Deobfuscate and decompile dll

[Gavin]

Hi, I'm not sure I'm even in the right place, but I have a dll which I cannot decompile or read via dotpeek, all I get is the obfuscated method names and no actual content. I've downloaded and installed both JustDecompile and the De4dot plug in. When I open the dll via JustDecompile, I get the same behaviour, obfuscated method names and no content, just an error which reads

 

Current member / type: _1MbkbW8ta
File path: xxxxxxxxxx

Product version: 2015.2.623.1
Operation is not valid due to the current state of the object.
at Mono.Cecil.Cil.CodeReader.ReadMethodBody() in c:\Builds\245\Behemoth\ReleaseBranch Production Build\Sources\OpenSource\Mono.Cecil\Mono.Cecil.Cil\CodeReader.cs:line 102
at Mono.Cecil.Cil.CodeReader.ReadMethodBody(MethodDefinition method) in c:\Builds\245\Behemoth\ReleaseBranch Production Build\Sources\OpenSource\Mono.Cecil\Mono.Cecil.Cil\CodeReader.cs:line 66
at Mono.Cecil.MetadataReader.ReadMethodBody(MethodDefinition method) in c:\Builds\245\Behemoth\ReleaseBranch Production Build\Sources\OpenSource\Mono.Cecil\Mono.Cecil\AssemblyReader.cs:line 2114
at Mono.Cecil.MethodDefinition.<get_Body>b__2(MethodDefinition method, MetadataReader reader) in c:\Builds\245\Behemoth\ReleaseBranch Production Build\Sources\OpenSource\Mono.Cecil\Mono.Cecil\MethodDefinition.cs:line 180
at Mono.Cecil.ModuleDefinition.Read[TItem,TRet](TRet& variable, TItem item, Func`3 read) in c:\Builds\245\Behemoth\ReleaseBranch Production Build\Sources\OpenSource\Mono.Cecil\Mono.Cecil\ModuleDefinition.cs:line 985
at Mono.Cecil.MethodDefinition.get_Body() in c:\Builds\245\Behemoth\ReleaseBranch Production Build\Sources\OpenSource\Mono.Cecil\Mono.Cecil\MethodDefinition.cs:line 180
at ——.ƒ˜.™—(MethodDefinition €, ILanguage , — —) in c:\Builds\245\Behemoth\ReleaseBranch Production Build\Sources\OpenSource\Cecil.Decompiler\Decompiler\WriterContextServices\BaseWriterContextService.cs:line 41
at ——.ƒ˜.Ÿ—(MethodDefinition €, ILanguage , — —) in c:\Builds\245\Behemoth\ReleaseBranch Production Build\Sources\OpenSource\Cecil.Decompiler\Decompiler\WriterContextServices\BaseWriterContextService.cs:line 157
at ——.ƒ˜.˜(TypeDefinition ‹, ILanguage ) in c:\Builds\245\Behemoth\ReleaseBranch Production Build\Sources\OpenSource\Cecil.Decompiler\Decompiler\WriterContextServices\BaseWriterContextService.cs:line 347
at ——.‡˜.“—(IMemberDefinition
, ILanguage ) in c:\Builds\245\Behemoth\ReleaseBranch Production Build\Sources\OpenSource\Cecil.Decompiler\Decompiler\WriterContextServices\SimpleWriterContextService.cs:line 25
at Ÿ˜..(TypeDefinition ‹, –— ’, Boolean ˜‘, Boolean
™, Boolean ”˜) in c:\Builds\245\Behemoth\ReleaseBranch Production Build\Sources\OpenSource\Cecil.Decompiler\Languages\NamespaceImperativeLanguageWriter.cs:line 36
at .š.Ÿ—( ›, ˜ ‹Ž) in c:\Builds\245\Behemoth\ReleaseBranch Production Build\Sources\UI\JustDecompile.CodeViewer\Writers\TypeDefinitionCodeWriter.cs:line 52

 

Does this mean I'm doing something wrong, or have I just found a dll which isn't handled by either/both JustDecompile and De4dot?

 

Many thanks in advance,

[Alexander]

Hello,

Opening an obfuscated assembly in JustDecompile is not a supported scenario. The De4dot plugin is the best attempt in this case, but it's not guarantied to fix everything.

Keep in mind that the plugin does not work automatically. You can use it by right clicking on the assembly in the tree view on the left and then De4dot -> Obfuscator Search. By doing that you will run the plugin. If De4dot doesn't help, you can assume that this dll cannot be opened in JustDecompile.

Regards,
Alexander
Telerik