I'm trying to deobfuscate a .NET exe file, using de4dot. I have many dll files, when I open the dll file with .NET Reflector, it appears like this:
And when I did the deobfuscation again with de4dot
, some stuff are cleaned:
When I open that cleaned-dll, all the variables and class name look very strange, it's not related with the code inside that function.
Have you guys seen this before? How can I get the real name of functions and variables ? Did they use 2 times obfuscation ?
Link to download application files : https://dl.dropboxusercontent.com/u/10907501/bc/UW.rar
[0,1,2,3,4]
etc.. before they were randomized, to attempt to find their offsets. It's possible that in the RNG the value[3,4,0,1,2]
is really positions[4,5,1,2,3]
The more dedicated you are to figuring this out then you will actually figure it out.. because nothing is really lost, it's just computed/swapped :) You will need to find the string table then re-order it back and if it's correct everything will go back in place