Deobfuscate and decompile dll

2 posts, 0 answers
  1. Gavin
    Gavin avatar
    1 posts
    Member since:
    Jul 2015

    Posted 08 Jul 2015 Link to this post

    Hi, I'm not sure I'm even in the right place, but I have a dll which I cannot decompile or read via dotpeek, all I get is the obfuscated method names and no actual content. I've downloaded and installed both JustDecompile and the De4dot plug in. When I open the dll via JustDecompile, I get the same behaviour, obfuscated method names and no content, just an error which reads

     

    Current member / type: _1MbkbW8ta
    File path: xxxxxxxxxx

    Product version: 2015.2.623.1
    Operation is not valid due to the current state of the object.
    at Mono.Cecil.Cil.CodeReader.ReadMethodBody() in c:\Builds\245\Behemoth\ReleaseBranch Production Build\Sources\OpenSource\Mono.Cecil\Mono.Cecil.Cil\CodeReader.cs:line 102
    at Mono.Cecil.Cil.CodeReader.ReadMethodBody(MethodDefinition method) in c:\Builds\245\Behemoth\ReleaseBranch Production Build\Sources\OpenSource\Mono.Cecil\Mono.Cecil.Cil\CodeReader.cs:line 66
    at Mono.Cecil.MetadataReader.ReadMethodBody(MethodDefinition method) in c:\Builds\245\Behemoth\ReleaseBranch Production Build\Sources\OpenSource\Mono.Cecil\Mono.Cecil\AssemblyReader.cs:line 2114
    at Mono.Cecil.MethodDefinition.<get_Body>b__2(MethodDefinition method, MetadataReader reader) in c:\Builds\245\Behemoth\ReleaseBranch Production Build\Sources\OpenSource\Mono.Cecil\Mono.Cecil\MethodDefinition.cs:line 180
    at Mono.Cecil.ModuleDefinition.Read[TItem,TRet](TRet& variable, TItem item, Func`3 read) in c:\Builds\245\Behemoth\ReleaseBranch Production Build\Sources\OpenSource\Mono.Cecil\Mono.Cecil\ModuleDefinition.cs:line 985
    at Mono.Cecil.MethodDefinition.get_Body() in c:\Builds\245\Behemoth\ReleaseBranch Production Build\Sources\OpenSource\Mono.Cecil\Mono.Cecil\MethodDefinition.cs:line 180
    at ——.ƒ˜.™—(MethodDefinition €, ILanguage , — —) in c:\Builds\245\Behemoth\ReleaseBranch Production Build\Sources\OpenSource\Cecil.Decompiler\Decompiler\WriterContextServices\BaseWriterContextService.cs:line 41
    at ——.ƒ˜.Ÿ—(MethodDefinition €, ILanguage , — —) in c:\Builds\245\Behemoth\ReleaseBranch Production Build\Sources\OpenSource\Cecil.Decompiler\Decompiler\WriterContextServices\BaseWriterContextService.cs:line 157
    at ——.ƒ˜.˜(TypeDefinition ‹, ILanguage ) in c:\Builds\245\Behemoth\ReleaseBranch Production Build\Sources\OpenSource\Cecil.Decompiler\Decompiler\WriterContextServices\BaseWriterContextService.cs:line 347
    at ——.‡˜.“—(IMemberDefinition , ILanguage ) in c:\Builds\245\Behemoth\ReleaseBranch Production Build\Sources\OpenSource\Cecil.Decompiler\Decompiler\WriterContextServices\SimpleWriterContextService.cs:line 25
    at Ÿ˜..(TypeDefinition ‹, –— ’, Boolean ˜‘, Boolean ™, Boolean ”˜) in c:\Builds\245\Behemoth\ReleaseBranch Production Build\Sources\OpenSource\Cecil.Decompiler\Languages\NamespaceImperativeLanguageWriter.cs:line 36
    at .š.Ÿ—( ›, ˜ ‹Ž) in c:\Builds\245\Behemoth\ReleaseBranch Production Build\Sources\UI\JustDecompile.CodeViewer\Writers\TypeDefinitionCodeWriter.cs:line 52

     

    Does this mean I'm doing something wrong, or have I just found a dll which isn't handled by either/both JustDecompile and De4dot?

     

    Many thanks in advance,

  2. Alexander
    Admin
    Alexander avatar
    80 posts

    Posted 14 Jul 2015 Link to this post

    Hello,

    Opening an obfuscated assembly in JustDecompile is not a supported scenario. The De4dot plugin is the best attempt in this case, but it's not guarantied to fix everything.

    Keep in mind that the plugin does not work automatically. You can use it by right clicking on the assembly in the tree view on the left and then De4dot -> Obfuscator Search. By doing that you will run the plugin. If De4dot doesn't help, you can assume that this dll cannot be opened in JustDecompile.

    Regards,
    Alexander
    Telerik
    Do you want to have your say when we set our development plans? Do you want to know when a feature you care about is added or when a bug fixed? Explore the Telerik Feedback Portal and vote to affect the priority of the items
  3. DevCraft banner
Back to Top