Home

Awesome

Project Old Rod - KoiVM Devirtualisation tool

License: GPL v3 Master branch build status

Project Old Rod is an automated command-line utility that attempts to disassemble any .NET application protected by the KoiVM virtualiser plugin for ConfuserEx. Additionally, it tries to recompile the VM code back to .NET CIL in an attempt to recover the original code.

Project Old Rod is released under the GPLv3 license.

Usage:

Dependencies

The devirtualiser is powered by the following projects:

These are submodules or nuget packages. Be sure to clone/restore all of them when building the project.

Binaries

Get the latest build from the AppVeyor build server.

Alternatively, you can build the project yourself using MSBuild or an IDE that works with MSBuild (such as Visual Studio and JetBrains Rider).

FAQ

Is Old Rod a deobfuscator?

No. It only disassembles the code and recompiles it. It will not simplify control flow, nor will it decrypt your strings, simplify arithmetic expressions, rename all symbols, decrypt resources, or anything like that. For this, other tools exist.

Will Old Rod support modifications of KoiVM?

Yes and no.

Old Rod's recompiler is quite generic and is built to be able to resist several architectural changes. For example, it does not rely on hardcoded opcode sequences or the like in the actual virtualized code. See here for more information on how that is done. Furthermore, there are some command-line arguments that you can use to override certain auto detection systems and behaviour (see OldRod.exe --help).

That being said, it will always be possible to break Old Rod's automatic detection systems with very minimal changes to vanilla KoiVM (lazy modifications such as changing the signature of the methods in VMEntry or VMConstants). It is not worth the time and effort to support each and every one of them that can be found on the internet, unless one of these mods gets very popular. Therefore, don't expect drag-n-drop to always work on binaries protected by modifications of KoiVM, nor support for them in the near future.

Heeeeeelp! it...

These are features, not bugs. You can turn them off by using:

OldRod.exe <input-file> --dont-crash --no-errors --no-output-corruption

If the above does not work, please consider going to the issue tracker and file a detailed bug report, preferably using the issue template and sample binary.

How do I troubleshoot Old Rod?

Old Rod has quite a few diagnostics built-in that might help you out:

Why did you create this?

I thought it would be a cool project.

Why did you release this?

The original author of KoiVM released the source code for free.

Why is the project so complicated?

Because KoiVM is more complicated than the average VM that is out there for .NET. Check out the docs to find out how the recompiler works.

Also I am probably not the best coder or reverse engineer.

Couldn't you just use pattern matching for every CIL instruction like normal people?

Sure, but I am stubborn, I don't like to write countless of patterns, and I like writing compilers. The last reason is also the main reason this project was started in the first place.

What is the OldRod.Core.CodeGen namespace that is injected?

Not all instructions are always perfectly translated to CIL, and still require some of the original features of KoiVM (most notably, the flags register as the CLR does not have one). For this, the code generator might inject some code to emulate the behaviour of these features. This is put into this namespace.

What's with the name and the Magikarp?

In the original release of KoiVM, the plugin description mentions a Magikarp virtualising your code. In the original Pokémon games, the best way to catch a Magikarp is using an old rod.

...

Honestly, I don't know, I am probably weird...