# de4dot
# .NET deobfuscator — remove obfuscation from .NET assemblies
# FOR610 Labs: 4.8 | Sections: 4
# Docs: https://docs.remnux.org/discover-the-tools/statically+analyze+code/.net

% dotnet, deobfuscation

# Basic usage
de4dot obfuscated.exe


# --- Recipes (multi-tool chains) ---

# >> Decompile .NET on Command Line
# Decompile to C# source
ilspycmd <assembly.exe> > source.cs
# Search for suspicious patterns
grep -n 'Assembly.Load\|WebClient\|Process.Start' source.cs
# If obfuscated, deobfuscate first
de4dot <assembly.exe>
ilspycmd <assembly-cleaned.exe> > source_clean.cs