classify_dotnet_protection
Detect common obfuscation patterns in .NET assemblies by analyzing IL/Metadata for canonical categories like type-name-renaming and string-encryption.
Instructions
Walk a .NET assembly for canonical obfuscation patterns.
Returns category-only labels (type-name-renaming,
control-flow-flattening, string-encryption,
managed-anti-debug, resource-encryption,
native-aot-stub). Never names a specific commercial
obfuscator.
The walker uses the re-dotnet Python helper
:mod:re_dotnet.protection_classifier (pure-Python
IL/Metadata subset; no need for the .NET CLI binary
to be built). The CLI is only used for type-name listing
(already covered by :func:parse_assembly).
Args:
path: path to a .dll / .exe .NET assembly
max_per_category: per-category cap (default 50)
Returns::
{
"path": "...",
"matches": [{"category": "...", "evidence": "...",
"evidence_member": "..."}, ...],
"by_category": {"type-name-renaming": 12, "string-encryption": 4, ...}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | ||
| max_per_category | No |