de4dot is a .NET deobfuscator, unpacker, and assembly analysis tool. It is designed to remove obfuscation layers, restore metadata, and simplify bytecode control flow to transform protected binaries back into human-readable code. The project features specialized systems for decrypting strings and constants using both static and dynamic analysis. It identifies specific protection tools through pattern-based detection and strips anti-analysis protections, such as tamper detection and anti-debugging code. The tool provides a suite of reverse engineering capabilities, including binary wrapper un
Detect-It-Easy is a binary file identifier and analysis toolkit designed to determine file formats, compilers, and packers. It functions as a binary file identifier that utilizes signature matching and heuristic analysis to identify executable and archive formats. The project includes a custom file signature engine and a scriptable rule system for defining and applying detection logic to identify specific binary patterns. It features specialized detectors for Android packages, such as APK and DEX files, and a malware packer detector to identify protections, obfuscators, and virus families. T
Recaf is a suite of specialized tools for assembling, editing, deobfuscating, decompiling, and instrumenting Java bytecode and runtime processes. It provides a coordinated environment for modifying compiled Java class files and analyzing the behavior of Java applications. The project distinguishes itself through a multi-level abstraction layer that allows for editing across different formats and a pluggable framework that routes bytecode through multiple configurable decompilation engines. It includes an embedded scripting engine and plugin architecture to automate repetitive tasks and extend
Behavior based monitoring and hunting tool built in C# leveraging ETW tracing. Blue teamers can use this tool to detect and respond to potential Cobalt Strike beacons. Red teamers can use this tool to research ETW bypasses and discover new processes that behave like beacons.
Agile - ArchangelCloak - Atomic - AutoIt - Autori Obfuscator - Babel - BoxedAppPacker - BytePress - Beebyte - Confuser 1.9 - ConfuserEx - Crypto Obfuscator - Cypher - DCNETProtector - De4dot - DNGuard - DotnetPatcher - DotNetCompressor - DotRefiner - DotWall - Dumper - Eazfuscator - Habib -…
The main features of notprab/.net-deobfuscator are: Unpacking and Deobfuscation, Blue Team Tools.
Open-source alternatives to notprab/.net-deobfuscator include: 0xd4d/de4dot — de4dot is a .NET deobfuscator, unpacker, and assembly analysis tool. It is designed to remove obfuscation layers,… col-e/recaf — Recaf is a suite of specialized tools for assembling, editing, deobfuscating, decompiling, and instrumenting Java… horsicq/detect-it-easy — Detect-It-Easy is a binary file identifier and analysis toolkit designed to determine file formats, compilers, and… 3lp4tr0n/beaconhunter — Behavior based monitoring and hunting tool built in C# leveraging ETW tracing. Blue teamers can use this tool to… cisagov/sparrow — Sparrow.ps1 was created by CISA's Cloud Forensics team to help detect possible compromised accounts and applications… ccob/beaconeye — BeaconEye scans running processes for active CobaltStrike beacons. When processes are found to be running beacon,…