Tool
de4dot
Open-source .NET deobfuscator and unpacker that tries to restore a packed and obfuscated assembly to almost its original form. Depending on the obfuscator, it decrypts strings, constants, methods, resources and embedded assemblies statically or dynamically, removes proxy methods, junk classes and tamper-detection and anti-debug code, devirtualizes virtualized code, deobfuscates control flow and renames symbols to readable names; it can also just detect which obfuscator was used. The README lists 19 supported obfuscators and packers, among them Dotfuscator, .NET Reactor, Eazfuscator.NET and SmartAssembly.
- Targets
- App
- Category
- .NET tools
- Relationship
- Foundation tool
- Sources reviewed
Requirements & limits
- Prerequisites: The repository was archived on GitHub after its last commit on 2020-08-29 and has no GitHub releases; the README points to CI builds for binaries. Source builds use the .NET Framework or .NET Core solution and need dnlib, which de4dot uses to read and write assemblies.
- Limits: Original symbol names usually cannot be restored, and XAML is not renamed, so WPF or Silverlight assemblies may need --dont-rename. The README offers no support and says newer obfuscator versions may require updating de4dot yourself.
- Limits: For some obfuscators, and for dynamic string decryption, it loads the assembly and its dependencies into memory and executes them, so the README advises a safe sandbox for suspected malware.
- License: GPL-3.0 (COPYING); bundled libraries such as dnlib, SharpZipLib, QuickLZ and LZMA keep their own license files.
About this entry
The description was reviewed against primary sources.
Primary sources
- README.md GitHub · de4dot/de4dot · Revision b7d5728
- https://github.com/de4dot/de4dot/tree/b7d5728fc0c82fb0ad758e3a4c0fbb70368a4853
- COPYING GitHub · de4dot/de4dot · Revision b7d5728
More in Apps
- ClassyShark · Tool
- JEB Decompiler · Tool
- Luyten · Tool
- jd-cli · Tool
- Android Unpacker · Tool
- ReverseAPK · Tool