awesome-repositories.com
Blog
MCP
awesome-repositories.com

Discover the best open-source repositories with AI-powered search.

ExploreCurated searchesOpen-source alternativesSelf-hosted softwareBlogSitemap
ProjectMCP serverAboutHow we rankPress
LegalPrivacyTerms
© 2026 Bringes Technology SRL·VAT RO45896025·hello@awesome-repositories.com
0xd4d avatar

0xd4d/de4dotArchived

0
View on GitHub↗
7,426 stars·2,808 forks·C#·GPL-3.0·38 views

De4dot

de4dot is a .NET deobfuscator, unpacker, and assembly analysis tool. It is designed to remove obfuscation layers, restore metadata, and simplify bytecode control flow to transform protected binaries back into human-readable code.

The project features specialized systems for decrypting strings and constants using both static and dynamic analysis. It identifies specific protection tools through pattern-based detection and strips anti-analysis protections, such as tamper detection and anti-debugging code.

The tool provides a suite of reverse engineering capabilities, including binary wrapper unpacking, symbol renaming, and the repair of invalid intermediate language instructions. It also includes automation for recursive batch processing across directory trees.

Features

  • Deobfuscation Tools - Provides specialized tools for restoring readability to obfuscated .NET assemblies through the removal of protection layers.
  • .NET Assembly Deobfuscation - Core purpose is decrypting strings and simplifying control flow in obfuscated .NET code.
  • Metadata Restoration - Fixes verifiable code and preserves assembly metadata to ensure compatibility with decompilers.
  • Binary Unpacking - Extracts embedded assemblies from protective outer shells and strips junk classes to expose original bytecode.
  • Control Flow Simplification - Removes proxy methods and inlines split functions to restore the original logical execution path of the bytecode.
  • .NET Assembly Analysis - Detects obfuscators and analyzes .NET binary structure without modifying files.
  • .NET Reverse Engineering - Analyzes protected .NET assemblies by removing obfuscation layers to restore source code.
  • .NET String Decryption - Identifies and replaces encrypted strings and constants using static and dynamic analysis.
  • Symbol Restoration - Renames obfuscated symbols to human-readable strings and restores field types to make the binary logic easier to follow.
  • Control Flow Simplification - Simplifies bytecode control flow by removing proxy methods and inlining split functions.
  • CIL Simplification - Removes proxy methods and inlines split code to restore original .NET bytecode execution paths.
  • Bytecode Repair - Corrects buggy intermediate language instructions that cause verification errors to ensure the assembly is structurally sound.
  • Binary Cleaning - Cleans and fixes buggy intermediate language instructions to ensure compatibility with analysis tools.
  • Metadata Preservation - Retains critical assembly metadata tokens and signature data to ensure compatibility with specialized analysis tools.
  • Static Binary Analysis - Reveals original constants and embedded files by analyzing the binary without execution.
  • Bytecode Repair - Corrects invalid or buggy bytecode instructions to ensure assemblies pass structural verification.
  • Anti-Analysis Removal - Strips tamper detection and anti-debugging code to enable deeper analysis of instructions.
  • Binary Pattern Matching - Identifies protection tools by matching specific byte patterns within binary metadata.
  • Dynamic Binary Decryption - Executes decryption methods from loaded assemblies to replace encrypted calls with plain text.
  • Dynamic String Decryption - Executes decryption methods from a loaded assembly to replace encrypted string calls with plain-text values.
  • Malware Analysis - Strips anti-debugging and anti-analysis protections to reveal the actual behavior of programs.
  • Obfuscated Data Decryption - Decrypts strings, constants, and embedded files using static and dynamic analysis to reveal original values.
  • Obfuscator Detection - Identifies the specific protection tool used on an assembly by matching byte patterns and structural markers.
  • Symbol Renamers - Tracks and replaces obfuscated identifiers with human-readable names while maintaining references.
  • Game Hacking Tools - Deobfuscator and unpacker for .NET assemblies.
  • Reverse Engineering Tools - Deobfuscates and unpacks .NET assemblies.
  • Unpacking and Deobfuscation - .NET deobfuscator and unpacker.
  • Blue Team Tools - .NET deobfuscator.
  • Deobfuscation - Deobfuscates and unpacks .NET assemblies.

Star history

Star history chart for 0xd4d/de4dotStar history chart for 0xd4d/de4dot

How this analysis was created: This summary and feature list are AI-generated from collected project material and can contain mistakes. Stars, license and language are imported from GitHub. Inclusion does not mean that we have tested or audited this project. Check the source documentation for any feature you depend on. Learn more on our About page.

AI search

Explore more awesome repositories

Describe what you need in plain English — the AI ranks thousands of curated open-source projects by relevance.

Start searching with AI

Projects sharing features with De4dot

These projects share indexed features with De4dot. Shared tags can include platform or build tooling; verify the primary use case before treating a result as a replacement.
  • de4dot/de4dotde4dot avatar

    de4dot/de4dot

    7,428View on GitHub↗

    de4dot is a .NET deobfuscator and unpacker designed to reverse obfuscation and restore readable code and metadata within .NET assemblies. It functions as a bytecode analyzer that simplifies control flow, strips anti-debugging protections, and extracts original payloads from packed executable wrappers. The project distinguishes itself through a modular deobfuscation pipeline and a sandbox environment used for dynamic string decryption, which executes decryption methods to replace encrypted strings with plain-text values. It can identify specific obfuscation tools through pattern-based binary a

    C#
    View on GitHub↗7,428
  • extremecoders-re/pyinstxtractorextremecoders-re avatar

    extremecoders-re/pyinstxtractor

    4,119View on GitHub↗

    pyinstxtractor is a PyInstaller executable unpacker and Python bytecode recovery tool. It functions as a helper for decompiling compiled Python binaries by extracting bundled binaries and bytecode from executables created with PyInstaller. The project includes a bytecode decryptor to remove encryption from extracted files and a header repair tool that restores corrupted headers. These capabilities ensure that extracted compiled files are compatible with bytecode decompilation software. The utility covers reverse engineering of Python applications, supporting malware analysis workflows throug

    Pythondecompilepycpyc-files
    View on GitHub↗4,119
  • mandiant/flare-flossmandiant avatar

    mandiant/flare-floss

    3,886View on GitHub↗

    Flare-floss is a security utility and static binary string extractor designed to uncover hidden text and configuration data within compiled binaries. It functions as an obfuscated string decoder and reverse engineering tool to translate encoded strings into readable text for security auditing. The project employs emulated execution to capture the decrypted state of strings in memory by running small chunks of binary code in a virtual CPU. It further utilizes static analysis disassembly, intermediate representation analysis, and heuristic-based pattern matching to identify and decode strings t

    Pythondeobfuscationflaregsoc-2026
    View on GitHub↗3,886
  • hasherezade/pe-sievehasherezade avatar

    hasherezade/pe-sieve

    3,559View on GitHub↗

    pe-sieve is a set of diagnostic tools for scanning Windows process memory to identify malicious implants, shellcode, and hooks. It functions as an in-memory implant detector, malware unpacker, and process callstack analyzer designed to locate and dump memory patches and injected code from running processes. The project identifies advanced evasion techniques, such as process hollowing and reflective injection, by verifying portable executable structures in memory. It distinguishes itself by analyzing process callstacks to detect anomalies and redirections and by reconstructing executable heade

    C++anti-malwarehookinglibpeconv
    View on GitHub↗3,559
Compare all 30 related projects→

Frequently asked questions

What does 0xd4d/de4dot do?

de4dot is a .NET deobfuscator, unpacker, and assembly analysis tool. It is designed to remove obfuscation layers, restore metadata, and simplify bytecode control flow to transform protected binaries back into human-readable code.

What are the main features of 0xd4d/de4dot?

The main features of 0xd4d/de4dot are: Deobfuscation Tools, .NET Assembly Deobfuscation, Metadata Restoration, Binary Unpacking, Control Flow Simplification, .NET Assembly Analysis, .NET Reverse Engineering, .NET String Decryption.

Which projects share features with 0xd4d/de4dot?

Projects with overlapping indexed features include: de4dot/de4dot — de4dot is a .NET deobfuscator and unpacker designed to reverse obfuscation and restore readable code and metadata… extremecoders-re/pyinstxtractor — pyinstxtractor is a PyInstaller executable unpacker and Python bytecode recovery tool. It functions as a helper for… mandiant/flare-floss — Flare-floss is a security utility and static binary string extractor designed to uncover hidden text and configuration… hasherezade/pe-sieve — pe-sieve is a set of diagnostic tools for scanning Windows process memory to identify malicious implants, shellcode,… virustotal/yara — YARA is a pattern matching engine and binary analysis tool used to identify and classify malware samples. It functions… avast-tl/retdec — Retdec is an LLVM-based machine code decompiler and static binary analysis tool designed for binary reverse…