themaoci

Deobfuscation

• Open obfuscated assembly
• Save module with MD Writed Options / Preserve Heap Offsets && Create Heap Even If Empty ticked ON
• In same file go to -.ActionTrigger variable StateFalseAnim open \uE000 Token of this will be used to deobfuscate string, 0600???? is an template
• Go to de4dot program open cmd in that folder and paste string from below withc changed path and token.

de4dot.exe --un-name "!^<>[a-z0-9]$&!^<>[a-z0-9]__.*$&![A-Z][A-Z]\$<>.*$&^[a-zA-Z_<{$][a-zA-Z_0-9<>{}$.`-]*$" "{$DIR}\Assembly-CSharp.dll" --strtyp delegate --strtok {$TOKEN}

to be continued ??

themaoci

<?php
function getBrowserData()
{
	/* Made By TheMaoci */
    $u_agent = $_SERVER['HTTP_USER_AGENT'];
    $bname = 'Unknown';
    $platform = 'Unknown';
    $version= "";
    $osArray = array(
        '/windows nt 10.0/i'    =>  'Windows 10',