De4dot

de4dot is a .NET deobfuscator and unpacker designed to reverse obfuscation and restore readable code and metadata within .NET assemblies. It functions as a bytecode analyzer that simplifies control flow, strips anti-debugging protections, and extracts original payloads from packed executable wrappers.

The project distinguishes itself through a modular deobfuscation pipeline and a sandbox environment used for dynamic string decryption, which executes decryption methods to replace encrypted strings with plain-text values. It can identify specific obfuscation tools through pattern-based binary analysis and synchronize symbols across multiple assemblies to maintain consistent naming and linkage.

Its broader capabilities cover binary analysis and reverse engineering, including the removal of tamper detection mechanisms, the decryption of embedded assets, and the conversion of wrapped executables into standard formats. It also provides utilities for restoring readable symbols and reversing specific compression algorithms to retrieve original file content.

Features

.NET Reverse Engineering - Provides a comprehensive suite for analyzing and reconstructing .NET assemblies to recover source-level logic.
Bytecode Analysis Tools - Analyzes Common Intermediate Language bytecode to simplify control flow and remove junk instructions.
Binary Payload Extraction - Extracts original payloads and decrypts embedded assets from packed executable wrappers.
Wrapper Unpacking - Identifies and strips binary packing layers to recover original executable assemblies from embedded resources.
Reverse Engineering Tools - Provides a workflow to analyze internal binary logic by removing anti-debugging protections and decrypting strings.

0xd4d/de4dot

7,426View on GitHub

de4dot is a .NET deobfuscator, unpacker, and assembly analysis tool. It is designed to remove obfuscation layers, restore metadata, and simplify bytecode control flow to transform protected binaries back into human-readable code. The project features specialized systems for decrypting strings and constants using both static and dynamic analysis. It identifies specific protection tools through pattern-based detection and strips anti-analysis protections, such as tamper detection and anti-debugging code. The tool provides a suite of reverse engineering capabilities, including binary wrapper un

mandiant/flare-floss

3,886View on GitHub

Flare-floss is a security utility and static binary string extractor designed to uncover hidden text and configuration data within compiled binaries. It functions as an obfuscated string decoder and reverse engineering tool to translate encoded strings into readable text for security auditing. The project employs emulated execution to capture the decrypted state of strings in memory by running small chunks of binary code in a virtual CPU. It further utilizes static analysis disassembly, intermediate representation analysis, and heuristic-based pattern matching to identify and decode strings t

pxb1988/dex2jar

13,112View on GitHub

dex2jar is an Android dex decompiler and reverse engineering tool designed to convert Dalvik executable bytecode into Java class files. It functions as a bytecode converter that transforms compiled Android binaries into a format compatible with standard Java analysis tools. The project facilitates Android app decompilation and Java bytecode recovery by translating executable files into readable structures. This allows for the analysis of application logic and the identification of security vulnerabilities or malicious behavior during Android malware analysis. The tool performs static bytecod

JetBrains/fernflower

4,169View on GitHub

Fernflower is a Java bytecode decompiler designed to convert compiled Java class files back into human-readable source code. It functions as a bytecode analysis tool that recovers original program logic and structure from compiled binaries. The project includes capabilities for obfuscated identifier resolution to rename ambiguous member elements, ensuring clear identifiers in the resulting source. These features support the analysis of obfuscated code, legacy code recovery, and Java malware analysis for security auditing. The system utilizes a structural analysis pipeline that includes contr

de4dotde4dotArchived

Features