de4dot VG

A de4dot fork with full support for VirtualGuard Protector

Refer to the blogpost for more information.
https://mrt4ntr4.github.io/VirtualGuard-P1/

Features

• Fixes control flow
• Fixes proxy calls
• Removes Anti-Debug methods
• Removes Anti-Tamper methods

Original README

---

Samples

Before (obfuscated):

9.6 <<EMPTY_NAME>> = new 9.6();
byte[] buffer;
Assembly assembly;
for (;;)
{
	IL_06:
	uint num = 0x6FB11A9DU;
	for (;;)
	{
		uint num2;
		switch ((num2 = (num ^ 0x7C4718BDU)) % 0xAU)
		{
		case 0U:
		{
			uint num3 = num2;
			uint[] array = new uint[4];
			array[0] = 0x17FU;
			array[1] = 5U + array[0];
			array[2] = 0x12DU - array[1] + array[0];
			array[3] = 0x2E6U - array[2] + array[1] - array[0];
			uint num4 = num3 / array[3];
			num = num4 - 0xC4EFA7F5U;
			continue;
		}
		case 1U:
		{
			bool flag;
			num = (((!flag) ? 0x2FB1F33CU : 0x78195D88U) ^ num2 / 0x69CU);
			continue;
		}
		case 2U:
		{
			buffer = new byte[2];
			uint num5 = num2;
			uint[] array = new uint[3];
			array[0] = 0x106U;
			array[1] = 0x29FU - array[0];
			array[2] = 0x15AU + array[1] - array[0];
			uint num6 = num5 / array[2];
			num = num6 - 0xA952A5ABU;
			continue;
		}
		case 3U:
			goto IL_06;
		case 4U:
		{
			<<EMPTY_NAME>>.0e. = A_0;
			uint num7 = num2;
			uint[] array = new uint[3];
			array[0] = 0x6DU;
			array[1] = 0x10DU - array[0];
			array[2] = 0x22FU - array[1] - array[0];
			uint num8 = num7 / array[2];
			num = num8 - 0x865CCA94U;
			continue;
		}
		case 5U:
			goto IL_22E;
		case 6U:
		{
			assembly = ed.f3();
			uint num9 = num2;
			uint[] array = new uint[4];
			array[0] = 0x1E5U;
			array[1] = 0xFFFFFF2AU + array[0];
			array[2] = 0xFFFFFE5BU + array[1] + array[0];
			array[3] = 0x361U + array[2] - array[1] - array[0];
			uint num10 = num9 / array[3];
			num = num10 - 0xB8623758U;
			continue;
		}
		case 7U:
		{
			bool flag = 9.ab1.;
			uint num11 = num2;
			uint[] array = new uint[4];
			array[0] = 0xDDU;
			array[1] = 0x47U + array[0];
			array[2] = 0x3B5U - array[1] - array[0];
			array[3] = 0xBDU + array[2] - array[1] - array[0];
			uint num12 = num11 / array[3];
			num = num12 - 0xD8E918C6U;
			continue;
		}
		case 9U:
			9.cb2. = new Dictionary<int, 9.85>();
			num = 0x3FBD817DU;
			continue;
		}
		goto Block_1;
	}
}

After:

9.6 <<EMPTY_NAME>> = new 9.6();
<<EMPTY_NAME>>.0e. = A_0;
if (!9.ab1.)
{
	9.cb2. = new Dictionary<int, 9.85>();
	byte[] buffer = new byte[2];
	Assembly executingAssembly = Assembly.GetExecutingAssembly();