dotscope 0.7.0

A high-performance, cross-platform framework for analyzing and reverse engineering .NET PE executables
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

//! JIEJIE.NET-specific deobfuscation techniques.
//!
//! JIEJIE.NET is an IL-text-level obfuscator that operates through ildasm/ilasm.
//! Detection is purely structural — no reliance on type or method names, since
//! JIEJIE.NET's rename feature transforms all identifiers.
//!
//! # Techniques
//!
//! | ID | Pattern | Category |
//! |---|---|---|
//! | `jiejienet.constants` | All-static-initonly-int32 class with ldc.i8 delta chain .cctor | Value |
//! | `jiejienet.strings` | Classes with `dcsoft(byte[], int64) -> string` decryptor | Value |
//! | `jiejienet.typeof` | RuntimeTypeHandle[] container with index accessor | Value |
//! | `jiejienet.arrays` | RuntimeFieldHandle[] container with index accessor | Value |
//! | `jiejienet.resources` | Stream subclass nested in type with Dictionary<string,byte[]> | Value |

// Detection techniques
mod arrays;
mod constants;
mod resources;
mod strings;
mod typeofs;

pub use arrays::JiejieNetArrays;
pub use constants::JiejieNetConstants;
pub use resources::JiejieNetResources;
pub use strings::JiejieNetStrings;
pub use typeofs::JiejieNetTypeOf;