monocul.us/de4dot-cex
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Update README

Browse Source
This commit is contained in:
de4dot 2011-11-06 14:48:54 +01:00
parent a4e4a7284e
commit aa4e64ffa4
1 changed files with 4 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
README.md
View File

@ -59,9 +59,8 @@ symbol renaming, and dynamic string decryption could possibly work.
Most obfuscators can rearrange the control flow so the code is harder to Most obfuscators can rearrange the control flow so the code is harder to
understand. A simple method that is 10 lines long and easy to read, could understand. A simple method that is 10 lines long and easy to read, could
become 30-40 lines and be very hard to read. Control flow deobfuscation will become 30-40 lines and be very hard to read. Control flow deobfuscation will
remove all of the obfuscated code, leaving just the original code. All dead remove all of the obfuscated code, leaving just the original code. Dead code
(non-executed) code blocks are also removed as part of control flow is also removed.
deobfuscation.
### Cross-assembly symbol renaming ### Cross-assembly symbol renaming
@ -96,9 +95,8 @@ decypted and decompressed and then saved to disk.
### Dumps encrypted methods ### Dumps encrypted methods
Some obfuscators encrypt all methods and only decrypt each method when Some obfuscators encrypt all methods and only decrypt each method when
requested by the .NET runtime. These methods can be dumped dynamically by requested by the .NET runtime. The methods are statically decrypted and then
using some special tricks. It's not a generic methods decrypter but will work deobfuscated.
with the supported obfuscators that encrypt methods.
### Deobfuscated files are runnable ### Deobfuscated files are runnable
@ -153,13 +151,6 @@ Detect obfuscator recursively:
de4dot -d -r c:\path1 de4dot -d -r c:\path1
Dump methods and deobfuscate:
dumpMethods file1
dumpMethods file2
dumpMethods file3
de4dot file1 file2 file3
Deobfuscate and get a detailed log of what was changed: Deobfuscate and get a detailed log of what was changed:
de4dot -v file1.exe file2.dll file3.exe > log.txt de4dot -v file1.exe file2.dll file3.exe > log.txt