Skip to main content
Bumped by Community user
Formatted code for syntax highlighting and removed thanks
Source Link
using MyApp.Controller;
using MyApp.Controller.SendQuest;
using PureMVC.Interfaces;

public class AutoSendQuestCommand : BaseQuestCommand
{
    private delegate void a(AutoSendQuestCommand P_0, INotification notification);

    private delegate void b(AutoSendQuestCommand P_0);

    private static bool Processing;

    protected override void InternalExecute(INotification notification)
    {
        try
        {
            ((a)global::<Module>.Invoke(334))(this, notification);
        }
        catch
        {
            throw;
        }
    }

    private void AutoSendQuestIntenal()
    {
        try
        {
            ((b)global::<Module>.Invoke(335))(this);
        }
        catch
        {
            throw;
        }
    }
}
    using MyApp.Controller;
    using MyApp.Controller.SendQuest;
    using PureMVC.Interfaces;
    
    public class AutoSendQuestCommand : BaseQuestCommand
    {
        private delegate void a(AutoSendQuestCommand P_0, INotification notification);
    
        private delegate void b(AutoSendQuestCommand P_0);
    
        private static bool Processing;
    
        protected override void InternalExecute(INotification notification)
        {
            try
            {
                ((a)global::<Module>.Invoke(334))(this, notification);
            }
            catch
            {
                throw;
            }
        }
    
        private void AutoSendQuestIntenal()
        {
            try
            {
                ((b)global::<Module>.Invoke(335))(this);
            }
            catch
            {
                throw;
            }
        }
    }
using System;
using System.IO;
using System.Security.AccessControl;
using System.Security.Principal;
using System.Runtime.InteropServices;
using System.Threading;

internal class <Module>
{
    internal static i Invoke;

    static <Module>()
    {
        IntPtr iUnknownForObject = Marshal.GetIUnknownForObject(typeof(global::<Module>));
        try
        {
            if (IntPtr.Size == 4)
            {
                g(Environment.Version.Major, iUnknownForObject);
            }
            else if (IntPtr.Size == 8)
            {
                h(Environment.Version.Major, iUnknownForObject);
            }
        }
        finally
        {
            Marshal.Release(iUnknownForObject);
        }
    }

    [DllImport("kernel32.dll", CharSet = CharSet.Auto, EntryPoint = "GetModuleHandle")]
    private static extern IntPtr a(string P_0);

    [DllImport("kernel32.dll", CharSet = CharSet.Auto, EntryPoint = "LoadLibrary")]
    private static extern IntPtr b(string P_0);    
    
    private static IntPtr d()
    {
        string text = ((IntPtr.Size == 4) ? "Protect544cd51a.dll" : "Protect2a3d628b.dll");
        IntPtr intPtr = a(text);            
        return intPtr;
    }

    [DllImport("kernel32.dll", CharSet = CharSet.Ansi, EntryPoint = "GetProcAddress", ExactSpelling = true)]
    private static extern IntPtr e(IntPtr P_0, string P_1);

    private static Delegate f(string P_0, Type P_1)
    {
        return Marshal.GetDelegateForFunctionPointer(e(d(), P_0), P_1);
    }

    private static bool g(int P_0, IntPtr P_1)
    {
        return ((a)f("P0", typeof(a)))(P_0, P_1);
    }

    private static bool h(int P_0, IntPtr P_1)
    {
        return ((a)f("P0", typeof(a)))(P_0, P_1);
    }
}
    using System;
    using System.IO;
    using System.Security.AccessControl;
    using System.Security.Principal;
    using System.Runtime.InteropServices;
    using System.Threading;
    
    internal class <Module>
    {
        internal static i Invoke;
    
        static <Module>()
        {
            IntPtr iUnknownForObject = Marshal.GetIUnknownForObject(typeof(global::<Module>));
            try
            {
                if (IntPtr.Size == 4)
                {
                    g(Environment.Version.Major, iUnknownForObject);
                }
                else if (IntPtr.Size == 8)
                {
                    h(Environment.Version.Major, iUnknownForObject);
                }
            }
            finally
            {
                Marshal.Release(iUnknownForObject);
            }
        }
    
        [DllImport("kernel32.dll", CharSet = CharSet.Auto, EntryPoint = "GetModuleHandle")]
        private static extern IntPtr a(string P_0);
    
        [DllImport("kernel32.dll", CharSet = CharSet.Auto, EntryPoint = "LoadLibrary")]
        private static extern IntPtr b(string P_0);    
        
        private static IntPtr d()
        {
            string text = ((IntPtr.Size == 4) ? "Protect544cd51a.dll" : "Protect2a3d628b.dll");
            IntPtr intPtr = a(text);            
            return intPtr;
        }
    
        [DllImport("kernel32.dll", CharSet = CharSet.Ansi, EntryPoint = "GetProcAddress", ExactSpelling = true)]
        private static extern IntPtr e(IntPtr P_0, string P_1);
    
        private static Delegate f(string P_0, Type P_1)
        {
            return Marshal.GetDelegateForFunctionPointer(e(d(), P_0), P_1);
        }
    
        private static bool g(int P_0, IntPtr P_1)
        {
            return ((a)f("P0", typeof(a)))(P_0, P_1);
        }
    
        private static bool h(int P_0, IntPtr P_1)
        {
            return ((a)f("P0", typeof(a)))(P_0, P_1);
        }
    }
((a)global::<Module>.Invoke(334))(this, notification);
    ((a)global::<Module>.Invoke(334))(this, notification);

But how can iI see the native code, what obfuscator is this? where to dig ? Thanks

using MyApp.Controller;
using MyApp.Controller.SendQuest;
using PureMVC.Interfaces;

public class AutoSendQuestCommand : BaseQuestCommand
{
    private delegate void a(AutoSendQuestCommand P_0, INotification notification);

    private delegate void b(AutoSendQuestCommand P_0);

    private static bool Processing;

    protected override void InternalExecute(INotification notification)
    {
        try
        {
            ((a)global::<Module>.Invoke(334))(this, notification);
        }
        catch
        {
            throw;
        }
    }

    private void AutoSendQuestIntenal()
    {
        try
        {
            ((b)global::<Module>.Invoke(335))(this);
        }
        catch
        {
            throw;
        }
    }
}
using System;
using System.IO;
using System.Security.AccessControl;
using System.Security.Principal;
using System.Runtime.InteropServices;
using System.Threading;

internal class <Module>
{
    internal static i Invoke;

    static <Module>()
    {
        IntPtr iUnknownForObject = Marshal.GetIUnknownForObject(typeof(global::<Module>));
        try
        {
            if (IntPtr.Size == 4)
            {
                g(Environment.Version.Major, iUnknownForObject);
            }
            else if (IntPtr.Size == 8)
            {
                h(Environment.Version.Major, iUnknownForObject);
            }
        }
        finally
        {
            Marshal.Release(iUnknownForObject);
        }
    }

    [DllImport("kernel32.dll", CharSet = CharSet.Auto, EntryPoint = "GetModuleHandle")]
    private static extern IntPtr a(string P_0);

    [DllImport("kernel32.dll", CharSet = CharSet.Auto, EntryPoint = "LoadLibrary")]
    private static extern IntPtr b(string P_0);    
    
    private static IntPtr d()
    {
        string text = ((IntPtr.Size == 4) ? "Protect544cd51a.dll" : "Protect2a3d628b.dll");
        IntPtr intPtr = a(text);            
        return intPtr;
    }

    [DllImport("kernel32.dll", CharSet = CharSet.Ansi, EntryPoint = "GetProcAddress", ExactSpelling = true)]
    private static extern IntPtr e(IntPtr P_0, string P_1);

    private static Delegate f(string P_0, Type P_1)
    {
        return Marshal.GetDelegateForFunctionPointer(e(d(), P_0), P_1);
    }

    private static bool g(int P_0, IntPtr P_1)
    {
        return ((a)f("P0", typeof(a)))(P_0, P_1);
    }

    private static bool h(int P_0, IntPtr P_1)
    {
        return ((a)f("P0", typeof(a)))(P_0, P_1);
    }
}
((a)global::<Module>.Invoke(334))(this, notification);

But how can i see the native code, what obfuscator is this? where to dig ? Thanks

    using MyApp.Controller;
    using MyApp.Controller.SendQuest;
    using PureMVC.Interfaces;
    
    public class AutoSendQuestCommand : BaseQuestCommand
    {
        private delegate void a(AutoSendQuestCommand P_0, INotification notification);
    
        private delegate void b(AutoSendQuestCommand P_0);
    
        private static bool Processing;
    
        protected override void InternalExecute(INotification notification)
        {
            try
            {
                ((a)global::<Module>.Invoke(334))(this, notification);
            }
            catch
            {
                throw;
            }
        }
    
        private void AutoSendQuestIntenal()
        {
            try
            {
                ((b)global::<Module>.Invoke(335))(this);
            }
            catch
            {
                throw;
            }
        }
    }
    using System;
    using System.IO;
    using System.Security.AccessControl;
    using System.Security.Principal;
    using System.Runtime.InteropServices;
    using System.Threading;
    
    internal class <Module>
    {
        internal static i Invoke;
    
        static <Module>()
        {
            IntPtr iUnknownForObject = Marshal.GetIUnknownForObject(typeof(global::<Module>));
            try
            {
                if (IntPtr.Size == 4)
                {
                    g(Environment.Version.Major, iUnknownForObject);
                }
                else if (IntPtr.Size == 8)
                {
                    h(Environment.Version.Major, iUnknownForObject);
                }
            }
            finally
            {
                Marshal.Release(iUnknownForObject);
            }
        }
    
        [DllImport("kernel32.dll", CharSet = CharSet.Auto, EntryPoint = "GetModuleHandle")]
        private static extern IntPtr a(string P_0);
    
        [DllImport("kernel32.dll", CharSet = CharSet.Auto, EntryPoint = "LoadLibrary")]
        private static extern IntPtr b(string P_0);    
        
        private static IntPtr d()
        {
            string text = ((IntPtr.Size == 4) ? "Protect544cd51a.dll" : "Protect2a3d628b.dll");
            IntPtr intPtr = a(text);            
            return intPtr;
        }
    
        [DllImport("kernel32.dll", CharSet = CharSet.Ansi, EntryPoint = "GetProcAddress", ExactSpelling = true)]
        private static extern IntPtr e(IntPtr P_0, string P_1);
    
        private static Delegate f(string P_0, Type P_1)
        {
            return Marshal.GetDelegateForFunctionPointer(e(d(), P_0), P_1);
        }
    
        private static bool g(int P_0, IntPtr P_1)
        {
            return ((a)f("P0", typeof(a)))(P_0, P_1);
        }
    
        private static bool h(int P_0, IntPtr P_1)
        {
            return ((a)f("P0", typeof(a)))(P_0, P_1);
        }
    }
    ((a)global::<Module>.Invoke(334))(this, notification);

But how can I see the native code, what obfuscator is this? where to dig ?

Source Link
Alex
  • 21
  • 1

How to detect obfuscator and where to dig?

I have an .net assembly application written on c#

Its target framework version is 4.5.2

Trying to decompile with ILSpy, mostly all files looks like this:

using MyApp.Controller;
using MyApp.Controller.SendQuest;
using PureMVC.Interfaces;

public class AutoSendQuestCommand : BaseQuestCommand
{
    private delegate void a(AutoSendQuestCommand P_0, INotification notification);

    private delegate void b(AutoSendQuestCommand P_0);

    private static bool Processing;

    protected override void InternalExecute(INotification notification)
    {
        try
        {
            ((a)global::<Module>.Invoke(334))(this, notification);
        }
        catch
        {
            throw;
        }
    }

    private void AutoSendQuestIntenal()
    {
        try
        {
            ((b)global::<Module>.Invoke(335))(this);
        }
        catch
        {
            throw;
        }
    }
}

Also, there are class Module :

using System;
using System.IO;
using System.Security.AccessControl;
using System.Security.Principal;
using System.Runtime.InteropServices;
using System.Threading;

internal class <Module>
{
    internal static i Invoke;

    static <Module>()
    {
        IntPtr iUnknownForObject = Marshal.GetIUnknownForObject(typeof(global::<Module>));
        try
        {
            if (IntPtr.Size == 4)
            {
                g(Environment.Version.Major, iUnknownForObject);
            }
            else if (IntPtr.Size == 8)
            {
                h(Environment.Version.Major, iUnknownForObject);
            }
        }
        finally
        {
            Marshal.Release(iUnknownForObject);
        }
    }

    [DllImport("kernel32.dll", CharSet = CharSet.Auto, EntryPoint = "GetModuleHandle")]
    private static extern IntPtr a(string P_0);

    [DllImport("kernel32.dll", CharSet = CharSet.Auto, EntryPoint = "LoadLibrary")]
    private static extern IntPtr b(string P_0);    
    
    private static IntPtr d()
    {
        string text = ((IntPtr.Size == 4) ? "Protect544cd51a.dll" : "Protect2a3d628b.dll");
        IntPtr intPtr = a(text);            
        return intPtr;
    }

    [DllImport("kernel32.dll", CharSet = CharSet.Ansi, EntryPoint = "GetProcAddress", ExactSpelling = true)]
    private static extern IntPtr e(IntPtr P_0, string P_1);

    private static Delegate f(string P_0, Type P_1)
    {
        return Marshal.GetDelegateForFunctionPointer(e(d(), P_0), P_1);
    }

    private static bool g(int P_0, IntPtr P_1)
    {
        return ((a)f("P0", typeof(a)))(P_0, P_1);
    }

    private static bool h(int P_0, IntPtr P_1)
    {
        return ((a)f("P0", typeof(a)))(P_0, P_1);
    }
}

And, finally in resources there are those dll files Protect544cd51a.dll and Protect2a3d628b.dll (their content not readable)

I understand that each delegate calls some function like this

((a)global::<Module>.Invoke(334))(this, notification);

and then class Module check if system is 32bit or 64bit

and then loads code from Protect544cd51a.dll (32bit) or from Protect2a3d628b.dll (64bit) by the number parameter (334 or 335)

But how can i see the native code, what obfuscator is this? where to dig ? Thanks