Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

What are these symbols in a decompiled code

I decompiled an executable and cant understand what are these symbols in the source code (C#). I would paste source examples here but as I tried pasting, the special characters in the decompiled source are not printable here in this editor. So i'm taking few snip images and pasting links here so anyone can see, so examples are:

Image 1

Image 2

Image 3

what I am guessing is that this source code is obfuscated right? And that these symbols are OK to exist in the MSIL, but when translated as is in C#, they make for illegal characters. Is that right? Any suggestions on how do I get past this, like do a replace-all on this stuff?

like image 851
user734028 Avatar asked Dec 21 '22 22:12

user734028


2 Answers

MSIL has very lax rules for what is allowed as an identifier name. Obsfuscators intentionally choose chars which C# cannot represent so you can't roundtrip to C#.

You can decompile to IL however and be able to compile the project.

Also look at C#'s unicode identifiers. You can have unicode escape code inside of C# identifiers which is surprising to many. Example:

class @class
{
   public static void @static(bool @bool) {
      if (@bool)
         System.Console.WriteLine("true");
      else
         System.Console.WriteLine("false");
   }   
}
class Class1
{
   static void M() {
      cl\u0061ss.st\u0061tic(true);
   }
}
like image 85
usr Avatar answered Feb 27 '23 18:02

usr


You could look at the file with a hex editor, figure out the 'rules' of these values, and then you might be able to write yourself a program that would convert them to ascii representations with some prefix - ie, obs_627 or whatever.

Of course you can only change names which will be referred to only from within the codebase you are changing. Any external linkage to these special names, or internal use of whatever the equivalent of reflection is, would break. If there's reason to expect either of these are the case, then it would be a wasted effort.

like image 33
Chris Stratton Avatar answered Feb 27 '23 18:02

Chris Stratton