Dedot – A deobfuscator for Dotfuscator

INTRODUCTION
Dotfuscator is the single most widely deployed obfuscation solution on .NET and every other platform combined. And Dedot is a tool which tries to do against what Dotfuscator does. It’ll be helpful in some cases if you loose your project and have only binary files, or you want to analyze some viruses,…
After decryption, a patched assembly with decrypted string will be saved at the same folder of the application. Use Reflector to see result.
This tool will be updated soonly with more functions. Now it’s on BETA version. Use it on your risk. I’ll do it when I have more time.

  • Requirements : .NET Framework 2.0
  • Version: 1.0.0.6
  • Supported Version of Dotfuscator
    • 4.2
    • before 4.2 (not sure)

Want more functions. Post a comment directly under.

NOTE

  • If this tool doesn’t work with your packed assembly, send it to me. DO NOT blame me if this one doesn’t work. I’m just a newbie.
  • The Anti-obfuscate flow control doesn’t work good. Use it on your risk. My recommend is “Don’t use this option.

LINK DOWN: When you want to post this tool to somewhere. Please post url to my site, that keeps update for this tool when you do that.

Link down: http://hintdesk.com/Web/Tool/DeDot.zip

HISTORY

  • [1.0.0.4 – 1.0.0.6] : Fix minor bug.
  • [1.0.0.3] : Anti-Flow-Control-Obfuscation was implemented successfully.
  • [1.0.0.2] : Fix some bug at decrypting Unicode String
  • [1.0.0.0] : BETA Version.

SCREENSHOT
Dedot screenshot

UPDATE 31.03.2012
Source : http://hintdesk.com/Web/Source/DeDotSource.zip

14 thoughts on “Dedot – A deobfuscator for Dotfuscator”

  1. Great shit man! With this + reflector, I crack .NET apps in 5 minutes.

    Keep it up, thank you very much for this great app.

  2. I am getting this error while running dedot for my exe
    Can u please suggest me what to do?

    —————————
    Rongchaua
    —————————
    Unable to cast object of type ‘Mono.Cecil.Cil.Instruction[]’ to type ‘Mono.Cecil.Cil.Instruction’.

    at DeobfuscatorLib.Deobfuscator.FixBranch()

    at DeobfuscatorLib.Deobfuscator.DeobfuscateBranch(Lis t`1 lstException, WAYTOWRITE wtw)
    —————————
    OK
    —————————

  3. Also getting the Unable to cast object of type ‘Mono.Cecil.Cil.Instruction[]‘ to type ‘Mono.Cecil.Cil.Instruction’. error

  4. Please can you update the program to latest version of .net and dotfuscator …. i think that is why we are getting the above errors with mono.cecil …..

    great program. works very well except for the above error

  5. Hey ya proggie would be double useful if you would release it with it’s source code!

    I’m still having problems with ChrW obfucation(btw. the example is taken from liccl.dll of Replay Media Catcher 4.4).
    Code looks like that:

    Dim num2 As Integer = 11
    ...f3.b(ChrW(22794) & ChrW(16396) & ChrW(19470), num2))

    Function b(ByVal A_0 As String, ByVal A_1 As Integer) As String
    >This item appears to be obfuscated and can not be translated.<
    Some snipped
    L_0007: ldc.i4 1240135679
    L_0027: xor

    Or well can you recommand any tut or give some hints on how to easy read IL-code into some program modify it and write it back into a file?

    I mean there is probably a better way than just disasm the File to Text, Parse that Texfile for ‘ChrW-IL-Pattern’ and Search&Replace it and in the end assemble the Texfile file back to a *.dll or *.exe.

  6. @all: I don’t want to support DeDot anymore and Dotfuscator has changed a lot since 2008 therefore I publish DeDot’s source. Please use it only for education purpose.

Leave a Reply

Your email address will not be published. Required fields are marked *