Smiley face
Smiley face

Monday, June 9, 2014

[Collection] Basics Of Dotnet Reversing

I see a lot of potential in this forum, so I thought about starting the base. Everything uploaded by me is literally uploaded by me, therefore guaranteed to be clean. I am not here to play games.
 
Categorized for your ease.


Decompilers

Spoiler 

NET Reflector - http://www.red-gate.com/products/dotnet-development/reflector/
Mirror (universal keygen) - https://mega.co.nz/#!pV50yRTL!cAp8RH4DuHKeO1UWzXRGahr3IA8C2KI3_s9AE8HUPVc
Short description - The famous decompiler everybody uses. It is worked out to perfectness, almost no bugs are present and features are just more than rich.

Simle Assembly Explorer (SAE) - https://sites.google.com/site/simpledotnet/simple-assembly-explorer
Mirror (v1.14.2) - https://mega.co.nz/#!5MAE1QoC!aHeWawfEClx2FJXa88Qb2XsfHYR7EyfQdgB-qPmR_dc
Short description - Another well-known decompiler. It's aimed at easily editing huge blocks of MSIL code.

GrayWolf https://www.digitalbodyguard.com/graywolf.html
Mirror (v1.88) - https://mega.co.nz/#!VUhjWQxI!K898ZFNJleNgUTyv65rdWVM3fUEDPZSMe9flufv3g_Y
Short description - One extremely underestimated decompiler. It's not developed a lot, has many bugs, but it also owns the unique ability to reflect the MSIL changes to C# in real-time.

Dumpers

Spoiler 

MegaDumper http://forum.tuts4you.com/topic/24087-dotnet-dumper-10/
Mirror - https://mega.co.nz/#!IcpGhIjQ!XJYAymJwuq-iVkCmmQJSpUo57shHbtyFjxqcEL-MN4E
Short description - The ultimate dumper for NET assemblies. This will be your best friend in 99% of the cases.

PETools - check [Misc]

Unpackers/Deobfuscators

Spoiler 

de4dot https://github.com/0xd4d/de4dot
Mirror (v2.0.3) - https://mega.co.nz/#!NcQyCaQB!HmWdY0TTBi0xxfuXcsuApUMDV4RRqs1QMXsl4ldf_m8
Short description - The most well known and most used program to deal with all protected assemblies. Simply drag-n-drop to get your file cleaned.

iMPROVE http://sourceforge.net/projects/improvenetdeobf/
Mirror (v0.1.6) - https://mega.co.nz/#!QVZyUaCQ!GaC_9HCBjl8vzUzDaSdF9SEuIvhm90kYUlw8QADEtT8
Short description - One very unknown deobfuscator and unpacker, aimed to do the job for what de4dot can't.

NoFuser - somewhere @ HF
Mirror (v1.1) - https://mega.co.nz/#!1ZoTzTDZ!kw2Eqn77M7fhAfp_z1xTZTgA_HOJnuoQhzYSh3_yIhU
Short description - Pretty much the only Confuser deobfuscator that actually works. Requires Windows 8 or above with NET Framework 4.5 in order to work!

Misc

Spoiler 

PETools http://sourceforge.net/projects/pe-tools/
Mirror - https://mega.co.nz/#!8FggyCSb!LbgFpwzt8rnkrJvhbsRK8z4Ezt4jjlt-uwIx8xVaW_k
Short description - One of the many all-in-one tools for ... everything connected with PE files.

CFF Toolbox (Explorer Suite) http://www.ntcore.com/exsuite.php
Mirror (portable patched version) - https://mega.co.nz/#!YJ4kHazJ!D-bZphihwWygaEvNKOUHfW3_pI9N2EBu7JsnMWofCr4
Short description - Another extremely useful program. It allows you to easily analyze every PE file and do a lot of nice things with it. Includes a packer analyzer.

StrongNameKiller - not directly found
Mirror - https://mega.co.nz/#!NYxmkIRY!RWW9AdiM7op1Ax7EgLcfUZodRb7iGB-Bu9CrkOQlGQ8
Short description - Again "one of the many", but I found exactly this one working in cases where nothing else worked. Simple but effective, removes any SNK found in a target assembly.


0 Comments:

Post a Comment

Smiley face
Smiley face