de4dot  /? 帮助原文

使用方法

de4dot "d:\xx.exe" -p xc-p xc  指定壳类型 , 这里是xc,表示Xenocode壳.这样会在exe的相同目录生成一个 xx_cleaned.exe 的文件, 拖进ILSpy什么的去看代码吧.要指定输出路径请使用 -o "d:\output\xx.exe"

一般选对壳了大部分都可以脱掉，脱不掉的首先尝试使用最新版的de4dot， 脱完之后一部分类/方法名会恢复， 另一部分会变成Class123,、method_123之类的, ，不过总比那些都显示不出来的字符可强多了，简单修改一下即可编译了。 突然想到有没有人搞个de4dot GUI工具呢?

放俩图对比一下:

de4dot v3.1.41592.3405 Copyright (C) 2011-2014de4dot@gmail.com
Latest version and source code: https://bitbucket.org/0xd4d/de4dot
Some of the advanced options may be incompatible, causing a nice exception.
With great power comes great responsibility.de4dot<options> <file options>Options:-r DIR           Scan for .NET files inall subdirs-ro DIR          Output base dir forrecursively found files-ru              Skip recursively found files with unsupported obfuscator-d               Detect obfuscators and exit--asm-path PATH  Add an assembly search path--dont-rename    Don't rename classes, methods, etc.--keep-names FLAGSDon't rename n(amespaces), t(ypes), p(rops), e(vents), f(ields), m(ethods), a(rgs), g(enericparams), d(elegate fields). Can be combined, eg. efm--dont-create-paramsDon't create method params when renaming--dont-restore-propsDon't restore properties/events--default-strtyp TYPEDefaultstringdecrypter type--default-strtok METHODDefaultstringdecrypter method token or [type::][name][(args,...)]--no-cflow-deob  No control flow deobfuscation (NOT recommended)--load-new-processLoad executed assemblies into anewprocess--keep-types     Keep obfuscator types, fields, methods--preserve-tokensPreserve important tokens, #US, #Blob, extra sig data--preserve-table FLAGSPreserve ridsin table: tr (TypeRef), td (TypeDef), fd (Field), md (Method), pd (Param), mr (MemberRef), s (StandAloneSig), ed (Event), pr (Property), ts (TypeSpec), ms (MethodSpec), all (all previous tables). Use - to disable (eg. all,-pd). Can be combined: ed,fd,md--preserve-stringsPreserve #Strings heap offsets--preserve-us    Preserve #US heap offsets--preserve-blob  Preserve #Blob heap offsets--preserve-sig-dataPreserve extra data at the end of signatures--one-file       Deobfuscate one file at a time-v               Verbose-vv              Very verbose-h               Show thishelp message--help           Same as -hFile options:-f FILE          Name of .NET file-o FILE          Name of output file-p TYPE          Obfuscator type (see below)--strtyp TYPE    String decrypter type--strtok METHOD  String decrypter method token or [type::][name][(args,...)]Deobfuscator options:
Type un (Unknown)--un-name REGEX  Valid name regex pattern (^[a-zA-Z_<{$][a-zA-Z_0-9<>{}$.`-]*$)Type an (Agile.NET)--an-name REGEX  Valid name regex pattern (^[\u2E80-\u9FFFa-zA-Z_<{$][\u2E80-\u9FFFa-zA-Z_0-9<>{}$.`-]*$)--an-methods BOOLDecrypt methods (True)--an-rsrc BOOL   Decrypt resources (True)--an-stack BOOL  Remove all StackFrameHelper code (True)--an-vm BOOL     Restore VM code (True)--an-initlocals BOOLSet initlocalsinmethod header (True)Type bl (Babel .NET)--bl-name REGEX  Valid name regex pattern (^[\u2E80-\u9FFFa-zA-Z_<{$][\u2E80-\u9FFFa-zA-Z_0-9<>{}$.`-]*$)--bl-inline BOOL Inline shortmethods (True)--bl-remove-inlined BOOLRemove inlined methods (True)--bl-methods BOOLDecrypt methods (True)--bl-rsrc BOOL   Decrypt resources (True)--bl-consts BOOL Decrypt constants and arrays (True)--bl-embedded BOOLDump embedded assemblies (True)Type cf (CodeFort)--cf-name REGEX  Valid name regex pattern (!^[a-zA-Z]{1,3}$&!^[_<>{}$.`-]$&^[\u2E80-\u9FFFa-zA-Z_<{$][\u2E80-\u9FFFa-zA-Z_0-9<>{}$.`-]*$)--cf-embedded BOOLDump embedded assemblies (True)Type cv (CodeVeil)--cv-name REGEX  Valid name regex pattern (!^[A-Za-z]{1,2}$&^[\u2E80-\u9FFFa-zA-Z_<{$][\u2E80-\u9FFFa-zA-Z_0-9<>{}$.`-]*$)Type cw (CodeWall)--cw-name REGEX  Valid name regex pattern (!^[0-9A-F]{32}$&!^[_<>{}$.`-]$&^[\u2E80-\u9FFFa-zA-Z_<{$][\u2E80-\u9FFFa-zA-Z_0-9<>{}$.`-]*$)--cw-embedded BOOLDump embedded assemblies (True)--cw-decrypt-main BOOLDecrypt main embedded assembly (True)Type co (Crypto Obfuscator)--co-name REGEX  Valid name regex pattern (!^(get_|set_|add_|remove_)?[A-Z]{1,3}(?:`\d+)?$&!^(get_|set_|add_|remove_)?c[0-9a-f]{32}(?:`\d+)?$&^[\u2E80-\u9FFFa-zA-Z_<{$][\u2E80-\u9FFFa-zA-Z_0-9<>{}$.`-]*$)--co-tamper BOOL Remove tamper protection code (True)--co-consts BOOL Decrypt constants (True)--co-inline BOOL Inline shortmethods (True)--co-ldnull BOOL Restore ldnull instructions (True)Type ds (DeepSea)--ds-name REGEX  Valid name regex pattern (^[\u2E80-\u9FFFa-zA-Z_<{$][\u2E80-\u9FFFa-zA-Z_0-9<>{}$.`-]*$)--ds-inline BOOL Inline shortmethods (True)--ds-remove-inlined BOOLRemove inlined methods (True)--ds-rsrc BOOL   Decrypt resources (True)--ds-embedded BOOLDump embedded assemblies (True)--ds-fields BOOL Restore fields (True)--ds-keys BOOL   Rename resource keys (True)--ds-casts BOOL  Deobfuscate casts (True)Type df (Dotfuscator)--df-name REGEX  Valid name regex pattern (!^(?:eval_)?[a-z][a-z0-9]{0,2}$&!^A_[0-9]+$&^[\u2E80-\u9FFFa-zA-Z_<{$][\u2E80-\u9FFFa-zA-Z_0-9<>{}$.`-]*$)Type dr3 (.NET Reactor)--dr3-name REGEX Valid name regex pattern (^[\u2E80-\u9FFFa-zA-Z_<{$][\u2E80-\u9FFFa-zA-Z_0-9<>{}$.`-]*$)--dr3-types BOOL Restore types (object ->real type) (True)--dr3-inline BOOLInlineshortmethods (True)--dr3-remove-inlined BOOLRemove inlined methods (True)--dr3-ns1 BOOL   Clear namespace if there's only one class in it (True)--dr3-sn BOOL    Remove anti strong name code (True)Type dr4 (.NET Reactor)--dr4-name REGEX Valid name regex pattern (^[\u2E80-\u9FFFa-zA-Z_<{$][\u2E80-\u9FFFa-zA-Z_0-9<>{}$.`-]*$)--dr4-methods BOOLDecrypt methods (True)--dr4-bools BOOL Decrypt booleans (True)--dr4-types BOOL Restore types (object ->real type) (True)--dr4-inline BOOLInlineshortmethods (True)--dr4-remove-inlined BOOLRemove inlined methods (True)--dr4-embedded BOOLDump embedded assemblies (True)--dr4-rsrc BOOL  Decrypt resources (True)--dr4-ns1 BOOL   Clear namespace if there's only one class in it (True)--dr4-sn BOOL    Remove anti strong name code (True)--dr4-sname BOOL Rename shortnames (False)Type ef (Eazfuscator.NET)--ef-name REGEX  Valid name regex pattern (!^[a-zA-Z]$&!^#=&!^dje_.+_ejd$&^[\u2E80-\u9FFFa-zA-Z_<{$][\u2E80-\u9FFFa-zA-Z_0-9<>{}$.`-]*$)Type go (Goliath.NET)--go-name REGEX  Valid name regex pattern (!^[A-Za-z]{1,2}(?:`\d+)?$&^[\u2E80-\u9FFFa-zA-Z_<{$][\u2E80-\u9FFFa-zA-Z_0-9<>{}$.`-]*$)--go-inline BOOL Inline shortmethods (True)--go-remove-inlined BOOLRemove inlined methods (True)--go-locals BOOL Restore locals (True)--go-ints BOOL   Decrypt integers (True)--go-arrays BOOL Decrypt arrays (True)--go-sn BOOL     Remove anti strong name code (True)Type il (ILProtector)--il-name REGEX  Valid name regex pattern (^[\u2E80-\u9FFFa-zA-Z_<{$][\u2E80-\u9FFFa-zA-Z_0-9<>{}$.`-]*$)Type mc (MaxtoCode)--mc-name REGEX  Valid name regex pattern (!^[oO01l]+$&!^[A-F0-9]{20,}$&^[\u2E80-\u9FFFa-zA-Z_<{$][\u2E80-\u9FFFa-zA-Z_0-9<>{}$.`-]*$)--mc-cp INT      String code page (936)Type mp (MPRESS)--mp-name REGEX  Valid name regex pattern (^[\u2E80-\u9FFFa-zA-Z_<{$][\u2E80-\u9FFFa-zA-Z_0-9<>{}$.`-]*$)Type rm (Rummage)--rm-name REGEX  Valid name regex pattern (!.)Type sk (Skater .NET)--sk-name REGEX  Valid name regex pattern (!`[^0-9]+&^[\u2E80-\u9FFFa-zA-Z_<{$][\u2E80-\u9FFFa-zA-Z_0-9<>{}$.`-]*$)Type sa (SmartAssembly)--sa-name REGEX  Valid name regex pattern (^[\u2E80-\u9FFFa-zA-Z_<{$][\u2E80-\u9FFFa-zA-Z_0-9<>{}$.`-]*$)--sa-error BOOL  Remove automated error reporting code (True)--sa-tamper BOOL Remove tamper protection code (True)--sa-memory BOOL Remove memory manager code (True)Type sn (Spices.Net)--sn-name REGEX  Valid name regex pattern (!^[a-zA-Z0-9]{1,2}$&^[\u2E80-\u9FFFa-zA-Z_<{$][\u2E80-\u9FFFa-zA-Z_0-9<>{}$.`-]*$)--sn-inline BOOL Inline shortmethods (True)--sn-remove-inlined BOOLRemove inlined methods (True)--sn-ns1 BOOL    Clear namespace if there's only one class in it (True)--sn-rsrc BOOL   Restore resource names (True)Type xc (Xenocode)--xc-name REGEX  Valid name regex pattern (!^[oO01l]{4,}$&!^(get_|set_|add_|remove_|_)?[x_][a-f0-9]{16,}$&^[\u2E80-\u9FFFa-zA-Z_<{$][\u2E80-\u9FFFa-zA-Z_0-9<>{}$.`-]*$)String decrypter typesnone             Don't decrypt stringsdefault          Use default string decrypter type (usually static)static           Use static string decrypter ifavailabledelegate         Use a delegate to call the real stringdecrypteremulate          Call realstringdecrypter and emulate certain instructionsMultiple regexes can be usedif separated by '&'.
Use'!' if you want to invert the regex. Example: !^[a-z\d]{1,2}$&!^[A-Z]_\d+$&^[\w.]+$Examples:
de4dot-r c:\my\files -ro c:\my\output
de4dot file1 file2 file3
de4dot file1-f file2 -o file2.out -f file3 -o file3.outde4dot file1--strtyp delegate --strtok 06000123ERROR:
ERROR:
ERROR: ERROR: File"/?"does not exist.
ERROR:

支持的混淆器种类(从github复制来的)

• Agile.NET (aka CliSecure)
• Babel.NET
• CodeFort
• CodeVeil
• CodeWall
• CryptoObfuscator
• DeepSea Obfuscator
• Dotfuscator
• .NET Reactor
• Eazfuscator.NET
• Goliath.NET
• ILProtector
• MaxtoCode
• MPRESS
• Rummage
• Skater.NET
• SmartAssembly
• Spices.Net
• Xenocode

下载地址: http://pan.baidu.com/s/1hqvcNkS

github : https://github.com/0xd4d/de4dot