Hi,

Agile.net has been updated and got some little modifications.

I decided to start telling you how to fix delegates because I see lots of people trying some public tools (codecracker’s one, TheProxy’s one) but without success.

The easiest way to resolve them without too much knowledge is to update de4dot.

The other thing you have to know is that Agile.Net use the name of delegate to resolve the original method so if your target has restored name, You won’t be able to restore Delegate.

Now, let’s go deeper in the resolving method.

The target i’ll use today is this one : http://ge.tt/4oPDNb33

The things I noticed from previous version of Agile is that they changed the name of the decryption method. Now, the method is called « dau »

If we look at the body of this method, we see that a integer is used to decrypt type token and then it’s using field name to decrypt original method name. This is why it is so IMPORTANT to keep original names…

Screenshot_3

From there, it’s pretty easy to get original methods. Maybe if I have time, I’ll make a delegatekiller with some comments.

The rest of the code is not very interesting. It’s only some delegate setting if the method is static and the creation of a dynamicmethod for non static method… You to resolve the original method, you only have to get the fieldname, decrypt it using the algorithm as in « dau » method and getting the original methodinfo using reflection

If you’re not used to delegate, I recommend you reading these articles :

Delegate description How ConfuserEx create delegates

So as you can see, Agile.Net developpers are I think lazy and they only changed a few things to defeat de4dot but it takes 5 minuts to fix it. I let you look at the code yourself and if you have question, you can contact me 🙂

I hope this small explanation was useful for some of you. Delegate can look tricky for new reversers but as you can see, it’s pretty easy