https://github.com/TobitoFatitoRE/ArchangelUnCloaker

Public ArchangelCloak Deobfuscator
https://github.com/TobitoFatitoRE/ArchangelUnCloaker

Last synced: 21 days ago
JSON representation

Public ArchangelCloak Deobfuscator

• Host: GitHub
• URL: https://github.com/TobitoFatitoRE/ArchangelUnCloaker
• Owner: TobitoFatitoRE
• License: mit
• Created: 2019-09-20T20:07:16.000Z (over 5 years ago)
• Default Branch: master
• Last Pushed: 2019-09-21T09:31:11.000Z (over 5 years ago)
• Last Synced: 2024-09-04T23:30:53.675Z (5 months ago)
• Language: C#
• Size: 3.02 MB
• Stars: 24
• Watchers: 3
• Forks: 11
• Open Issues: 0
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

• awesome-rainmana - TobitoFatitoRE/ArchangelUnCloaker - Public ArchangelCloak Deobfuscator (C# #)

README

        
# ArchangelUnCloaker

  The First Public Open-Sourced ArchangelCloak Deobfuscator

## How to use:

  Drag n Drop obfuscated program on the deobfuscator exe.

## Careful! This can in theory invoke malware, since it invokes the dll and the dll might be malicious. Always run on sandbox/vm.

 

 Special thanks to holly for his harmony class :D

 

 ## Doesn't Work

  If it doesn't work put the files on the same directory.

  Still doesn't work? The file you are trying to deobfuscate has been renamed

  find the exact assembly name that it had before it was renamed.

 

 ## How does it work

It works by invoking boot method on dll (with harmony attached), then getting the value of the fields and

using DynamicMethodBodyReader it gets the methoddef out of the delegates.