burningcyclebike / netreactorslayer

An open source (GPLv3) deobfuscator and unpacker for Eziriz .NET Reactor

.NETReactorSlayer

.NETReactorSlayer is an open source (GPLv3) deobfuscator and unpacker for Eziriz .NET Reactor.

Preview

GUI	CLI

Features & Commands:

Command	Description	Default Value
	Unpack native stub
--dec-methods	Decrypt methods body	True
--fix-proxy	Fix proxied calls	True
--dec-strings	Decrypt strings	True
--dec-rsrc	Decrypt assembly resources	True
--dec-bools	Decrypt booleans	True
--deob-cflow	Deobfuscate control flow	True
--deob-tokens	Deobfuscate tokens	True
--dump-asm	Dump embedded assemblies	True
--dump-costura	Dump assemblies that embedded by Costura.Fody	True
--inline-methods	Inline short methods	True
--rename	Rename n(amespaces), t(ypes), m(ethods), p(rops), e(vents), f(ields)	ntmfe
--rename-short	Rename short names	False
--dont-rename	Don't rename classes, methods, etc..	False
--rem-antis	Remove anti tamper & anti debugger	True
--rem-sn	Remove strong name removal protection	True
--rem-calls	Remove calls to obfuscator methods	True
--rem-junks	Remove junk types, methods, fields, etc...	True
--keep-types	Keep obfuscator types, methods, fields, etc...	False
--preserve-all	Preserve all metadata tokens	False
--keep-max-stack	Keep old max stack value	False
--no-pause	Close CLI immediately after deobfuscation	False
--verbose	Verbose mode	False

Known Issues:

• If target file is not working after deobfuscation try using --preserve-all and/or --keep-max-stack command(s).

• Since .NETReactorSlayer does not yet have the ability to de-virtualize virtualized functions, if the target protected assembly contains virtualized functions, .NETReactorSlayer may fail to de-obfuscate some protections such as string encryption and control flow.

➡️Click to see few example of comparing virtualized functions with normal functions

Normal	Virtualized
	Or

Normal	Virtualized
	Or

Contribution:

Want to contribute to this project? Feel free to open a pull request.

Donations:

License:

.NETReactorSlayer is licensed under GPLv3.

Credits:

• dnlib
• de4dot.blocks
• Harmony