Home - Forums-.NET - Spices.Net - Stack Trace deobfuscation

Spices.Net

NET code security, tools to protect, obfuscate, tamper defense, code and data safety, recover, convert, optimize, explore, browse and analyze .Net software.

This forum related to following products: Spices.Net Suite, Spices.Net Obfuscator, Spices.Net Decompiler

Stack Trace deobfuscation
Link Posted: 04-Jul-2018 02:09
Hi, I've found interesting tool/utility in Spices.Net - Stack Trace deobfuscation, that allows deobfuscate exception stacktrace. Could you explain how this thing works, how work with this thing?
Link Posted: 04-Jul-2018 02:18
Yes, StackTrace Deobfuscate tool can help you to find the place of exception.
You can parse with this tool rather standard Exception.StackTrace message and provided for free our SmartStackTrace message.
Parsing of standard StackTrace some time doesn't work correctly because Exception.StackTrace doesn't contain return types of methods in the call stack and in situation with names of methods having same names names and same parameter types(but with different return types) StackTrace just sin't able to find right method.
If you're using SmartStackTrace (you can find source code in the \SDK folder and use in your projects for free) you'll get all detailed information about methods in the call stack, position in il or source code(if debug info is available), method token, assembly of method information, so be able to precisely find the place of exception.
In next reply I'll explain how to use Deobfuscate Stack Trace with SmartStackTrace.
Link Posted: 04-Jul-2018 02:19

  1. Copy stack trace digest information from Exception message.
  2. Load your spices.project
  3. Click Tools-Deobfuscate StackTrace command.
  4. Paste digest information into yellow text box, click Use Stack Trace digest checkbox and click Deobfuscate button to get parsed graph of methods in stack trace.


Also you can find methods from stack trace digest in your spices.project and disassemble them to find the place of exception (sometime it's very useful):

  1. Copy token of the method (its 0x.... number in the stack trace digest or more detailed stack trace).
  2. Load your Spices.Project
  3. Select the assembly of the method (stack trace contains this information) in Assembly Browser
  4. Click Tools-Informer-Token Info
  5. Paste copied token of the method and click Fill Info. You'll get detailed information about method.
  6. If you'll use Follow button - it will find and select method in the AssemblyBrowser. But remember - this operation can take time, sometime about 5-10minutes on big assemblies.