Dedot - A deobfuscator for Dotfuscator

[rongchaua]

Dotfuscator is the single most widely deployed obfuscation solution on .NET and every other platform combined. And Dedot is a tool which tries to do against what Dotfuscator does. It'll be helpful in some cases if you loose your project and have only binary files, or you want to analyze some viruses,...

After decryption, a patched assembly with decrypted string will be saved at the same folder of the application. Flow Control Obfuscation was defeated too. Use Reflector to see result.

This tool will be updated soonly with more functions. Now it's on BETA version. Use it on your risk. I'll do it when I have more time.

* Requirements : .NET Framework 2.0
* Version: 1.0.0.3
* Supported Version of Dotfuscator
o 4.2
o before 4.2 (not sure)
* Want more functions. Post at my site or at this thread.

NOTE:
* If this tool doesn't work with your packed assembly, send it to me. DO NOT blame me if this one doesn't work. I'm just a newbie.

Link down: http://rongchaua.net/tools-mainmenu-36/106-dedot-a-deobfuscator-for-dotfuscator

[llyang]

thank you, rongchaua.

[axiohm]

I got "This version of Dotfuscator was not supported!" and dont know what version of Obfuscator the DLL used.

Any idea? thanks!

[rongchaua]

I have updated new version. Check it out. Or upload your files somewhere send link to me. I would like to take a look too.
Regards.
rca.

[axiohm]

Thanks! But the file version is still in 1.0.0.3...

[rongchaua]

Sorry, yesterday I am too tired. Maybe I forgot to upload file after fixing. The new version is now available.

[axiohm]

I downloaded again the tool from your site, but still gives me same version and same timestamp of 5/9/2008. I haven't got a new version yet.

thanks!

[axiohm]

thanks! i've seen the updated file. and the tool works!

[patentcomet]

I got exception while solving flow control obfuscation.
Is there any way to skip flow control deobfuscation?

may I know whats the algorithm for deobfuscate that dotfuscator? :D

[Tyra]

[QUOTE=rongchaua;7153]* Supported Version of Dotfuscator
o 4.2
o before 4.2 (not sure)
[QUOTE]
Dont worked on
http://rapidshare.com/files/277573318/gPC_Setup.cab.html :confused:

[kribio]

With what software do I deoffuscare this file?
http://rapidshare.com/files/279861970/s.rar.html
thanks

[pangag]

I am getting this error while running dedot for my exe
Can u please suggest me what to do?

---------------------------
Rongchaua
---------------------------
Unable to cast object of type 'Mono.Cecil.Cil.Instruction[]' to type 'Mono.Cecil.Cil.Instruction'.

at DeobfuscatorLib.Deobfuscator.FixBranch()

at DeobfuscatorLib.Deobfuscator.DeobfuscateBranch(Lis t`1 lstException, WAYTOWRITE wtw)
---------------------------
OK
---------------------------

[nikole.957]

thanks! i've seen the updated file. and the tool works!

I got exception while solving flow control obfuscation.
Is there any way to skip flow control deobfuscation?

[cimmerian]

Hi,

I have problems unpacking any of this files http://www.megaupload.com/?d=NSPGF4DY with DeDot. Don't run properly once they are deobfuscated.

Are packed with Dotfuscator("69255:1:0:4.4.1400.25709", 0)

Any ideas?

Thanks in advance.

Cheers.