Oct 11, 2021 08:25 PM
(This post was last modified: Oct 11, 2021 08:26 PM by sneezing panda.)
Heads up, straight up copy pasted from tuts4you. Posted by Raktabeej originally.
Really Long List (Click to View)
Really Long List (Click to View)
Code
.NET Deobfuscator
Lists of .NET Deobfuscator / Unpacker (Open Source)
link - https://awesomeopensource.com/project/NotPrab/.NET-Deobfuscator
General Lists
Agile
AgileStringDecryptor - A dynamic agile string decryptor that relies on invoke.
Agile.NET-Deobfuscator - Deobfuscates Agile.NET controlflow, strings, and proxy delegates. Please let me know for new updates or any other problems. Throughout the full source on every line it contains comments so you can easily understand the process behind it. Enjoy!
AgileDotNet-StringDeobfuscator - Quickly decrypts strings from Agile.NET (aka AgileDotNet, CliSecure) packed assemblies. Supports multiple modules.
ArchangelCloak
ArchangeIUncloaker - Public ArchangelCloak Deobfuscator
Atomic
Atomic-Deobfuscator - A deobfuscator for Atomic obfuscator
AutoIt
DeobHellper - Yeat Another AutoIt Deobfuscator
Autori Obfuscator
NeonFuscatorDeobfuscator - .NET Deobfuscator for Autori Obfuscator (NeonFuscator)
Babel
BabelDeobfuscator - BabelDeobfuscator is an open-source deobfuscator for BabelObfuscator
DeBabelVM - DeBabelVM is a restorer for the Babel Obfuscator - This will restore 'msil encrypt' methods for Babel
Babel-Deobfuscator - Babel-Deobfuscator is an open-source deobfuscator for Babel Obfuscator.
BoxedAppPacker
BoxedAppUnpacked - Tool to unpack .net assemblies packed by BoxedAppPacker
BytePress
BytePressDecompressor - Unpacks files compressed by BytePress(https://github.com/roachadam/bytepress)
Beebyte
beeless - BeeByte Deobfuscator. Used it to deobfuscate an Unity3D Game. Alternatively, de4dot works aswell.
Confuser 1.9
ConfuserDeobfuscator - Deobfuscator for Confuser 1.9.0.0 release
DeConfuser - This is a deobfuscator for protected confuser assemblies
Confuser-Methods-Decryptor - Confuser-Methods-Decryptor
ConfuserEx
NoFuserEx - Free deobfuscator for ConfuserEx.
Netguard-Unpacker-Public - Public NetGuard Deobfuscator
ClarifierEx - Deobfuscator for ConfuserEx
Rzy-Protector-V2-Unpacker - An unpacker (deobfuscator) for the protector (obfuscator) Rzy Protector V2.
ConfuserEx-Dynamic-Unpacker - A dynamic confuserex unpacker that relies on invoke for most things
ConfuserEx-Unpacker-Mod-By-Bed - Edited copy of cawks confuserex unpacker, support more than your averageprogram
ConfuserEx-Unpacker-2 - An Updated ConfuserEx Unpacker Based On Emulation to be more reliable
Krawk-Unpacker - Krawk Unpacker
EasyPredicateKiller - Replacing and Calling ConfuserEx x86 Predicates
ConfuserExSwitchKiller - ConfuserExSwitchKiller
ConfuserEx-Anti-Debug-Remover - ConfuserEx-Anti-Debug-Remover
ConfuserEx-Static-String-Decryptor - A static String Decryptor Based Off Instruction Emulator
ConfuserEx-Static-String-Decryptor - it will decrypt strings statically from a non modded confuserex with or without cflow doesnt really matter
ConfuserEx-Resources-Decryptor - This tool can decrypt encrypted resources from ConfuserEx and replace them
ConfuserExResourceReplace - ConfuserExResourceReplace
ConfuserExTools - ConfuserEx unpacking tools basic support for ConfuserEx (AntiTamper, ReferenceProxy, Constants)
FinGu-Cfex-Cleaner - Removing/Cleaning FinGu Cfex Mutations
Unscrambler - Universal unpacker and fixer for a number of modded ConfuserEx protections
Cursed-Auto-Decryptor - Program Decrypt Cfex / Modded Cfex Constants By Auto Detecting Params
Crypto Obfuscator
Crypto-Deobfuscator - A Deobfuscator for Crypto Obfuscator
Cypher
Cyphor-Pointer-Remover - Removes Cyphor Pointer Mutations | Cyphor : cyphor.net
DCNETProtector
DCNetStringDecryptor - String Decryptor for DC.NET Protector (tested on v1.1.0.1)
De4dot
de4dot - .NET deobfuscator and unpacker.
de4dot-cex - de4dot deobfuscator with full support for vanilla ConfuserEx
DNGuard
DNGuard-InvalidMD - The easiest way to remove DNGuard Invalid-MD
DotnetPatcher
DNPDeobfuscator - Open-source deobfuscator for dotnetpatcher (https://bitbucket.org/3dotdev/dotnet-patcher/src/)
Deobf-DotNetPathcer - an basic deobfuscator for last version (at the moment) dotnetpatcher (v4.5.9.0) https://bitbucket.org/3DotDev/dotnet-patcher
DotNetCompressor
DotNetCompressorDecompressor - Decompresses files compressed with https://github.com/TotalTechGeek/DotNetCompressor
DotRefiner
DotRefiner-Deobfuscator - Static DotRefiner Deobfuscator
DotWall
DotWall-Deobfuscator - Deobfuscator for DotWall
Dotwall-deobfuscator - A very simple deobfuscator for DotWall Obfuscator
Dumper
ExtremeDumper - .NET Assembly Dumper
Nemesis - A customizable process dumper.
MegaDumper - Dump native and .NET assemblies
KsDumper - Dumping processes using the power of kernel space !
Eazfuscator
EazFixer - A deobfuscation tool for Eazfuscator.
eazdevirt -Devirtualizer for Eazfuscator.NET
Fixer / Replacer / Simplifier / Remover / Decompressor
AssemblyRebuilderOld - [Obsolete] Fixup .Net Assembly dumped, if it can't work.
AssemblyFixer - Fix assembly pe header and metadata errors
RzyFixer - A .NET Unpacker tool, with many features. Using dnlib assembly & cui for the design.
CalliFixer - Here is a little program that remove calli protection from files, easy to use & easy to understand. Using the dnlib assembly.
Base64Encoding-Fixer - Little tool that i made cuse i'm bored rn, fix the string encryption protection (the one which encrypt strings to base64 made by forgothisname). Using dnlib assembly.
DoubleParseFixer - Little program that i made to fix Double Parse obfuscation. Using dnlib assembly.
Dumpy - Simple .NET Assembly deobfuscator.
IntToString-Deobfuscator - deobfuscator for int to string mutation (C#) supports negative values
Local2FieldFixer - Remove Fields From GlobalType To Locals
SizeOf-Fixer -Fix the sizeof of assembly
SuperCalculator - Helpful tool which handle most operations used in obfuscation
Mathematical-Operation-Simplifier -Mathematical Operation Simplifier for .NET Applications
SizeOf-Replacer - SizeOf Replacer for .NET Applications
Junk-Remover - .NET attributes cleaner/Junk remover (nops).
ProxyCall-Remover - Deobfuscator for remove proxy calls methods
PointMutationRemover - Does exactly what the title says, removes Point Mutations. Only supported with 2D points at the moment.
Universal-Math-Fixer - This calculator load all methods from mscorlib.dll and checks equivalence with the method from the instruction
SimpleMathCleaner - Simple Math Cleaner with invoke method for generic use
AntiDecompiler-Cleaner - An exception occurred when decompiling this method
AntiInvokeDetection - most string deobfuscators use Invoke to pick up the strings, however some obfuscators are using "GetCallingAssembly" to check if the method is being executed by another assembly
Excess-Nop-Remover - Remove excess nop opcodes
Universal-Proxy-Remover - A simple and universal .NET proxy remover
ProxyCall-Remover - Deobfuscator for remove proxy calls methods
UnSealer - A Deobfuscator Base Which Uses Plugins And Multi-Platform Of Assembly Lib's | Its Easy To Build On Download Now Make Ur Own Plugin !
Simple-Costura-Decompressor - Simple tool to extract and decompress embedded resources processed by Fody Costura
Fody-Costura-Decompress - Fody-Costura Decompress
netshrinkTrialRemover - Removes Trial Restrication from .netshrink Applications (tested on v2.9)
PEXTUnion - Cleaner & Extractor for PEUnion (tested on PEunion 3.1.5)
NETz_Unpacker - Unpacker for NETz Compressor
MutationCleaner - Mod of DevT02's Point Mutation Remover. Now supports TimeSpan Mutations & Now has Better CUI
ILProtector
ILProtectorUnpacker - ILProtector Unpacker Script
ILUnpacker - A simple unpacker for ILProtector. Supported versions <= 2.0.21.4.
ILUnpacker - Different approach on unpacking ILProtector (Latest)
KoiVM
OldRod - An automated KoiVM devirtualisation utility
Rhydon - Rhydon
MemeVM
MemeDevirtualizer - Devirtualizer for MemeVM (MindSystem)
MemeVM-Devirt - A devirtualizer for MemeVM (CursedSheep)
MemeVMDevirt - devirtualizer for memevm (MageLand29)
NashaVM
Deoxys - Deoxys is a Devirtualization utility for NashaVM, a Virtual Machine which runtime was made in C++/CLI
TheBear - .NET Devirtualizer for NashaVM that Gabtiex made for nothing.
Noisette Obfuscator
Noisette-Deobfuscator - A Deobfuscator for Noisette Obfuscator
NETReactor
Krypton - .Net Reactor Devirtualizer
.NET-Reactor-String-Decryptor - .NET-Reactor-String-Decryptor
.NetReactorCfCleaner - A control flow cleaner for .net reactor 6x
.NETReactor_6.3.0.0_Only_Strings - Example deobfuscate .NET Reactor 6.3.0.0 strings(ONLY STRINGS)
Cursed.Reactor - Full .Net Reactor UnPacker 🙂 Except VM & NecroBit
Obfuscar
DeObfuscar - An open source deobfuscator for 'Obfuscar'
DeObfuscar-Static - Static Obfuscar Deobfuscator
OrangeHeap
OrangeHeap-Deobfuscator - Deobfuscates an Assembly protected with Orangeheap
Origami
Unfold - Unfold is a simple tool that extract Assmebly packed with Origami.
Patcher
.NET-Virtualized-App-Patcher - This is a universal Patcher that I coded for Virtualized Applications. Protected by KoiVM/EazVM/AgileVM. The project idea wasn't mine at all it was by xsilent and Tobito and they released a txt that contains the tracer, uh I asked time for some infos and ended up coding my version.
JIT-Freezer - This program is used to suspend applications with a native layer in order to dump them (Only .NET)
Venturi77CallHijacker - KoiVM,EazVM,AgileVM Patcher.
Harmony - A library for patching, replacing and decorating .NET and Mono methods during runtime
JitUnpacker-Framework - A jit hook and unpacker framework
dnpatch - dnpatch is the ultimate library for all your .NET patching needs. It offers automated assembly patching, signature scanning and last but but not least bypassing of obfuscators by its ability to find methods in renamed/obfuscated types. Since the stars on GitHub exploded in a few days, dnpatch has been extended by a couple of projects. The most important one is dnpatch.deobfuscation which integrates de4dot directly into dnpatch. Also there is dnpatch.script, which gives you the ability to write patchers with pure JSON! The library itself uses dnlib (see next part).
EazRemoveTrial - After protected with Eazfuscator trial version then drag your protected file into EazRemoveTrial.exe, So you can use it forever not for 7 days, Working with lastest version
Renamer
simple-deobfuscator - simple-deobfuscator
BB-Deob - BeeByte Deobfuscator simply renames all the classes/fields/methods/params to readable strings that can be understood. AS I know BB Obfuscator only renames classes and etc, so it should be fully reversable at that point.
Panda
Panda-Deobfuscator - Panda Deobfuscator
Phoenix Obfuscator
PhoenixDeobfuscator - PhoenixDeobfuscator is an open-source deobfuscator for PhoenixObfuscator
Phoenix-Protector-Strings-Decryptor - A strings decryptor for Phoenix Protector (Illuzion9999)
Phoenix-String-Decryptor - A simple tool which decrypts strings protected with Phoenix Protector (Jomtek)
Protect.NET
ProtectNotNet - Decrypts Protect.NET encrypted strings
String Decryptor
StackYenoDeobfuscator - String decryptor relying on the stack. Made for teach
StringDecryptorBase - Complete basic string decryptor to help new reversers. The code is commented
Deobfuscation-Tutorials - String Deobfuscation Tutorials by TheProxy
DynamicStringDecrypter - Decrypts strings dynamically, using https://github.com/Washi1337/AsmResolver
OutStringDecrypter - OutStringDecrypter
Skater.Net Obfuscator
Skater.NetDeobfuscator - Deobfuscator for RustemSoft Skater.Net Obfuscator
SpecterObfuscator
SpecterObfuscator-Deobfuscator - a deobfuscator for https://github.com/NepErwin/SpecterObfuscator
VMP.NET
VMP.NET-Kill - This program allows you to bypass CRC checking, anti-debugging and anti-VM. Doesn't work when the app is packaged.
Themida .NET
Themida-Unpacker-for-.NET - Themida Unpacker for .NET
ThemidaStringDecryptor - Decrypt strings from a themida .net module dump
Yano
YanoDeobfuscator - YanoDeobfuscator is an open-source deobfuscator for YanoObfuscator

