Probably, many of you have ever seen the message from
de4dot while trying to deobfuscate app/dll:
WARNING: The file isn't a .NET PE file:
What steps to take in such cases to proceed? How to make the
.exe file to be detected as valid
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.Sign up to join this community
As a programmer myself, I have to again and again tell and shout, that if the purpose is cracking/stealing, then you should not do that for the sake of honesty. If the purpose is good, then I'll share my solutions.
At first, the language should be determined, if it's either a real
.NET file or not.
You can use the "PEiD" tool (or if you do not have a good custom signature database for "PEiD", then use "TridNet") to analyze the file and determine the language (that will be approximation).
Open it with CFF Explorer. If you don't see the .NET Directory, then this is a native dll, not .NET. Check what language is that. ( sometimes, use "Dependances" to view, if you reference MSCEERE.DLL, it contains managed code, if you reference MSVCR100.DLL, it contains Native Code.)
Now, there seems to be 2 possible scenarios:
de4dotis made for
.NETfiles. So, your executable might be a shell packed file, or
Win32exe, or program is not written by
.NETlanguages. For example, Visual C++ (i.e. written in Delphi or etc) has nothing to do with the
.NETFramework, so you can discard the
.NET decompiler(Reflector, ILSpy, etc) to get some code. In that case, you will have to go for the most complicated route and get back to reversing (with IDA, OllyDbg or any other similar and see what you can get in ASM, + HexRays Decompiler ).
.NETprogram, but hardened:
At first, you might try to unpack (if it's packed with i.e. UPX or etc..), like with
You might try to find the obfuscator name using the "DNiD" tool.
.exe file may be a .net assembly and only after unpacking it becomes readable.
Dump that exe from runtime using jitDumper3/MegaDumper ( the output will be .NET insted of c++) , And then use your dumped file with de4dot (or Fix the dumped exe which has invalid metadatas! You might try "universal fixer" for that.
I agree with T.Todua on likely causes, but the tools referenced are a bit dated. I'd recommend: