De4dot

de4dot is a .NET deobfuscator, unpacker, and assembly analysis tool. It is designed to remove obfuscation layers, restore metadata, and simplify bytecode control flow to transform protected binaries back into human-readable code.

The project features specialized systems for decrypting strings and constants using both static and dynamic analysis. It identifies specific protection tools through pattern-based detection and strips anti-analysis protections, such as tamper detection and anti-debugging code.

The tool provides a suite of reverse engineering capabilities, including binary wrapper unpacking, symbol renaming, and the repair of invalid intermediate language instructions. It also includes automation for recursive batch processing across directory trees.

Features

Deobfuscation Tools - Provides specialized tools for restoring readability to obfuscated .NET assemblies through the removal of protection layers.

.NET Assembly Deobfuscation - Core purpose is decrypting strings and simplifying control flow in obfuscated .NET code.

Metadata Restoration - Fixes verifiable code and preserves assembly metadata to ensure compatibility with decompilers.

Binary Unpacking - Extracts embedded assemblies from protective outer shells and strips junk classes to expose original bytecode.

Control Flow Simplification - Removes proxy methods and inlines split functions to restore the original logical execution path of the bytecode.

.NET Assembly Analysis - Detects obfuscators and analyzes .NET binary structure without modifying files.

.NET Reverse Engineering - Analyzes protected .NET assemblies by removing obfuscation layers to restore source code.

.NET String Decryption - Identifies and replaces encrypted strings and constants using static and dynamic analysis.

Symbol Restoration - Renames obfuscated symbols to human-readable strings and restores field types to make the binary logic easier to follow.

Control Flow Simplification - Simplifies bytecode control flow by removing proxy methods and inlining split functions.

CIL Simplification - Removes proxy methods and inlines split code to restore original .NET bytecode execution paths.

Bytecode Repair - Corrects buggy intermediate language instructions that cause verification errors to ensure the assembly is structurally sound.

Binary Cleaning - Cleans and fixes buggy intermediate language instructions to ensure compatibility with analysis tools.

Metadata Preservation - Retains critical assembly metadata tokens and signature data to ensure compatibility with specialized analysis tools.

Static Binary Analysis - Reveals original constants and embedded files by analyzing the binary without execution.

Bytecode Repair - Corrects invalid or buggy bytecode instructions to ensure assemblies pass structural verification.

Anti-Analysis Removal - Strips tamper detection and anti-debugging code to enable deeper analysis of instructions.

Binary Pattern Matching - Identifies protection tools by matching specific byte patterns within binary metadata.

Dynamic Binary Decryption - Executes decryption methods from loaded assemblies to replace encrypted calls with plain text.

Dynamic String Decryption - Executes decryption methods from a loaded assembly to replace encrypted string calls with plain-text values.

Malware Analysis - Strips anti-debugging and anti-analysis protections to reveal the actual behavior of programs.

Obfuscated Data Decryption - Decrypts strings, constants, and embedded files using static and dynamic analysis to reveal original values.

Obfuscator Detection - Identifies the specific protection tool used on an assembly by matching byte patterns and structural markers.

Symbol Renamers - Tracks and replaces obfuscated identifiers with human-readable names while maintaining references.

Reverse Engineering Tools - Deobfuscates and unpacks .NET assemblies.

Unpacking and Deobfuscation - .NET deobfuscator and unpacker.

Deobfuscation - Deobfuscates and unpacks .NET assemblies.

0xd4dde4dotArchived

Features

Star history