and static binary string extractor designed to uncover hidden text and configuration data within compiled binaries. It functions as an obfuscated string decoder and reverse engineering tool to translate encoded strings into readable text for security auditing. The project employs emulated execution to capture the decrypted state of strings in memory by running small chunks of binary code in a virtual CPU. It further utilizes static analysis disassembly, intermediate representation analysis, and heuristic-based pattern matching to identify and decode strings t
Pythondeobfuscationflaregsoc-2026
View on GitHub3,886
virustotal/yara
VirusTotal/yara
9,420View on GitHub
YARA is a pattern matching engine and binary analysis tool used to identify and classify malware samples. It functions as a malware research framework that allows for the definition of file descriptions and detection rules to find indicators of compromise within binaries. The system enables the creation of custom detection rules using strings, wildcards, and regular expressions. These rules use boolean logic to match textual or binary patterns, allowing for the classification of files into specific malware families and the automation of threat intelligence. The engine utilizes Aho-Corasick s
Cyara
View on GitHub9,420

See all 30 alternatives to De4dot

0xd4dde4dotArchived

Features

Open-source alternatives to De4dot

de4dot/de4dot

extremecoders-re/pyinstxtractor

mandiant/flare-floss

VirusTotal/yara

Star history

Open-source alternatives to De4dot

de4dot/de4dot

extremecoders-re/pyinstxtractor

mandiant/flare-floss

VirusTotal/yara