VB.NET Deobfuscator in Treeview
I wrote a sub which opens an exe (.net) and renames it's symbols,
basically this just renames the exe, but it opens it and renames all it's
methods, types, modules, fields, parameters, properties and namespace. All
with help if MonoCecil library.
Private Sub RenameSymbols(ByVal asmDef As AssemblyDefinition)
Dim modd As Integer = 0
Dim type As Integer = 0
Dim method As Integer = 0
Dim param As Integer = 0
Dim field As Integer = 0
Dim propertyy As Integer = 0
Dim namespacee As Integer = 0
Dim namespaceList = New SortedList(Of String, List(Of TypeDefinition))()
For Each moDef In asmDef.Modules
For Each typeDef In moDef.Types
If namespaceList.Keys.Contains(typeDef.Namespace) Then
namespaceList(typeDef.Namespace).Add(typeDef)
Else
namespaceList.Add(typeDef.Namespace, New List(Of
TypeDefinition)() From {typeDef})
End If
Next
Next
For Each member In namespaceList
namespacee += 1
Dim newName = "ns_" & namespacee
For Each typeDef In member.Value
typeDef.Namespace = newName
Next
Next
namespaceList.Clear()
For Each moDef In asmDef.Modules
modd += 1
moDef.Name = "mod_" & modd
For Each typeDef In moDef.Types
type += 1
typeDef.Name = "type_" & type
For Each mDef In typeDef.Methods
If mDef.IsConstructor And mDef.IsRuntimeSpecialName <> 0 Then
method += 1
mDef.Name = "method_" & method
End If
For Each paramDef In mDef.Parameters
param += 1
paramDef.Name = "param_" & param
Next
Next
For Each mField In typeDef.Fields
field += 1
mField.Name = "field_" & field
Next
For Each propDef In typeDef.Properties
propertyy += 1
propDef.Name = "property_" & propertyy
Next
Next
asmDef.Write("C:\Test.exe")
End If
Next
End Sub
Is there a way to get the before renamed data and show it in one tree
view? Like the programm called "Reflector" or "ILSpy" ?
No comments:
Post a Comment