1

I'm trying to deobfuscate a .NET exe file, using de4dot. I have many dll files, when I open the dll file with .NET Reflector, it appears like this:

Step 1

And when I did the deobfuscation again with de4dot, some stuff are cleaned:

Step 2

When I open that cleaned-dll, all the variables and class name look very strange, it's not related with the code inside that function.

Step 3

Have you guys seen this before? How can I get the real name of functions and variables ? Did they use 2 times obfuscation ?

Link to download application files : https://dl.dropboxusercontent.com/u/10907501/bc/UW.rar

Improve this question
2
  • 2
    I doubt you could get the original name of the functions. I think the obfuscation technique used randomly switched the function names within the assembly, or used random function names from a list. If the prior happend, you could guess which function name belongs to a certain function, after observing what it does. I don't know which obfuscation software has this "func name switching" feature, but if you find out, maybe you can observe what it uses to decide the switching and restore it manually.
    – Dominik Antal
    Sep 9, 2014 at 9:24
  • Find out how the RNG worked what seed used etc.. and you will be able to compile a list of RNG values which could aid in the reverse process, consider a set of values [0,1,2,3,4] etc.. before they were randomized, to attempt to find their offsets. It's possible that in the RNG the value [3,4,0,1,2] is really positions [4,5,1,2,3] The more dedicated you are to figuring this out then you will actually figure it out.. because nothing is really lost, it's just computed/swapped :) You will need to find the string table then re-order it back and if it's correct everything will go back in place
    – SSpoke
    Oct 6, 2014 at 21:58

1 Answer 1

Reset to default
5

This is definitely one of the naming schemes from Crypto Obfuscator.

As listed on their features page:

Fake Renaming Scheme

Crypto Obfuscator also has a renaming mode which renames all classes, fields, methods, etc to fake but realistic names like Domain/Log/Stream/etc (for classes) or Open/Close/Clear/Delete/etc for methods and so on. This makes it extremely difficult to differentiate between symbols excluded from obfuscation and obfuscated symbols.

Also, running de4dot through Command Prompt should display the detected obfuscator.

Improve this answer
1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.