{"id":29308648,"url":"https://github.com/lowlevel01/degremlin","last_synced_at":"2025-08-01T09:37:58.063Z","repository":{"id":302473593,"uuid":"1012573442","full_name":"lowlevel01/deGremlin","owner":"lowlevel01","description":"Decrypt and Patch strings obfuscated with Appfuscator. Tested on Gremlin Stealer.","archived":false,"fork":false,"pushed_at":"2025-07-02T15:43:11.000Z","size":3365,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2025-07-02T15:45:13.137Z","etag":null,"topics":["appfuscator","deobfuscator","gremlin-stealer"],"latest_commit_sha":null,"homepage":"","language":"C#","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/lowlevel01.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2025-07-02T14:36:28.000Z","updated_at":"2025-07-02T15:43:14.000Z","dependencies_parsed_at":"2025-07-02T15:55:26.962Z","dependency_job_id":null,"html_url":"https://github.com/lowlevel01/deGremlin","commit_stats":null,"previous_names":["lowlevel01/degremlin"],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/lowlevel01/deGremlin","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lowlevel01%2FdeGremlin","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lowlevel01%2FdeGremlin/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lowlevel01%2FdeGremlin/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lowlevel01%2FdeGremlin/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/lowlevel01","download_url":"https://codeload.github.com/lowlevel01/deGremlin/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lowlevel01%2FdeGremlin/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":264032346,"owners_count":23546811,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["appfuscator","deobfuscator","gremlin-stealer"],"created_at":"2025-07-07T07:14:37.881Z","updated_at":"2025-07-07T07:14:45.583Z","avatar_url":"https://github.com/lowlevel01.png","language":"C#","funding_links":[],"categories":[],"sub_categories":[],"readme":"# deGremlin\n##### A tool to decrypt and patch strings obfuscated with Appfuscator. Tested on Gremlin Stealer.\n\u003cimg src=\"images/clown.png\" alt=\"Clown\" width=\"400\" height=\"300\"\u003e\n\n\n\n# USAGE\n\n````\n\n       __          ______                              __    _\n      |  ]       .' ___  |                            [  |  (_)\n  .--.| | .---. / .'   \\_| _ .--.  .---.  _ .--..--.   | |  __   _ .--.\n/ /'`\\' |/ /__\\\\| |   ____[ `/'`\\]/ /__\\\\[ `.-. .-. |  | | [  | [ `.-. |\n| \\__/  || \\__.,\\ `.___]  || |    | \\__., | | | | | |  | |  | |  | | | |\n '.__.;__]'.__.' `._____.'[___]    '.__.'[___||__||__][___][___][___||__]\n                                                                        P.S: little bit Appfuscator\n\nUsage:\ndegremlin.exe [filepath] [method_token_in_hex]\n````\n\n\n# Example\n##### This is from the Gremlin Stealer sample\n![](images/before_after.png)\n\n\n# IT DOES\n- [x] Patch most obfuscated strings\n- [x] Simplify Addition and XOR mixed boolean arithmetic\n- [x] Eliminate sizeof's\n- [x] Eliminate EmptyType\n\n\n# TO-DO\n- [ ] Patch terneary operator\n- [ ] Cover more patterns\n\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flowlevel01%2Fdegremlin","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Flowlevel01%2Fdegremlin","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flowlevel01%2Fdegremlin/lists"}