A deobfuscation tool for Eazfuscator.
Warning
EazFixer works by invoking code in the binary it operates on. Either due to fuzzy heuristics or intentional effort on the obfuscator's part, EazFixer may execute code in the binary that is malicious in nature. Never use EazFixer on untrusted binaries unless you are in an insulated environment. Assume that running EazFixer is equivalent to running the binary.
EazFixer is a deobfuscation tool for Eazfuscator, a commercial .NET obfuscator. For a list of features, see the list below.
- String encryption
- Resource encryption
- Assembly embedding
- Entrypoint obfuscation
- Data virtualization
- Code virtualization (consider using EazyDevirt)
- Symbol renaming (symbol names are either unrecoverable or encrypted. For symbol decryption in case of a known key, see EazDecode)
- Automatic code optimization (not an anti-feature!)
- Code control flow obfuscation (I didn't have any problems with my samples in dnSpy)
- Assemblies merging (doesn't seem probable, especially with symbol renaming)
- Control flow obfuscation (use de4dot)
Call from the command line or drag and drop the file on and let it run or use the command line flag --file.
If your assembly is protected with control-flow obfuscation, run it through de4dot with the
--only-cflow-deob flag first.
- --file path
- --keep-types
- --virt-fix
The flag --file is used for the input file.
The flag --keep-types is similar to the de4dot flag, Keeps obfuscator types and assemblies.
The flag --virt-fix keeps certain parts obfuscated to stay working with virtualized assemblies.
example: EazFixer.exe --file test.exe --keep-types
Clone the repository and use the latest version of Visual Studio (2019, at the time of writing).
EazFixer is (and will always be) targeted at the latest version of Eazfuscator. If your version is not supported, try a more universal deobfuscator like de4dot. If your version is newer than what this tool supports, create an issue only after verifying with the latest version of Eazfuscator.
Also, I will not help you use this program. Consider it for advanced users only. If you do run into a problem and are sure it is a bug, feel free to submit an issue but I cannot guarantee I will fix it.
- EazDecode, for decrypting encrypted symbol names in case of a known encryption key.
- eazdevirt, a tool for devirtualizing older version of EazFuscator.
- eazdevirt fork, my abandoned fork of eazdevirt, may work slightly better on newer samples.
This tool uses the following (open source) software:
- dnlib by 0xd4d, licensed under the MIT license, for reading/writing assemblies.
- Harmony by Andreas Pardeike, licensed under the MIT license, for patching the stacktrace which allows for reflection invocation to be used.
