.NET ConfuserEx Mapping Decoder
Detect and decode ConfuserEx obfuscation patterns in .NET code automatically. Identifies constant encryption, renamed symbols, string encoding, anti-tamper markers, control flow obfuscation, anti-debug patterns, proxy call invocations, and resource protection. Each detection includes confidence scoring, source line numbers, and surrounding code context. Free, private, and no signup required.
Detect and decode ConfuserEx obfuscation patterns in .NET code. Automatically identifies constant encryption, anti-tamper markers, renamed symbols, string encoding, control flow obfuscation, resource protection, anti-debug patterns, and proxy call invocations with confidence ratings and source context.
Paste .NET code above and click Analyze .NET Code to detect ConfuserEx obfuscation patterns. The tool identifies constant encryption, string encoding, renamed symbols, anti-tamper markers, control flow obfuscation, anti-debug patterns, proxy call invocations, and resource protection. Try loading an example to see how it works!
Features
8 ConfuserEx Technique Detectors
Automatically detects constant encryption (encoded integer/hex values), anti-tamper markers (Module.Resolve, ResourceManager), renamed symbols (short or hex-style identifiers), string encoding (Base64, char arrays, XOR byte patterns), control flow obfuscation (switch dispatchers), resource protection (GetManifestResource), anti-debug patterns (Debugger.IsAttached), and proxy call invocations (MethodInfo.Invoke).
Encoded Value & Decoded Analysis Display
Every detection shows the original encoded value or obfuscation indicator alongside the decoded result or analysis in a clean card layout. Hex-encoded constants are decoded, Base64 strings are automatically decoded to reveal hidden URLs and configuration, and ConfuserEx patterns are identified by technique type.
Annotated Code View with Confidence Scoring
View your .NET code with inline annotations marking each detected ConfuserEx obfuscation point. Each detection receives a confidence rating from 1-5 with source line numbers and surrounding code context. The annotated view helps you quickly locate and understand each obfuscation technique used in the code.
100% Browser-Local & Private
All ConfuserEx deobfuscation runs entirely in your browser. Your .NET code, all detected indicators, decoded values, and analysis results never leave your device. No server uploads, no API calls, no data storage, and no tracking. Completely safe for analyzing proprietary or sensitive .NET source code.
Use Cases
Security Analysis of ConfuserEx-Protected .NET Malware
Analyze .NET malware samples protected with ConfuserEx by detecting and decoding obfuscation patterns. Many .NET malware families use ConfuserEx to hide C2 URLs, configuration strings, and payload delivery mechanisms from static analysis tools and security researchers.
.NET CrackMe & CTF Challenge Analysis
Reverse engineer .NET CrackMe challenges and CTF binaries that use ConfuserEx obfuscation. Identify constant encryption keys, decode hidden strings, and trace renamed symbols to understand the protection scheme and find vulnerabilities.
Deobfuscating ConfuserEx-Protected Commercial Software
Security researchers and penetration testers analyze ConfuserEx-protected .NET applications to understand obfuscation layers, extract API endpoints, and identify potential security weaknesses in proprietary .NET software.
.NET Supply Chain Security Auditing
During .NET project security audits, scan third-party assemblies and NuGet packages for ConfuserEx obfuscation indicators. Identify dependencies that use constant encryption, renamed symbols, or anti-tamper protection - potential signs of tampering or malicious intent.
Educational Tool for .NET Obfuscation Techniques
Learn how ConfuserEx obfuscation techniques work by seeing real decoded examples. Understand constant encryption, string encoding, control flow flattening, and symbol renaming techniques used by one of the most popular .NET obfuscators in the industry.
Forensic Analysis of Compromised .NET Systems
During incident response on compromised .NET systems, analyze decompiled assemblies for hidden backconnect URLs, data exfiltration endpoints, or encoded shell commands that attackers protect using ConfuserEx obfuscation techniques.
About ConfuserEx Deobfuscation
What is the .NET ConfuserEx Mapping Decoder?
The .NET ConfuserEx Mapping Decoder is a browser-based analysis tool that detects and decodes obfuscation patterns produced by ConfuserEx, one of the most popular open-source .NET obfuscators. ConfuserEx uses multiple protection techniques including constant encryption (replacing literal values with encoded expressions), symbol renaming (replacing meaningful class/method/variable names with short unreadable identifiers), string encoding (hiding string literals behind Base64, XOR, or char array constructions), control flow obfuscation (flattening code into switch-based dispatchers), anti-tamper (runtime integrity checks), anti-debug (debugger detection), proxy calls (reflection-based method invocations), and resource protection. This tool helps security researchers, reverse engineers, and .NET developers understand and analyze ConfuserEx-protected code by detecting each technique and providing decoded values where possible.
How Our ConfuserEx Decoder Works
The ConfuserEx Mapping Decoder scans .NET source code using language-aware pattern matching for each obfuscation technique. Constant encryption is detected by finding large hex or decimal literals that match ConfuserEx encoding patterns. String encoding is detected by identifying Convert.FromBase64String calls, byte array literals, and StringBuilder constructions - Base64 strings are automatically decoded to reveal hidden content. Renamed symbols are detected by finding unusually short class/method/variable names or hex-style identifiers like _0x1234. Anti-tamper markers are detected by scanning for Module.Resolve, ResourceManager, and GetCustomAttributes patterns. Anti-debug patterns target Debugger.IsAttached and related checks. Control flow obfuscation identifies switch dispatchers with large state variables. Each detection receives a confidence rating and is displayed with its original encoded value and decoded analysis.
Limitations & Considerations
This tool has important limitations. The ConfuserEx decoder analyzes deobfuscated or decompiled .NET source code - it cannot directly analyze compiled .NET assemblies or executables without first being decompiled using a tool like dnSpy, ILSpy, or dotPeek. Constant encryption values that use runtime decryption with keys defined elsewhere cannot be decoded without executing the code. XOR-encrypted strings require the XOR key to be known or derivable from context. The tool provides confidence scores to indicate reliability - high confidence means the pattern was clearly identifiable and decoded, lower confidence indicates suspected patterns that need manual verification. Advanced ConfuserEx configurations with custom plugins or modified protection schemes may produce patterns not covered by this detector.
Privacy & Security
This tool runs entirely in your browser using client-side JavaScript. The .NET code you paste, all detected obfuscation indicators, decoded values, analysis results, and annotated output are never uploaded to any server, stored in any database, or transmitted over the network. All parsing, pattern matching, and decoding execute locally on your device. There are no API calls, analytics tracking, cookies, or data collection of any kind. This makes it completely safe for analyzing proprietary .NET code, third-party assemblies, malware samples, or sensitive source code.
Related Deobfuscation Tools
Hex/Binary Converter with XOR
Convert between hex and binary. Apply XOR, AND, OR, NOT operations with customizable keys and cumulative XOR checksums. Essential for decoding XOR-encrypted ConfuserEx strings.
Binary Data Unpacker
Detect and unpack obfuscated binary data automatically. Supports Base64, hex, XOR, GZIP, and more with confidence scoring.
Entropy Analyzer
Compute Shannon entropy of binary data to detect encryption and obfuscation. Features byte frequency tables and sliding-window entropy heatmap.
Integer Obfuscator
Obfuscate integers using base conversion, arithmetic expressions, and bitwise operations. Understand how ConfuserEx encodes constants.
Frequently Asked Questions About ConfuserEx Deobfuscation
The tool detects eight common ConfuserEx obfuscation patterns: constant encryption (encoded integer/hex values replacing literal constants), anti-tamper markers (runtime integrity checks using Module.Resolve and ResourceManager), renamed symbols (short or hex-style class/method/variable names), string encoding (Base64 strings, byte arrays, StringBuilder constructions, and XOR patterns), control flow obfuscation (switch-based dispatchers with state variables), resource protection (GetManifestResource and embedded resource access), anti-debug patterns (Debugger.IsAttached and related checks), and proxy call invocations (reflection-based method dispatch via MethodInfo.Invoke and Delegate.CreateDelegate).
Constant encryption detection scans for large hex literals (0x followed by 6+ hex digits), very large decimal integer literals (10+ digits), and typed assignments with suspiciously large values. ConfuserEx replaces constants like 42 or "api.example.com" with encoded expressions that evaluate to the same value at runtime. When possible, hex values are decoded to reveal the original string or numeric constant they represent.
No. This tool can detect and decode ConfuserEx patterns that are statically identifiable in deobfuscated source code. It cannot decrypt constants or strings that use runtime keys defined elsewhere, decode XOR-encrypted data without the key, or reverse complex ConfuserEx protection layers that require .NET runtime execution. For full deobfuscation of ConfuserEx-protected assemblies, you typically need to use a dedicated deobfuscation tool like de4dot combined with runtime analysis.
Confidence scores range from 1 to 5. Score 5 (Very High) is assigned when Base64-decoded content contains readable text like URLs or API endpoints. Score 4 (High) is for successful hex decoding that produces readable text. Score 3 (Medium) is for renamed symbol detection and control flow patterns where ConfuserEx is likely but not certain. Score 2 (Low) is for anti-tamper and anti-debug patterns that could appear in legitimate code. Score 1 (Suspected) is for weak indicators that need manual verification.
Yes. This tool analyzes .NET source code, not compiled assemblies. You need to decompile ConfuserEx-protected .NET executables or DLLs using a tool like dnSpy, ILSpy, dotPeek, or JustDecompile first. Copy the decompiled C# or VB.NET code and paste it into this tool for analysis. ConfuserEx makes decompilation harder, so you may need to use the latest version of these decompilers.
ConfuserEx is an open-source .NET obfuscator that uses a modular protection system with individually configurable components. Unlike commercial obfuscators like Dotfuscator or SmartAssembly, ConfuserEx is free and widely used in malware and crackme communities. Its constant encryption, rename scheme, and control flow obfuscation have distinctive patterns that this tool is specifically designed to detect and decode.
The annotated code view displays your original .NET source code with inline comments added at each line where ConfuserEx obfuscation was detected. Each annotation includes the technique name (e.g., "Constant Encryption" or "String Encoding") and a brief description of what was found. This makes it easy to visually scan through the code and understand every obfuscation point in context.
Absolutely. The ConfuserEx Mapping Decoder runs entirely in your browser. Your .NET code, all detected indicators, decoded values, analysis results, and annotated output are never uploaded to any server, stored in any database, or transmitted over the network. All processing happens locally on your device with no API calls or data collection. You can safely analyze proprietary, confidential, or sensitive .NET source code.
Yes - 100% free with no signup, no account, and no usage limits. Analyze as much .NET code as you need, as many times as you want. There are no premium tiers, hidden charges, or rate limits. The tool runs entirely in your browser - your code never leaves your device.