Reflector - obfuscated code

Question

I run Reflector to de-compile some program and it seems to be obfuscated.

I got following output, it’s not very useful.

Any ideas how to decompile obfuscated code?

  [CompilerGenerated]
    get
    {
        // This item is obfuscated and can not be translated.
    }
    [CompilerGenerated]
    set
    {
        // This item is obfuscated and can not be translated.
        switch ((1 == 1))
        {
            case true:
                goto Label_0020;
        }
        goto Label_0018;
        if (((0 == 0) ? 0 : 1) != 0)
        {
        }
        this.eval_t = value;
    }

Answer 1

Technically speaking, decompiling obfuscated code is the same as decompiling non-obfuscated code. The way obfuscation in .NET works is by making it rediculously hard to follow the logic of the codepaths by routing the calls through randomly named types/methods/properties/etc in non-obvious ways. The whole point of obfuscation is to prevent people from decompiling code through the likes of Reflector and understanding how the internals of the code works.

There is no easy way to back out of the obfuscation. You are pretty much stuck with walking the code as-is.

Answer 2

Have you tried ILSpy?

http://wiki.sharpdevelop.net/ILSpy.ashx

I've had fairly good luck with obfuscated code, it still looks like garbage due to variable renaming, but you can follow it pretty well.

Answer 3

There are actually several (at least 4) very different types of obfuscation, ranging from simply changing method and variable names into "anonymous" names, to mangling program logic, and even a runtime de-obfuscation engine.
Tools to do so range from the free plugins (some programmers even write all their code that way :) ), through high-end, expensive commercial tools. You should know what you're dealing with, depending on that the answer may be different.

In your case, your code looks like its probably Level 2, i.e. with some code path mangling, not just variables. Which means, it is still perfectly valid, with exact same results, just incredibly hard to manually parse. (If it was just variable naming, you could incrementally change the names, depending on context and range, and try to figure out from there).

I dont have a simple solution for you, but the question is - what do you want to with it?

• If you want to recompile it, with small changes - should work okay, wont be too complicated, unless you really need to understand what is what.
• If you want to manually review it for flaws - Good luck, you'll need it.
• On the other hand, you should have no problem feeding this to an automatic code scanner. The higher-end tools ( :-) ) should have no problem parsing this (but no promises), although trying to verify the results, or locate the original line of code, may prove challenging. But you'd at least be able to get some visibility into the level of security.

Answer 4

It's hard to tell what obfuscator was used, but de4dot (.NET deobfuscator) may be able to help you: https://github.com/0xd4d/de4dot