themaoci/csharp-eft-deobfuscation.md

Created September 14, 2020 10:46

Star (5) You must be signed in to star a gist
Fork (0) You must be signed in to fork a gist

Select an option

Learn more about clone URLs
Clone this repository at <script src="https://gist.github.com/themaoci/ca9924cf6b3d4f3db89e3d6eb8addd00.js"></script>
Save themaoci/ca9924cf6b3d4f3db89e3d6eb8addd00 to your computer and use it in GitHub Desktop.

Download ZIP

Raw

csharp-eft-deobfuscation.md

Deobfuscation

Open obfuscated assembly
Save module with MD Writed Options / Preserve Heap Offsets && Create Heap Even If Empty ticked ON
In same file go to -.ActionTrigger variable StateFalseAnim open \uE000 Token of this will be used to deobfuscate string, 0600???? is an template
Go to de4dot program open cmd in that folder and paste string from below withc changed path and token.

de4dot.exe --un-name "!^<>[a-z0-9]$&!^<>[a-z0-9]__.*$&![A-Z][A-Z]\$<>.*$&^[a-zA-Z_<{$][a-zA-Z_0-9<>{}$.`-]*$" "{$DIR}\Assembly-CSharp.dll" --strtyp delegate --strtok {$TOKEN}

to be continued ??

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment