FAQ

How to deobfuscate but make sure metadata tokens stay the same?

Use --keep-types and no method, type or anything else will be removed from the file. All types, methods, fields, properties and events should have the same metadata token after deobfuscation. To make sure parameter metadata tokens stay the same, also use --dont-rename.

Example:

de4dot --keep-types filename.dll

and

de4dot --keep-types --dont-rename filename.dll

An assembly has been obfuscated by two or more supported obfuscators. How do I deobfuscate the assembly?

If two or more obfuscators are detected, de4dot will print that and a description on how to force detection of one of them.

You need to figure out in which order the obfuscators were used and deobfuscate it in reverse order. You should also use --keep-types to preserve metadata tokens in case the next obfuscator uses hard coded metadata tokens to decrypt eg. strings.

The -p XX option can be used to force detection of an obfuscator, where XX is the type of the obfuscator. de4dot -h will show all types.

Assume filename.dll has been obfuscated by sa followed by ef, then you should use these commands:

de4dot --keep-types --dont-rename filename.dll -p ef -o tmp.dll
de4dot tmp.dll -p sa -o cleaned-file.dll
del tmp.dll

The output will be in cleaned-file.dll.