0

I'm trying to decompile a c# dll and on a particular method I'm getting this result

public IEnumerable<Guid> GetDbIdentifiers(int classId)
{
    switch ((794999935 == 794999935) ? 1 : 0)
    {
    case 0:
    case 2:
        IL_1E:
        break;
    case 1:
        goto IL_1F;
    }
    goto IL_1E;
    IL_1F:
    if (0 == 0)
    {
    }
    if (1 == 0)
    {
    }
    int arg_2E_0 = 0;
    DatabaseHandler.Class106 @class = new DatabaseHandler.Class106(-2);
    @class.databaseHandler_0 = this;
    @class.int_3 = classId;
    return @class;
}

It's calling a inner class Class106 inside DatabaseHandler, but it seems it cannot decompile this inner class.

I tried dotPeek, ILSpy, JustDecompile and Reflector.

The best result I got was with Reflector, it decompiled the class partially. The definition is this:

[CompilerGenerated]
private sealed class Class106 : IDisposable, IEnumerable<Guid>, IEnumerator<Guid>, IEnumerable, IEnumerator

I read in many forums that Enumerators are decompiled as inner classes and no decompiler can produce usable code. It seems the case, since the Class106 implements IEnumerable and IEnumerator interfaces.

Does anyone have any clue on how I could patch this manually?

  • Is this an obfuscated assembly? If not, the common decompilers should have no problem with that. And I don't understand what are you actually asking: what kind of patch are you talking about? Also, including the "partially decompiled" code might be useful. – svick May 11 '16 at 15:48
  • 1
    ILSpy is not able to decompile inner classes. You might switch to IL view to see them. Perhaps the following stov posting could help you:reverseengineering.stackexchange.com/questions/9178/…. In case you wish to modify, Reflexil is very worth to look at. – josh Jun 13 '16 at 23:53
  • ![enter image description here](i.stack.imgur.com/Uq32Z.png) how can i know the Obfuscator for exe? – kostas1337 Oct 8 at 10:08
2

You file is obfuscated with ConfuserEX and I know it because of the way the ControlFlow looks. ControlFlow is simply the fact that the method body seems to be confusing / puzzling, with Switch Cases and Gotos. If you dig into Google, and look for "ConfuserEX Deobfuscator" you will be able to download a few tools to clean your protected assembly (mainly on tuts4you's forum).

Cheers.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.