Preserving Metadata Tokens During Deobfuscation

Use the --preserve-tokens flag to maintain important metadata tokens, the #US and #Blob heaps, and retain junk signature data. It's often advisable to combine this with --keep-types to prevent removal of obfuscator types and methods.

For most scenarios, preserving method parameter tokens isn't necessary. Use --preserve-table all,-pd to maintain all significant tokens except parameter definitions.

In cases like Confuser-protected assemblies, add --keep-names d to rename all elements except delegate type fields. Unsupported obfuscators automatically preserve all tokens.

Examples

de4dot --preserve-tokens --keep-types target.dll

de4dot --keep-names d --preserve-table all,-pd target.dll

Handling Multiple Obfuscation Layers

When multiple obfuscators are detected, de4dot provides guidance on forcing detection of specific types. Deobfuscation should proceed in reverse order of application, using --preserve-tokens to maintain metadata integrity for subsequent processing.

Use the -p parameter to specify obfuscator type (view available types with de4dot -h). For files processed with 'sa' followed by 'ef':

de4dot --preserve-tokens --dont-rename input.dll -p ef -o intermediate.dll
de4dot intermediate.dll -p sa -o final.dll

String Decryption for Unsupported Obfuscators

Identify the string decrypter's metadata token using tools like Simple Assembly Explorer. The token appears as a hexadecimal value when hovering over method names.

For dynamic decryption:

de4dot target.dll --strtyp delegate --strtok 06001234

Multiple decrypters require additional tokens:

de4dot target.dll --strtyp delegate --strtok 06001234 --strtok 06001235

Use --strtype emulate if dynamic methods are detected. Execute unknown code only in sandboxed environments for security.

Post-Rneaming Crash Analysis

Supported obfuscators typically handle renaming correctly, but issues may arise when:

• Resources aren't renamed alongside their consuming classes
• Referencing assemblies contain outdated metadata

Simultaneously process interdependent assemblies:

de4dot AssemblyA.dll AssemblyB.dll

.NET Reactor Native Method Handling

Methods displaying throw (uint)-559038242 (equivalent to throw 0xDEADCODE) indicate encrypted native code methods. These are replaced at runtime by the obfuscator's method decryptor. Output messages like "Re-encrypted 10/73 native methods" indicate successfully processed methods, with remaining native methods potentially convertible in future versions.