How to detect obfuscator and where to dig?

Question

I have an .net assembly application written on c#

Its target framework version is 4.5.2

Trying to decompile with ILSpy, mostly all files looks like this:

    using MyApp.Controller;
    using MyApp.Controller.SendQuest;
    using PureMVC.Interfaces;
    
    public class AutoSendQuestCommand : BaseQuestCommand
    {
        private delegate void a(AutoSendQuestCommand P_0, INotification notification);
    
        private delegate void b(AutoSendQuestCommand P_0);
    
        private static bool Processing;
    
        protected override void InternalExecute(INotification notification)
        {
            try
            {
                ((a)global::<Module>.Invoke(334))(this, notification);
            }
            catch
            {
                throw;
            }
        }
    
        private void AutoSendQuestIntenal()
        {
            try
            {
                ((b)global::<Module>.Invoke(335))(this);
            }
            catch
            {
                throw;
            }
        }
    }

Also, there are class Module :

    using System;
    using System.IO;
    using System.Security.AccessControl;
    using System.Security.Principal;
    using System.Runtime.InteropServices;
    using System.Threading;
    
    internal class <Module>
    {
        internal static i Invoke;
    
        static <Module>()
        {
            IntPtr iUnknownForObject = Marshal.GetIUnknownForObject(typeof(global::<Module>));
            try
            {
                if (IntPtr.Size == 4)
                {
                    g(Environment.Version.Major, iUnknownForObject);
                }
                else if (IntPtr.Size == 8)
                {
                    h(Environment.Version.Major, iUnknownForObject);
                }
            }
            finally
            {
                Marshal.Release(iUnknownForObject);
            }
        }
    
        [DllImport("kernel32.dll", CharSet = CharSet.Auto, EntryPoint = "GetModuleHandle")]
        private static extern IntPtr a(string P_0);
    
        [DllImport("kernel32.dll", CharSet = CharSet.Auto, EntryPoint = "LoadLibrary")]
        private static extern IntPtr b(string P_0);    
        
        private static IntPtr d()
        {
            string text = ((IntPtr.Size == 4) ? "Protect544cd51a.dll" : "Protect2a3d628b.dll");
            IntPtr intPtr = a(text);            
            return intPtr;
        }
    
        [DllImport("kernel32.dll", CharSet = CharSet.Ansi, EntryPoint = "GetProcAddress", ExactSpelling = true)]
        private static extern IntPtr e(IntPtr P_0, string P_1);
    
        private static Delegate f(string P_0, Type P_1)
        {
            return Marshal.GetDelegateForFunctionPointer(e(d(), P_0), P_1);
        }
    
        private static bool g(int P_0, IntPtr P_1)
        {
            return ((a)f("P0", typeof(a)))(P_0, P_1);
        }
    
        private static bool h(int P_0, IntPtr P_1)
        {
            return ((a)f("P0", typeof(a)))(P_0, P_1);
        }
    }

And, finally in resources there are those dll files Protect544cd51a.dll and Protect2a3d628b.dll (their content not readable)

I understand that each delegate calls some function like this

    ((a)global::<Module>.Invoke(334))(this, notification);

and then class Module check if system is 32bit or 64bit

and then loads code from Protect544cd51a.dll (32bit) or from Protect2a3d628b.dll (64bit) by the number parameter (334 or 335)

But how can I see the native code, what obfuscator is this? where to dig ?

Answer 1

You could try dnSpyEx (dnSpyEx) which is a bit more useful for .net binaries than ILSpy.

The dlls mentioned are most likely stored in the resources and you can dump/save them and then analyze the native code with a disassembler such as IDA Pro if the binaries are native or in case the dlls are .net binaries feed them back to dnSpyEx to see what they are doing in the rest of the execution process.