dotscope 0.7.0

A high-performance, cross-platform framework for analyzing and reverse engineering .NET PE executables
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41

//! BitMono-specific deobfuscation techniques.
//!
//! BitMono is an open-source .NET packer with 16 independent protections across
//! 4 categories. Unlike ConfuserEx (layered/interdependent), BitMono protections
//! are independent plugins, each detectable and reversible individually.
//!
//! # Technique Overview
//!
//! | Technique | Kind | Category | Description |
//! |-----------|------|----------|-------------|
//! | [`BitMonoCalli`] | SSA | Structure | Reverses CallToCalli indirect call pattern |
//! | [`BitMonoStrings`] | SSA | Value | Decrypts AES+PBKDF2 encrypted strings |
//! | [`BitMonoHooks`] | Byte | Protection | Reverses DotNetHook method redirections |
//! | [`BitMonoUnmanaged`] | SSA | Value | Detects fake native string methods |
//! | [`BitMonoAntiDebug`] | SSA | Neutralization | Removes timing-based anti-debug checks |
//! | [`BitMonoJunk`] | Byte | Metadata | Detects `br.s` junk prefix trampolines |
//! | [`BitMonoNops`] | SSA | Neutralization | Removes BillionNops dead methods |
//! | [`BitMonoPeRepair`] | Byte | Protection | Detects PE-level header corruptions |
//! | [`BitMonoRenamer`] | SSA | Metadata | Detects FullRenamer space-containing names |

mod calli;
mod debug;
mod hooks;
mod junk;
mod nops;
mod pe;
mod renamer;
mod strings;
mod unmanaged;

pub use calli::BitMonoCalli;
pub use debug::BitMonoAntiDebug;
pub use hooks::BitMonoHooks;
pub use junk::BitMonoJunk;
pub use nops::BitMonoNops;
pub use pe::BitMonoPeRepair;
pub use renamer::BitMonoRenamer;
pub use strings::BitMonoStrings;
#[cfg(feature = "legacy-crypto")]
pub use strings::StringFindings;
pub use unmanaged::BitMonoUnmanaged;