Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I run Reflector to de-compile some program and it seems to be obfuscated.

I got following output, it’s not very useful.

Any ideas how to decompile obfuscated code?

  [CompilerGenerated]
    get
    {
        // This item is obfuscated and can not be translated.
    }
    [CompilerGenerated]
    set
    {
        // This item is obfuscated and can not be translated.
        switch ((1 == 1))
        {
            case true:
                goto Label_0020;
        }
        goto Label_0018;
        if (((0 == 0) ? 0 : 1) != 0)
        {
        }
        this.eval_t = value;
    }
share|improve this question
add comment

4 Answers

Technically speaking, decompiling obfuscated code is the same as decompiling non-obfuscated code. The way obfuscation in .NET works is by making it rediculously hard to follow the logic of the codepaths by routing the calls through randomly named types/methods/properties/etc in non-obvious ways. The whole point of obfuscation is to prevent people from decompiling code through the likes of Reflector and understanding how the internals of the code works.

There is no easy way to back out of the obfuscation. You are pretty much stuck with walking the code as-is.

share|improve this answer
add comment

There are actually several (at least 4) very different types of obfuscation, ranging from simply changing method and variable names into "anonymous" names, to mangling program logic, and even a runtime de-obfuscation engine.
Tools to do so range from the free plugins (some programmers even write all their code that way :) ), through high-end, expensive commercial tools. You should know what you're dealing with, depending on that the answer may be different.

In your case, your code looks like its probably Level 2, i.e. with some code path mangling, not just variables. Which means, it is still perfectly valid, with exact same results, just incredibly hard to manually parse. (If it was just variable naming, you could incrementally change the names, depending on context and range, and try to figure out from there).

I dont have a simple solution for you, but the question is - what do you want to with it?

  • If you want to recompile it, with small changes - should work okay, wont be too complicated, unless you really need to understand what is what.
  • If you want to manually review it for flaws - Good luck, you'll need it.
  • On the other hand, you should have no problem feeding this to an automatic code scanner. The higher-end tools ( :-) ) should have no problem parsing this (but no promises), although trying to verify the results, or locate the original line of code, may prove challenging. But you'd at least be able to get some visibility into the level of security.
share|improve this answer
1  
Heh, who needs obfuscation when you have bad developers. :) –  SteveS Feb 23 '12 at 18:52
add comment

Have you tried ILSpy?

http://wiki.sharpdevelop.net/ILSpy.ashx

I've had fairly good luck with obfuscated code, it still looks like garbage due to variable renaming, but you can follow it pretty well.

share|improve this answer
    
It's SilverLight application, ILSpy doesn't open application.xap file - "// This file does not contain a managed assembly." (Reflector opens it file) –  AaronS Feb 6 '12 at 19:03
2  
@AaronS rename it to *.zip and extract the containing dlls –  ordag Feb 6 '12 at 19:12
    
Tried, getting following ILSpy error: ICSharpCode.Decompiler.DecompilerException: Error decompiling System.Void XXXXXX.API.YYYYYY::LoadZZZZZZZXML() ---> System.InvalidCastException: Cast from Int64 to Boolean not supported. –  AaronS Feb 7 '12 at 7:39
    
Did you grab ILSpy 2.0? It's in beta but I've had more luck decompiling tricky code. –  StrangeWill Feb 7 '12 at 14:15
add comment

It's hard to tell what obfuscator was used, but de4dot (.NET deobfuscator) may be able to help you: https://github.com/0xd4d/de4dot

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.