(de4dot) The file isn't a .NET PE file

Question

Probably, many of you have ever seen the message from de4dot while trying to deobfuscate app/dll:

WARNING: The file isn't a .NET PE file:

What steps to take in such cases to proceed? How to make the .exe file to be detected as valid .NET PE?

Answer 1

As a programmer myself, I have to again and again tell and shout, that if the purpose is cracking/stealing, then you should not do that for the sake of honesty. If the purpose is good, then I'll share my solutions.

At first, the language should be determined, if it's either a real .NET file or not.

• You can use the "PEiD" tool (or if you do not have a good custom signature database for "PEiD", then use "TridNet") to analyze the file and determine the language (that will be approximation).

• Open it with CFF Explorer. If you don't see the .NET Directory, then this is a native dll, not .NET. Check what language is that. ( sometimes, use "Dependances" to view, if you reference MSCEERE.DLL, it contains managed code, if you reference MSVCR100.DLL, it contains Native Code.)

Now, there seems to be 2 possible scenarios:

Scenario 1 - The original file is not .NET program:

• de4dot is made for .NET files. So, your executable might be a shell packed file, or Win32 exe, or program is not written by .NET languages. For example, Visual C++ (i.e. written in Delphi or etc) has nothing to do with the .NET Framework, so you can discard the .NET decompiler (Reflector, ILSpy, etc) to get some code. In that case, you will have to go for the most complicated route and get back to reversing (with IDA, OllyDbg or any other similar and see what you can get in ASM, + HexRays Decompiler ).

Scenario 2 - The original file is .NET program, but hardened:

• At first, you might try to unpack (if it's packed with i.e. UPX or etc..), like with Universal Extractor.

• You might try to find the obfuscator name using the "DNiD" tool.

• .exe file may be a .net assembly and only after unpacking it becomes readable.

• Dump that exe from runtime using jitDumper3/MegaDumper ( the output will be .NET insted of c++) , And then use your dumped file with de4dot (or Fix the dumped exe which has invalid metadatas! You might try "universal fixer" for that.

Answer 2

I agree with T.Todua on likely causes, but the tools referenced are a bit dated. I'd recommend:

• for packer identification, try PEiD plus custom userdb's (https://www.aldeid.com/wiki/PEiD), ExeInfo-PE (http://exeinfo.pe.hu/plugins.htm), and the Packer rules from Yara-Rules/rules git repository (https://github.com/Yara-Rules/rules)
• for dumping and fixing, OllyDumpEx (https://low-priority.appspot.com/ollydumpex/) and Scylla Import Reconstructor (https://github.com/NtQuery/Scylla) for native Windows code or dnSpy for managed code (https://github.com/0xd4d/dnSpy)