themaoci/csharp-eft-deobfuscation.md

## csharp-eft-deobfuscation.md

      
    Raw
  

              csharp-eft-deobfuscation.md
            
          
    Deobfuscation


Open obfuscated assembly
Save module with MD Writed Options / Preserve Heap Offsets && Create Heap Even If Empty ticked ON
In same file go to -.ActionTrigger variable StateFalseAnim open \uE000 Token of this will be used to deobfuscate string, 0600???? is an template
Go to de4dot program open cmd in that folder and paste string from below withc changed path and token.

de4dot.exe --un-name "!^<>[a-z0-9]$&!^<>[a-z0-9]__.*$&![A-Z][A-Z]\$<>.*$&^[a-zA-Z_<{$][a-zA-Z_0-9<>{}$.`-]*$" "{$DIR}\Assembly-CSharp.dll" --strtyp delegate --strtok {$TOKEN}

to be continued ??