/NetReactorSlayer

An open source (GPLv3) deobfuscator for Eziriz .NET Reactor

Primary LanguageC#GNU General Public License v3.0GPL-3.0

NetReactorSlayer

An open source (GPLv3) deobfuscator for Eziriz .NET Reactor

Preview:

Preview

Currently Supported .NET Reactor Versions:

  • From 6.0.0.0 To 6.8.0.0

Features:

  • Clean Control Flow
  • Restore Hidden Calls
  • Remove Proxy Calls
  • Decrypt Strings
  • Remove Anti Tamper
  • Remove Anti Debugger
  • Decrypt Resources
  • Dump Embedded Assemblies
  • Decrypt Methods (NecroBit)
  • Unpack Native
  • Decrypt Tokens

Usage:

Just drag and drop target obfuscated assembly on it.

Optional commands:

--no-necrobit        Don't decrypt methods (NecroBit).
--no-anti-tamper     Don't remove anti tamper.
--no-anti-debug      Don't remove anti debugger.
--no-hide-call       Don't restore hidden calls.
--no-str             Don't decrypt strings.
--no-rsrc            Don't decrypt assembly resources.
--no-deob            Don't deobfuscate methods.
--no-arithmetic      Don't resolve arithmetic equations.
--no-proxy-call      Don't clean proxied calls.
--no-dump            Don't dump embedded assemblies.
--no-remove          Don't remove obfuscator methods, resources, etc...
--no-decrypt-token   Don't decrypt tokens.

Known Issues:

  • Strings are still encrypted after deobfuscation:

In some targets string decryptor method is virtualized, that's why NetReactorSlayer can't decrypt strings.

How to know is string decryptor method is virtualized or not:

The normal string decryptor method should looks like this: image And the virtualized string decryptor method should looks like one of below images: image

image

  • Control Flow Deobfuscator Not Working / Control Flow Deobfuscator Deleted Most OpCodes:

.NET Reactor 6.7 or above use some arithmetic equations to apply control flow: image if you click on the class of field, You'll see one of class methods define the fields value on runtime: image NetReactorSlayer get that fields value to deobfuscate control flow, but in some targets this method is virtualized and the method goanna looks like one of below images: image

image That's why NetReactorSlayer get's failed to clean controlflow because it's don't have a feature yet to devirtualize virtualized methods.

  • Target file not working after deobfuscation:

  • Try to save deobfuscated file with Preserve all MD tokens & Keep old MaxStack options: image

Note:

Its free, but there is no support for it, I'll keep updating it for latest .NET Reactor version as I can.

Credits: