From the obfuscated to the deobfuscated assemblies, IL code looks different using ILDASM; however, DotPeek decompiled C# code looks exactly the same for both. Any clue why?

The obfuscation software is Dotfuscator. de4dot runs just fine, apparently.

  • did you run DotPeek on the obfuscated code? – Igor Skochinsky Aug 18 '17 at 15:34
  • I ran it on both the obfuscated and deobfuscated dlls, code looks exactly the same (i.e., it still has Dotfuscator's modifications). I must be missing something obvious... – Masamune Shirow Aug 18 '17 at 15:56
  • if you provide more info (e.g. bytecode vs. decompiled code listings) and tell us what exactly you did, we may be able to answer better. – Igor Skochinsky Aug 18 '17 at 15:57
  • I don't want to lose your time. I thought it would be straightforward, once de4dot ran smoothly, to decompile the dll using DotPeek. I debug into de4dot, looks ok. Though apparently it's not, I guess I need to learn more. – Masamune Shirow Aug 18 '17 at 16:12
  • I am interested too in the subject; truth be told, there's barely any resources to be found about how to get from de4dot to DotPeek (or any other decompiler). If de4dot succeeded, what then? The internets say, just open DotPeek and voilà...! – CTZStef Aug 19 '17 at 13:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.