FAQ

How to deobfuscate but make sure metadata tokens stay the same?

Use --keep-types and no method, type or anything else will be removed from the file. All types, methods, fields, properties and events should have the same metadata token after deobfuscation. To make sure parameter metadata tokens stay the same, also use --dont-rename.

Example:

de4dot --keep-types filename.dll

and

de4dot --keep-types --dont-rename filename.dll

An assembly has been obfuscated by two or more supported obfuscators. How do I deobfuscate the assembly?

If two or more obfuscators are detected, de4dot will print that and a description on how to force detection of one of them.

You need to figure out in which order the obfuscators were used and deobfuscate it in reverse order. You should also use --keep-types to preserve metadata tokens in case the next obfuscator uses hard coded metadata tokens to decrypt eg. strings.

The -p XX option can be used to force detection of an obfuscator, where XX is the type of the obfuscator. de4dot -h will show all types.

Assume filename.dll has been obfuscated by sa followed by ef, then you should use these commands:

de4dot --keep-types --dont-rename filename.dll -p ef -o tmp.dll
de4dot tmp.dll -p sa -o cleaned-file.dll
del tmp.dll

The output will be in cleaned-file.dll.

How do I decrypt strings in an assembly obfuscated by an unsupported obfuscator?

First you must figure out the metadata token of the string decrypter. You can use Simple Assembly Explorer (SAE). Locate the string decrypter and hover the mouse over the method name and you should see something like 06001234. That's the method's metadata token. The following command will dynamically decrypt the strings:

de4dot filename.dll --strtyp delegate --strtok 06001234

If it has more than one string decrypter, just append more --strtok 06xxxxxx like so:

de4dot filename.dll --strtyp delegate --strtok 06001234 --strtok 06001235 --strtok 06001236

--strtyp delegate will create a dynamic method and simply call the string decrypter and let it decrypt the string for us. --strtype emulate needs to be used if the string decrypter detects dynamic methods. If you suspect the assembly to be malware, you should only do this in a sandbox since unknown code is executed.

What could be the reason for an assembly to crash if it's been renamed?

If it's a supported obfuscator, renaming should always work, except in a few cases.

It could happen when a resource isn't renamed when the class that uses it has been renamed.

It could also happen if you deobfuscate an assembly, A.dll, but there's another assembly, B.dll, that has a reference to A, and that reference has been renamed in A.dll but not in B.dll. In this case, you must deobfuscate both A.dll and B.dll to make sure all references to A.dll in B.dll also are renamed.

de4dot A.dll B.dll