Networkapbridge / dll-decryptor
git clone https://github.com/Networkapbridge/dll-decryptor.git
dll decryptor — dumps encrypted DLL payloads, resolves imports, rebuilds PE headers, exports or memory-maps the decrypted module
+71
stars, 24h · #127
+71
stars, 7 days · #711
+71
stars, 30 days · #3,197
71
★ total · +71% this week
31
forks · 0 open issues
Star history starts 2026-10-20; the chart appears after the second daily snapshot.
LanguageHTML
LicenseMIT
Created2026-10-20 (today)
Last pushtoday
Watchers6
OwnerUser
GitHub topics
assembly-decryptorbinary-analysiscsharp-decompilerdll-decryptiondll-decryptordll-unpackerdll-unpackingdnspyil2cpp-decryptorilspymono-decryptornative-dllpe-decryptorpe-unpackerstatic-analysis
Links
README excerpt
--- **The only DLL decryptor that reads obfuscated game modules the way the runtime does — then hands you the plain source-level output.** I've been reversing Unity and Unreal protected assemblies for six months, reading every forum thread on dll decryptor that exists, and this repo is what I wish someone had handed me on day one: a single `.exe` that dumps decrypted DLLs, resolves obfuscated imports, and rebuilds callable module stubs without a compiler in sight. --- ## 🗣️ Community & Support - **Issue tracker** — bug reports, crash dumps, and feature requests live in the repo Issues tab. - **Discussions** — post your decrypted module dumps, share protected-DLL samples, and compare obfuscator signatures with other reversers. - **Discord** — link is pinned in Discussions; the `#dll-decryptor` channel is where hotfixes get announced before release. - **Docs folder** — every supported obfuscator gets a markdown cheat sheet in `/docs` with sample output. - **Sample vault** — community-contributed test DLLs (Themida, VMProtect, ConfuserEx, Unity IL2CPP) in `/samples`. > Reverse-engineering protected binaries is a hobbyist research activity in most jurisdictions — check your local rules and only decrypt DLLs you own or are licensed to inspect. Use at your own risk. --- ## 🧠 Overview | Category | Details | |---|---| | Tool type | Standalone Windows DLL decryptor / unpacker / deobfuscator | | Input | Packed or obfuscated `.dll`, `.exe`, IL2CPP `GameAssembly.dll` | | Output | Decrypted PE, recoverable IL, resolved imports, readable strings | | Runtime | Single portable `.exe`, no install, no dependencies | | Methods | Runtime dump, static unpack, import reconstruction, IL repair | | Scope | Game modules, mod loaders, cheat loaders, plugin DLLs | The dll decryptor works by running the target module in a suspended helper process, catching the moment the packer hands off decrypted code to the loader, and snapshotting the memory region before protection re-encrypts it. From there, import rebuilding, section alignment, and IL metadata repair are applied until you get a module that opens cleanly in dnSpy, IDA, or Ghidra. --- ## 📖 What is a dll decryptor? | Term | Explanation | |---|---| | **DLL decryptor** | A tool that reverses runtime encryption placed on a `.dll` by a packer or obfuscator and returns the plain module | | **PE dump** | A memory snapshot of the loaded image rewritten back to a valid on-disk PE file | | **Packer handoff** | The precise instruction boundary where a protector gives plaintext to the loader — the decryptor's target window | | **Import reconstruction** | Rebuilding the import address table after a packer destroys or virtualizes it | | **IL repair** | Rewriting obfuscated CIL method bodies back into something a decompiler can read | | **Stub regeneration** | Emitting fresh callable stubs so you can actually invoke decrypted exports | | **IAT rebuild** | Fixing the import table so the decrypted DLL does not crash on `LoadLibrary` | -