Exetools

Exetools (https://forum.exetools.com/index.php)
-   Community Tools (https://forum.exetools.com/forumdisplay.php?f=47)
-   -   de4dot - Deobfuscator for .NET (https://forum.exetools.com/showthread.php?t=13951)

mdj 12-22-2011 03:44

de4dot - Deobfuscator for .NET
 
This is a .NET deobfuscator by 0xd4d

https://bitbucket.org/0xd4d/de4dot
https://bitbucket.org/0xd4d/de4dot/downloads

It currently supports the following .NET obfuscators:

Babel.NET
CliSecure
CodeVeil
Crypto Obfuscator
DeepSea
Dotfuscator
Goliath.NET
.NET Reactor
Eazfuscator.NET
MaxtoCode
Skater.NET
SmartAssembly
Spices.Net
Xenocode


It has partial support for other obfuscators, but the result might not be runnable.

Depending on obfuscator, it will do one or more of the following:

Rename obfuscated symbols
Deobfuscate control flow
Decrypt strings
Decrypt and dump embedded assemblies
Decrypt resources
Decrypt methods
Fix proxy calls
Inline methods
Remove error reporting code (added exception handlers)
Restore field and method arg types
Get rid of added obfuscator classes and methods

sendersu 12-22-2011 04:29

why mediafire?

its open source, with full sources, take from the original point:

https://github.com/0xd4d/de4dot/downloads

mdj 12-22-2011 12:20

many time i see appropriate version not on site offline (many person use free server if server refuse then we cannot catch it so mirror is ok it's my opinion )
Best Regards
mdj

Av0id 12-22-2011 12:52

to download actual sources from debian/ubuntu:
Code:

sudo apt-get install git-core && cd ~ && mkdir de4dot-src && git clone git://github.com/0xd4d/de4dot.git de4dot-src

sendersu 12-22-2011 23:43

yeah, you are right, but take into account that github.com is not a personal server
it hosts thousands of projects all over the world (actually I guess it is a server farm, not a single server......)

beBoss 12-25-2011 06:04

de4dot-1.4.0.zip
Size: 1.0MB
Code:

https://github.com/downloads/0xd4d/de4dot/de4dot-1.4.0.zip

mdj 12-29-2011 18:41

de4dot-1.4.1
Binaries
de4dot-1.4.1.zip
source code
de4dot

D-Jester 01-31-2012 01:11

https://github.com/downloads/0xd4d/de4dot/de4dot-1.5.0.zip

GI4C4T 02-02-2012 00:54

Update ver 1.5.1
Code:

https://github.com/downloads/0xd4d/de4dot/de4dot-1.5.1.zip

sendersu 02-02-2012 03:32

I did not found any what was fixed page
anyone?

D-Jester 02-02-2012 06:41

https://github.com/0xd4d/de4dot

Av0id 02-02-2012 14:47

Quote:

Originally Posted by sendersu (Post 77308)
I did not found any what was fixed page
anyone?

you can find what was fixed here:
https://github.com/0xd4d/de4dot/commits/master

AFAIK latest SA deobfuscating was fixed

sendersu 02-16-2012 04:06

New version: 1.6.0 !!!
Added CodeVeil support (v3.2 - v5.0)
Added Spices.Net support
Fixed Mono.Cecil crash when methods contained encrypted instructions

where to get? see above link from D-Jester

sendersu 02-16-2012 04:28

wow, have you ever seen this super detection feature of de4dot?
its amazing:

de4dot.exe x.dll

de4dot v1.6.0.3405 Copyright (C) 2011-2012 de4dot@gmail.com
Latest version and source code: https://github.com/0xd4d/de4dot

More than one obfuscator detected:
.NET Reactor (use: -p dr4)
Eazfuscator.NET 2.9 (use: -p ef)
Detected Eazfuscator.NET 2.9 (x.dll)
Cleaning x.dll
Renaming all obfuscated symbols
Saving x.dll

JeRRy 03-09-2012 03:46

Quote:

New version: 1.7.0

* MaxtoCode is now supported
* Full Eazfuscator.NET support (static decryption of strings, assemblies, resources)
* Added CF 2.0 and 3.5 assembly search paths
Quote:

New version: 1.7.1

* Added support for latest Eazfuscator.NET (3.3)
* MaxtoCode name regex was updated
* Fixed two renamer bugs
DL: de4dot-1.7.1
https://github.com/downloads/0xd4d/d...4dot-1.7.1.zip

JeRRy 03-13-2012 06:36

Quote:

New version: 1.7.2

* Added support for a new Eazfuscator 3.3 version released 1-2 days ago
* Updated detection of SA v2 string decrypter
Download:
http://cloud.github.com/downloads/0xd4d/de4dot/de4dot-1.7.2.zip

JeRRy 03-16-2012 12:18

de4dot 1.7.3

Quote:

New version: 1.7.3

* Added support for latest Crypto Obfuscator 2012 version
* Added support for latest DeepSea 4.0.4 version
* Added support for latest Eazfuscator.NET version (3.3.136)
Download:
http://cloud.github.com/downloads/0xd4d/de4dot/de4dot-1.7.3.zip

@mdj
Can you please edit thread title to "de4dot - Deobfuscator for .NET" ?
Thanks

mdj 03-16-2012 23:00

de4dot - Deobfuscator for .NET
 
[QUOTE=
@mdj
Can you please edit thread title to "de4dot - Deobfuscator for .NET" ?
Thanks[/QUOTE]

bro i cannot edit thread i think JMI can do this
Best Regards
mdj

[Your wish is my command! ;) - Title changed as requested. JMI]

sendersu 03-17-2012 02:21

Someone knows the author of de4dot? he works like a devil, thats terrific, how one person could reverse the marjority, the huge number of the up-to-date .NET solutions.....
amazing
there is only one protector that is a hard nut for him for today... and it was here some time ago :)
I won't PR it, but you could find what is that

deepzero 03-17-2012 02:25

Quote:

I won't PR it
why not?

It`s a guy who goes by the name "0xd4d" on t4u.
http://forum.tuts4you.com/topic/27340-de4dot-deobfuscator-for-net/

amazing work indeed.

ZeNiX 03-19-2012 10:59

Quote:

Originally Posted by deepzero (Post 77953)
why not?

It`s a guy who goes by the name "0xd4d" on t4u.
http://forum.tuts4you.com/topic/27340-de4dot-deobfuscator-for-net/

amazing work indeed.

May we invite him to EXETOOLS?

Av0id 03-19-2012 13:31

also you can find him on portal.b-at-s.info

giv 03-19-2012 14:55

Quote:

Originally Posted by ZeNiX (Post 77970)
May we invite him to EXETOOLS?

I have made a proposal to him to join here.
I will wait for his option.

giv 03-20-2012 16:07

Invitation sent.

mdj 03-22-2012 00:34

good news 0xd4d here now
http://forum.exetools.com/member.php?u=36138

0xd4d 03-23-2012 17:33

New version: 1.7.4
  • Supports the latest Eazfuscator.NET version (3.3.143)
  • Supports Compact Framework assemblies obfuscated with Eazfuscator.NET
  • Supports Silverlight assemblies obfuscated with Eazfuscator.NET
  • Supports Silverlight assemblies obfuscated with DeepSea
  • Restores resource names ending in ".g.resources" (Spices.Net)
  • Some WinForm property names weren't restored. Now they are.
  • Added some more assembly search paths.

Downloads: https://github.com/0xd4d/de4dot/downloads

giv 03-23-2012 17:39

There you are...
Put the download link in the message please.
Welcome!
Enjoy your stay here!

0xd4d 04-15-2012 14:50

New version: 1.8.0
  • Supports CliSecure 6.0
    • Devirtualizes CSVM code
    • Dynamic decryption of methods encrypted with the new encryption algorithm
  • Supports the latest Eazfuscator.NET build
  • Supports the latest Crypto Obfuscator build
  • MaxtoCode
    • Supports the latest build
    • Decrypts encrypted strings
    • Better MC detection
  • Updated Skater.NET string decrypter

https://github.com/0xd4d/de4dot/downloads

0xd4d 04-16-2012 05:58

I'd edit my previous post if I could, but I can't...
1.8.1 adds support for the latest CO build that was released just after de4dot 1.8.0 was released. :)

KuNgBiM 05-08-2012 11:12

Hope to support Confuser

http://confuser.codeplex.com/releases/view/83914

Hope to support DNGuard HVM

http://www.dnguard.net

sf42 05-08-2012 13:24

How about deobfuscating nlite/vlite? Those are pretty much the only ones I've never managed to decompile.

http://www.nliteos.com/

http://www.vlite.net/

0xd4d 05-09-2012 00:40

Quote:

Originally Posted by KuNgBiM (Post 78730)
Hope to support DNGuard HVM

Not very popular so not easy finding samples. Send me any if you find some. Don't send crackmes.

Quote:

Originally Posted by sf42 (Post 78731)
How about deobfuscating nlite/vlite? Those are pretty much the only ones I've never managed to decompile.

Looks homemade. Use de4dot, then study their assembly loader. Shouldn't be too hard.

0xd4d 05-13-2012 22:19

New version: 1.8.2
  • Supports the latest build of CliSecure (now called Agile.NET)
  • Supports older CliSecure versions (1.x-5)
  • Supports the latest build of MaxtoCode
  • Supports the latest build of DeepSea
  • Updated Eazfuscator.NET deobfuscator
  • Updated Skater.NET string decrypter

https://github.com/0xd4d/de4dot/downloads

nikre 05-16-2012 07:54

1.8.3 available.
changes?

congviet 05-16-2012 08:58

Quote:

Originally Posted by nikre (Post 78937)
1.8.3 available.
changes?

_https://github.com/0xd4d/de4dot/commits/master/

0xd4d 05-16-2012 13:00

Or the official changelog: https://github.com/0xd4d/de4dot/wiki/Changelog

nikre 05-20-2012 06:04

New version: 1.8.4
  • Supports the latest build of Agile.NET

thanks 0xd4d keep up the good work

WilliamElts 06-03-2012 13:22

Version v1.8.5 - Jun 02 2012

Quote:

Supports the latest build of Agile.NET
Fixed some Mono.Cecil antis

WilliamElts 07-01-2012 10:49

De4dot v1.8.6
 
v1.8.6 - Jun 27 2012
Changelog:
Code:

    Supports the latest CryptoObfuscator build
    Supports the latest Agile.NET build
    Fixed a crash in Eazfuscator.NET string decrypter

Binary :
Code:

https://github.com/downloads/0xd4d/de4dot/de4dot-1.8.6.zip

s0me0n3 07-02-2012 17:31

Quote:

Originally Posted by sf42 (Post 78731)
How about deobfuscating nlite/vlite? Those are pretty much the only ones I've never managed to decompile.

http://www.nliteos.com/

http://www.vlite.net/

Any news regarding this?


All times are GMT +8. The time now is 22:26.

Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2024, vBulletin Solutions, Inc.
Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX