6

When decompiling a dll file there are certain lines of code that read like this:

return \u0013.\u0002.\u0001(url, info);

I have two questions on this:

1) does \u00xx mean that it is obfuscated, if yes, what steps can I take to understand it

2) what are the . between each one, is it a dnSpy thing or does it mean something in C#

1 Answer 1

7

These are Unicode characters that are not supported by the font used by dnSpy. Usually, you'll see it when the code is obfuscated or in cases where the developer used languages as Chinese and Russian in their code. But yeah, usually obfuscation.

You can try to deobfuscate this .Net binary by using de4dot which is doing an incredible job with deobfuscating obfuscated .net applications. de4dot's engine was later used to create dnSpy which is my favorite .Net decompiler.

The separating dots are the dot Operator, just as in most popular programming languages, the dot operator is used to access members of variables, types, etc. "Members" can be a method, attribute, and others.

In your case, \u0001 is a method of \u0002 which is a member of the variable \u0013.

2
  • Can de4dot deobfuscated any .NET executable?
    – Biswapriyo
    Commented May 23, 2018 at 17:02
  • No. But it'll try and usually will output a bit less-obfuscated binary. There are indeed obfuscators that will beat de4dot
    – Megabeets
    Commented May 23, 2018 at 17:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.