NetReactorVMDecoder
A crude decoder for .NET Reactor of VM Opcodes
Install / Use
/learn @gembleman/NetReactorVMDecoderREADME
It's not perfect. Use it only as a reference when decoding VM opcodes.
Tested only on 32bit exe with .NET Reactor v6.3.
How to use
VMDecoder <origin_assembly_path> [method_id]
//ex) VMDecoder C:\\path\\to\\YourApp.exe(dll) 0
When you decode awesome.exe, this is what you get.
using System;
using System.Text;
public class DecompiledValidator
{
public string SomeFunction(SomeParameter)
{
string local0;
object local1;
object local2;
object local3;
object local4;
object local5;
object local6;
object local7;
object local8;
object local9;
object local10;
object local11;
int local12;
var temp_0 = System.Convert.FromBase64String(serial);
local1 = temp_0;
var temp_1 = System.Linq.Enumerable.Take(32, local1);
var temp_2 = System.Linq.Enumerable.ToArray(temp_1);
local2 = temp_2;
var temp_3 = System.Linq.Enumerable.Skip(32, local1);
var temp_4 = System.Linq.Enumerable.Take(32, temp_3);
var temp_5 = System.Linq.Enumerable.ToArray(temp_4);
local3 = temp_5;
var temp_6 = System.Linq.Enumerable.Skip(64, local1);
var temp_7 = ((string)local1).Length;
var temp_8 = Convert.ToInt32(temp_7);
var temp_9 = (temp_8 - 64);
var temp_10 = System.Linq.Enumerable.Take(temp_9, temp_6);
var temp_11 = System.Linq.Enumerable.ToArray(temp_10);
local4 = temp_11;
var temp_12 = new System.Security.Cryptography.Rfc2898DeriveBytes(1000, local2, "[MethodImpl(MethodImplOptions.NoInlining)]", EMPTY_STACK);
local5 = temp_12;
var temp_13 = System.Security.Cryptography.DeriveBytes.GetBytes(32, local5);
local6 = temp_13;
var temp_14 = new System.Security.Cryptography.RijndaelManaged(EMPTY_STACK);
local7 = temp_14;
var temp_15 = System.Security.Cryptography.SymmetricAlgorithm.set_BlockSize(256, local7);
var temp_16 = System.Security.Cryptography.SymmetricAlgorithm.set_Mode(1, local7);
var temp_17 = System.Security.Cryptography.SymmetricAlgorithm.set_Padding(2, local7);
var temp_18 = System.Security.Cryptography.SymmetricAlgorithm.CreateDecryptor(local3, local6, local7);
local8 = temp_18;
var temp_19 = new System.IO.MemoryStream(local4, EMPTY_STACK);
local9 = temp_19;
var temp_20 = new System.Security.Cryptography.CryptoStream(0, local8, local9, EMPTY_STACK);
local10 = temp_20;
var temp_21 = ((string)local4).Length;
var temp_22 = Convert.ToInt32(temp_21);
var temp_23 = new System.Byte[(int)temp_22];
local11 = temp_23;
var temp_24 = ((string)local11).Length;
var temp_25 = Convert.ToInt32(temp_24);
var temp_26 = System.IO.Stream.Read(temp_25, 0, local11, local10);
local12 = temp_26;
var temp_27 = System.IO.Stream.Close(local9);
var temp_28 = System.IO.Stream.Close(local10);
var temp_29 = System.Text.Encoding.get_UTF8();
var temp_30 = System.Text.Encoding.GetString(local12, 0, local11, temp_29);
local0 = temp_30;
LABEL_88:
if (!Convert.ToBoolean(local10)) goto INST_87;
var temp_31 = System.IDisposable.Dispose(local10);
INST_87:
return null;
LABEL_94:
if (!Convert.ToBoolean(local9)) goto INST_93;
var temp_32 = System.IDisposable.Dispose(local9);
INST_93:
return null;
LABEL_100:
if (!Convert.ToBoolean(local8)) goto INST_99;
var temp_33 = System.IDisposable.Dispose(local8);
INST_99:
return null;
LABEL_106:
if (!Convert.ToBoolean(local7)) goto INST_105;
var temp_34 = System.IDisposable.Dispose(local7);
INST_105:
return null;
LABEL_112:
if (!Convert.ToBoolean(local5)) goto INST_111;
var temp_35 = System.IDisposable.Dispose(local5);
INST_111:
return null;
return local0;
return null; // Default return
}
}
Related Skills
node-connect
344.1kDiagnose OpenClaw node connection and pairing failures for Android, iOS, and macOS companion apps
frontend-design
96.8kCreate distinctive, production-grade frontend interfaces with high design quality. Use this skill when the user asks to build web components, pages, or applications. Generates creative, polished code that avoids generic AI aesthetics.
openai-whisper-api
344.1kTranscribe audio via OpenAI Audio Transcriptions API (Whisper).
qqbot-media
344.1kQQBot 富媒体收发能力。使用 <qqmedia> 标签,系统根据文件扩展名自动识别类型(图片/语音/视频/文件)。
