I already try de4dot with all dlls and exe and try remove strong name and don't work.
what am I doing wrong?
-
You can't always deobfuscate .NET binaries. If, when the binaries are compiled, the obfuscation implementation modifies the name itself in every place it's referenced, then that (the mangled name) is what the name will be for you, the reverser.– dsasmblrNov 8, 2017 at 15:21
-
What do you think about I try my last shot with IDA ? Can be made?– Luan BarbosaNov 8, 2017 at 15:25
-
1Again, if the name has 100% been changed in the application you've downloaded, then there's nothing for you to recover. It's as if the developer developed the application using those obfuscated names in the first place. Depending on what you want to accomplish, this is where other analysis (static and/or dynamic) comes into play where you have to find your way to the meaning of everything that's obfuscated (well, everything you're interested in, at least). This is by no means a trivial task necessarily, but it's what you have to start considering in the absence of meaningful symbols/names.– dsasmblrNov 8, 2017 at 15:33
-
Thank you very much I'm so obsessed with breaking those names. And I love impossible tasks. You quoted static or dynamic analysis, I just started a cybrary course on RE has a topic just about what you quoted. Thank you very much for the help. If I can not, that's fine. But I will not give up easy. I'm addicted to it.– Luan BarbosaNov 8, 2017 at 15:56
-
1@dsasmblr please consider making these comments as an elaborated answer since it answers the question– MegabeetsNov 9, 2017 at 6:51
|
Show 2 more comments
1 Answer
Converting multiple comments of mine to an answer for future readers:
You can't always deobfuscate .NET binaries. If, when the binaries are compiled, the obfuscation implementation modifies the name itself in every place it's referenced, then that (the mangled name) is what the name will be for you, the reverser. It's as if the developer developed the application using those obfuscated names in the first place.
Depending on what you want to accomplish, this is where other analysis (static [studying binaries without executing (running) them] and/or dynamic [studying binaries while they're executing]) comes into play where you have to find your way to the meaning of everything that's obfuscated (well, everything you're interested in, at least). This is by no means a trivial task necessarily, but it's what you have to start considering in the absence of meaningful symbols/names (which is quite commonly the case in unmanaged (non-CLR) binaries that lack symbol names).
-
I figured out what was going on. He has the masked value I have the value masked. It is possible to unmark it.? Nov 9, 2017 at 17:57