De4dot

de4dot is a .NET deobfuscator, unpacker, and assembly analysis tool. It is designed to remove obfuscation layers, restore metadata, and simplify bytecode control flow to transform protected binaries back into human-readable code.

The project features specialized systems for decrypting strings and constants using both static and dynamic analysis. It identifies specific protection tools through pattern-based detection and strips anti-analysis protections, such as tamper detection and anti-debugging code.

The tool provides a suite of reverse engineering capabilities, including binary wrapper unpacking, symbol renaming, and the repair of invalid intermediate language instructions. It also includes automation for recursive batch processing across directory trees.

Features

Deobfuscation Tools - Provides specialized tools for restoring readability to obfuscated .NET assemblies through the removal of protection layers.
.NET Assembly Deobfuscation - Core purpose is decrypting strings and simplifying control flow in obfuscated .NET code.
Metadata Restoration - Fixes verifiable code and preserves assembly metadata to ensure compatibility with decompilers.
Binary Unpacking - Extracts embedded assemblies from protective outer shells and strips junk classes to expose original bytecode.
Control Flow Simplification - Removes proxy methods and inlines split functions to restore the original logical execution path of the bytecode.
.NET Assembly Analysis - Detects obfuscators and analyzes .NET binary structure without modifying files.
.NET Reverse Engineering - Analyzes protected .NET assemblies by removing obfuscation layers to restore source code.
.NET String Decryption - Identifies and replaces encrypted strings and constants using static and dynamic analysis.
Symbol Restoration - Renames obfuscated symbols to human-readable strings and restores field types to make the binary logic easier to follow.
Control Flow Simplification - Simplifies bytecode control flow by removing proxy methods and inlining split functions.
CIL Simplification - Removes proxy methods and inlines split code to restore original .NET bytecode execution paths.
Bytecode Repair - Corrects buggy intermediate language instructions that cause verification errors to ensure the assembly is structurally sound.
Binary Cleaning - Cleans and fixes buggy intermediate language instructions to ensure compatibility with analysis tools.
Metadata Preservation - Retains critical assembly metadata tokens and signature data to ensure compatibility with specialized analysis tools.
Static Binary Analysis - Reveals original constants and embedded files by analyzing the binary without execution.
Bytecode Repair - Corrects invalid or buggy bytecode instructions to ensure assemblies pass structural verification.
Anti-Analysis Removal - Strips tamper detection and anti-debugging code to enable deeper analysis of instructions.
Binary Pattern Matching - Identifies protection tools by matching specific byte patterns within binary metadata.
Dynamic Binary Decryption - Executes decryption methods from loaded assemblies to replace encrypted calls with plain text.
Dynamic String Decryption - Executes decryption methods from a loaded assembly to replace encrypted string calls with plain-text values.
Malware Analysis - Strips anti-debugging and anti-analysis protections to reveal the actual behavior of programs.
Obfuscated Data Decryption - Decrypts strings, constants, and embedded files using static and dynamic analysis to reveal original values.
Obfuscator Detection - Identifies the specific protection tool used on an assembly by matching byte patterns and structural markers.
Symbol Renamers - Tracks and replaces obfuscated identifiers with human-readable names while maintaining references.
Game Hacking Tools - Deobfuscator and unpacker for .NET assemblies.
Reverse Engineering Tools - Deobfuscates and unpacks .NET assemblies.
Unpacking and Deobfuscation - .NET deobfuscator and unpacker.
Blue Team Tools - .NET deobfuscator.
Deobfuscation - Deobfuscates and unpacks .NET assemblies.

Star 历史

0xd4dde4dotArchived

Name: 0xd4d/de4dot
Author: 0xd4d

View on GitHub

7,426 星标2,808 分支C#GPL-3.011 次浏览

De4dot

Features

Deobfuscation Tools - Provides specialized tools for restoring readability to obfuscated .NET assemblies through the removal of protection layers.
.NET Assembly Deobfuscation - Core purpose is decrypting strings and simplifying control flow in obfuscated .NET code.
Metadata Restoration - Fixes verifiable code and preserves assembly metadata to ensure compatibility with decompilers.
Binary Unpacking - Extracts embedded assemblies from protective outer shells and strips junk classes to expose original bytecode.
Control Flow Simplification - Removes proxy methods and inlines split functions to restore the original logical execution path of the bytecode.
.NET Assembly Analysis - Detects obfuscators and analyzes .NET binary structure without modifying files.
.NET Reverse Engineering - Analyzes protected .NET assemblies by removing obfuscation layers to restore source code.
.NET String Decryption - Identifies and replaces encrypted strings and constants using static and dynamic analysis.
Symbol Restoration - Renames obfuscated symbols to human-readable strings and restores field types to make the binary logic easier to follow.
Control Flow Simplification - Simplifies bytecode control flow by removing proxy methods and inlining split functions.
CIL Simplification - Removes proxy methods and inlines split code to restore original .NET bytecode execution paths.
Bytecode Repair - Corrects buggy intermediate language instructions that cause verification errors to ensure the assembly is structurally sound.
Binary Cleaning - Cleans and fixes buggy intermediate language instructions to ensure compatibility with analysis tools.
Metadata Preservation - Retains critical assembly metadata tokens and signature data to ensure compatibility with specialized analysis tools.
Static Binary Analysis - Reveals original constants and embedded files by analyzing the binary without execution.
Bytecode Repair - Corrects invalid or buggy bytecode instructions to ensure assemblies pass structural verification.
Anti-Analysis Removal - Strips tamper detection and anti-debugging code to enable deeper analysis of instructions.
Binary Pattern Matching - Identifies protection tools by matching specific byte patterns within binary metadata.
Dynamic Binary Decryption - Executes decryption methods from loaded assemblies to replace encrypted calls with plain text.
Dynamic String Decryption - Executes decryption methods from a loaded assembly to replace encrypted string calls with plain-text values.
Malware Analysis - Strips anti-debugging and anti-analysis protections to reveal the actual behavior of programs.
Obfuscated Data Decryption - Decrypts strings, constants, and embedded files using static and dynamic analysis to reveal original values.
Obfuscator Detection - Identifies the specific protection tool used on an assembly by matching byte patterns and structural markers.
Symbol Renamers - Tracks and replaces obfuscated identifiers with human-readable names while maintaining references.
Game Hacking Tools - Deobfuscator and unpacker for .NET assemblies.
Reverse Engineering Tools - Deobfuscates and unpacks .NET assemblies.
Unpacking and Deobfuscation - .NET deobfuscator and unpacker.
Blue Team Tools - .NET deobfuscator.
Deobfuscation - Deobfuscates and unpacks .NET assemblies.

De4dot 的开源替代方案

相似的开源项目，按与 De4dot 的功能重合度排序。

de4dot/de4dot
de4dot/de4dot
7,428在 GitHub 上查看
de4dot is a .NET deobfuscator and unpacker designed to reverse obfuscation and restore readable code and metadata within .NET assemblies. It functions as a bytecode analyzer that simplifies control flow, strips anti-debugging protections, and extracts original payloads from packed executable wrappers. The project distinguishes itself through a modular deobfuscation pipeline and a sandbox environment used for dynamic string decryption, which executes decryption methods to replace encrypted strings with plain-text values. It can identify specific obfuscation tools through pattern-based binary a
C#
在 GitHub 上查看7,428
extremecoders-re/pyinstxtractor
extremecoders-re/pyinstxtractor
4,119在 GitHub 上查看
pyinstxtractor is a PyInstaller executable unpacker and Python bytecode recovery tool. It functions as a helper for decompiling compiled Python binaries by extracting bundled binaries and bytecode from executables created with PyInstaller. The project includes a bytecode decryptor to remove encryption from extracted files and a header repair tool that restores corrupted headers. These capabilities ensure that extracted compiled files are compatible with bytecode decompilation software. The utility covers reverse engineering of Python applications, supporting malware analysis workflows throug
Pythondecompilepycpyc-files
在 GitHub 上查看4,119
mandiant/flare-floss
mandiant/flare-floss
3,886在 GitHub 上查看
Flare-floss is a security utility and static binary string extractor designed to uncover hidden text and configuration data within compiled binaries. It functions as an obfuscated string decoder and reverse engineering tool to translate encoded strings into readable text for security auditing. The project employs emulated execution to capture the decrypted state of strings in memory by running small chunks of binary code in a virtual CPU. It further utilizes static analysis disassembly, intermediate representation analysis, and heuristic-based pattern matching to identify and decode strings t
Pythondeobfuscationflaregsoc-2026
在 GitHub 上查看3,886

常见问题解答

0xd4d/de4dot 是做什么的？

0xd4d/de4dot 的主要功能有哪些？

0xd4d/de4dot 的主要功能包括：Deobfuscation Tools, .NET Assembly Deobfuscation, Metadata Restoration, Binary Unpacking, Control Flow Simplification, .NET Assembly Analysis, .NET Reverse Engineering, .NET String Decryption。

0xd4d/de4dot 有哪些开源替代品？

0xd4d/de4dot 的开源替代品包括： de4dot/de4dot — de4dot is a .NET deobfuscator and unpacker designed to reverse obfuscation and restore readable code and metadata… extremecoders-re/pyinstxtractor — pyinstxtractor is a PyInstaller executable unpacker and Python bytecode recovery tool. It functions as a helper for… mandiant/flare-floss — Flare-floss is a security utility and static binary string extractor designed to uncover hidden text and configuration… hasherezade/pe-sieve — pe-sieve is a set of diagnostic tools for scanning Windows process memory to identify malicious implants, shellcode,… virustotal/yara — YARA is a pattern matching engine and binary analysis tool used to identify and classify malware samples. It functions… avast-tl/retdec — Retdec is an LLVM-based machine code decompiler and static binary analysis tool designed for binary reverse…