de4dot 反混淆

de4dot

.NET deobfuscator and unpacker.

Description

de4dot is an open source (GPLv3) .NET deobfuscator and unpacker written in C#.

It will try its best to restore a packed and obfuscated assembly to almost the original assembly.

Most of the obfuscation can be completely restored (eg. string encryption), but symbol renaming is impossible to restore since the original names aren't (usually) part of the obfuscated assembly.

It uses dnlib to read and write assemblies so make sure you get it or it won't compile.

Supported obfuscators/packers

以下工具支持反混淆

• Agile.NET (aka CliSecure)
• Babel.NET
• CodeFort
• CodeVeil
• CodeWall
• CryptoObfuscator
• DeepSea Obfuscator
• Dotfuscator
• .NET Reactor
• Eazfuscator.NET
• Goliath.NET
• ILProtector
• MaxtoCode
• MPRESS
• Rummage
• Skater.NET
• SmartAssembly
• Spices.Net
• Xenocode

Some of the above obfuscators are rarely used (eg. Goliath.NET), so they have had much less testing. Help me out by reporting bugs or problems you find.

How to use de4dot

N00b users

Drag and drop the file(s) onto de4dot.exe and wait a few seconds.

de4dot v3.1.41592.3405 Copyright (C) 2011-2015 de4dot@gmail.com
Latest version and source code: https://github.com/0xd4d/de4dot

Detected Unknown Obfuscator (C:\workspace\clu\Downloads\de4dot-net35\Hearthbuddy.exe)
Cleaning C:\workspace\clu\Downloads\de4dot-net35\Hearthbuddy.exe
WARNING: File 'C:\workspace\clu\Downloads\de4dot-net35\Hearthbuddy.exe' contains XAML which isn't supported. Use --dont-rename.
Renaming all obfuscated symbols
Saving C:\workspace\clu\Downloads\de4dot-net35\Hearthbuddy-cleaned.exe

Press any key to exit...

de4dot参数详解