📈 GH Trending Explorer 🎲 Surprise me

← all repos

Networkapbridge / dll-decryptor

git clone https://github.com/Networkapbridge/dll-decryptor.git

dll decryptor — dumps encrypted DLL payloads, resolves imports, rebuilds PE headers, exports or memory-maps the decrypted module

+71
stars, 24h · #127
+71
stars, 7 days · #711
+71
stars, 30 days · #3,197
71
★ total · +71% this week
31
forks · 0 open issues

Star history starts 2026-10-20; the chart appears after the second daily snapshot.

LanguageHTML
LicenseMIT
Created2026-10-20 (today)
Last pushtoday
Watchers6
OwnerUser

GitHub topics

Links

README excerpt
---
**The only DLL decryptor that reads obfuscated game modules the way the runtime does — then hands you the plain source-level output.**
I've been reversing Unity and Unreal protected assemblies for six months, reading every forum thread on dll decryptor that exists, and this repo is what I wish someone had handed me on day one: a single `.exe` that dumps decrypted DLLs, resolves obfuscated imports, and rebuilds callable module stubs without a compiler in sight.
---
## 🗣️ Community & Support
- **Issue tracker** — bug reports, crash dumps, and feature requests live in the repo Issues tab.
- **Discussions** — post your decrypted module dumps, share protected-DLL samples, and compare obfuscator signatures with other reversers.
- **Discord** — link is pinned in Discussions; the `#dll-decryptor` channel is where hotfixes get announced before release.
- **Docs folder** — every supported obfuscator gets a markdown cheat sheet in `/docs` with sample output.
- **Sample vault** — community-contributed test DLLs (Themida, VMProtect, ConfuserEx, Unity IL2CPP) in `/samples`.
> Reverse-engineering protected binaries is a hobbyist research activity in most jurisdictions — check your local rules and only decrypt DLLs you own or are licensed to inspect. Use at your own risk.
---
## 🧠 Overview
| Category | Details |
|---|---|
| Tool type | Standalone Windows DLL decryptor / unpacker / deobfuscator |
| Input | Packed or obfuscated `.dll`, `.exe`, IL2CPP `GameAssembly.dll` |
| Output | Decrypted PE, recoverable IL, resolved imports, readable strings |
| Runtime | Single portable `.exe`, no install, no dependencies |
| Methods | Runtime dump, static unpack, import reconstruction, IL repair |
| Scope | Game modules, mod loaders, cheat loaders, plugin DLLs |
The dll decryptor works by running the target module in a suspended helper process, catching the moment the packer hands off decrypted code to the loader, and snapshotting the memory region before protection re-encrypts it. From there, import rebuilding, section alignment, and IL metadata repair are applied until you get a module that opens cleanly in dnSpy, IDA, or Ghidra.
---
## 📖 What is a dll decryptor?
| Term | Explanation |
|---|---|
| **DLL decryptor** | A tool that reverses runtime encryption placed on a `.dll` by a packer or obfuscator and returns the plain module |
| **PE dump** | A memory snapshot of the loaded image rewritten back to a valid on-disk PE file |
| **Packer handoff** | The precise instruction boundary where a protector gives plaintext to the loader — the decryptor's target window |
| **Import reconstruction** | Rebuilding the import address table after a packer destroys or virtualizes it |
| **IL repair** | Rewriting obfuscated CIL method bodies back into something a decompiler can read |
| **Stub regeneration** | Emitting fresh callable stubs so you can actually invoke decrypted exports |
| **IAT rebuild** | Fixing the import table so the decrypted DLL does not crash on `LoadLibrary` |
-