首页
社区
课程
招聘
[旧帖] [求助][求助].net dll 混肴后怎么反编译出C#代码? 0.00雪花
发表于: 2009-5-16 23:05 12203

[旧帖] [求助][求助].net dll 混肴后怎么反编译出C#代码? 0.00雪花

2009-5-16 23:05
12203
有个dll 的方法在Reflectorr打开,C#和IL显示代码时分别如下,请问怎样才能反出来C#源程序,只能一行行根据IL代码写C#代码吗?有没有什么工具能转换?谢谢。

C#:

public static i a(string O1l)
{
    // This item is obfuscated and can not be translated.
}

IL:
.method public hidebysig static class i a(string O1l) cil managed
{
    .maxstack 2
    .locals init (
        [0] class i i,
        [1] bool flag,
        [2] int32 num)
    L_0000: br.s L_001b
    L_0002: ldloc num
    L_0006: switch (L_0049, L_007d, L_003b, L_0097)
    L_001b: nop
    L_001c: ldsfld class i a::k
    L_0021: ldnull
    L_0022: ceq
    L_0024: ldc.i4.0
    L_0025: ceq
    L_0027: stloc.1
    L_0028: ldc.i4.1
    L_0029: br.s L_002e
    L_002b: ldc.i4.0
    L_002c: br.s L_002e
    L_002e: brfalse.s L_0030
    L_0030: ldc.i4 2
    L_0035: stloc num
    L_0039: br.s L_0002
    L_003b: ldloc.1
    L_003c: brtrue.s L_004b
    L_003e: ldc.i4 0
    L_0043: stloc num
    L_0047: br.s L_0002
    L_0049: br.s L_007f
    L_004b: ldsfld class i a::k
    L_0050: ldstr "\u7cfb\u7edf\u6b63\u5728\u521d\u59cb\u5316"
    L_0055: callvirt instance void i::a(string)
    L_005a: nop
    L_005b: ldsfld class i a::k
    L_0060: callvirt instance void [System.Windows.Forms]System.Windows.Forms.Control::Show()
    L_0065: nop
    L_0066: call void [System.Windows.Forms]System.Windows.Forms.Application::DoEvents()
    L_006b: nop
    L_006c: ldsfld class i a::k
    L_0071: stloc.0
    L_0072: ldc.i4 1
    L_0077: stloc num
    L_007b: br.s L_0002
    L_007d: br.s L_0099
    L_007f: newobj instance void i::.ctor()
    L_0084: stsfld class i a::k
    L_0089: ldc.i4 3
    L_008e: stloc num
    L_0092: br L_0002
    L_0097: br.s L_004b
    L_0099: ldloc.0
    L_009a: ret
}

[培训]《安卓高级研修班(网课)》月薪三万计划,掌握调试、分析还原ollvm、vmp的方法,定制art虚拟机自动化脱壳的方法

收藏
免费 0
支持
分享
最新回复 (6)
雪    币: 504
活跃值: (10)
能力值: ( LV3,RANK:30 )
在线值:
发帖
回帖
粉丝
2
你可以使用反混淆工具反混淆后。可以看到C#,其实也不多代码,可以自己重写
2009-5-17 07:42
0
雪    币: 211
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
3
哦,谢谢,反混淆工具那个好用呀
2009-5-18 08:05
0
雪    币: 504
活跃值: (10)
能力值: ( LV3,RANK:30 )
在线值:
发帖
回帖
粉丝
4
先要知道使用什么混淆,然后再选择对应工具
2009-5-18 09:44
0
雪    币: 225
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
5
自己手动就可以还原了,只是简单的混淆
2009-5-19 20:26
0
雪    币: 213
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
6
.method public hidebysig static class i a(string O1l) cil managed
{
    .maxstack 2
    .locals init (
        [0] class i i,
        [1] bool flag,
        [2] int32 num)
   
    L_001b: nop
    L_001c: ldsfld class i a::k
    L_0021: ldnull
    L_0022: ceq
    L_0024: ldc.i4.0
    L_0025: ceq
    L_0027: stloc.1
    L_0028: ldc.i4.1
    L_0029: br.s L_002e
    L_002b: ldc.i4.0
    L_002c: br.s L_002e
    L_002e: brfalse.s L_0030

    L_003b: ldloc.1
    L_003c: brtrue.s L_004b
  
    L_0049: br.s L_007f
    L_004b: ldsfld class i a::k
    L_0050: ldstr "\u7cfb\u7edf\u6b63\u5728\u521d\u59cb\u5316"
    L_0055: callvirt instance void i::a(string)
    L_005a: nop
    L_005b: ldsfld class i a::k
    L_0060: callvirt instance void [System.Windows.Forms]System.Windows.Forms.Control::Show()
    L_0065: nop
    L_0066: call void [System.Windows.Forms]System.Windows.Forms.Application::DoEvents()
    L_006b: nop
    L_006c: ldsfld class i a::k
    L_0071: stloc.0

    L_007d: br.s L_0099
    L_007f: newobj instance void i::.ctor()
    L_0084: stsfld class i a::k

    L_0097: br.s L_004b
    L_0099: ldloc.0
    L_009a: ret
}
2009-5-21 08:44
0
雪    币: 213
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
7
去掉混淆后的代码是
.method public hidebysig static class i a(string O1l) cil managed
{
    .maxstack 2
    .locals init (
        [0] class i i,
        [1] bool flag,
        [2] int32 num)
   
    L_001b: nop
    L_001c: ldsfld class i a::k
    L_0021: ldnull
    L_0022: ceq
    L_0024: ldc.i4.0
    L_0025: ceq
    L_0027: stloc.1
    L_0028: ldc.i4.1
    L_0029: br.s L_002e
    L_002b: ldc.i4.0
    L_002c: br.s L_002e
    L_002e: brfalse.s L_0030

    L_003b: ldloc.1
    L_003c: brtrue.s L_004b
  
    L_0049: br.s L_007f
    L_004b: ldsfld class i a::k
    L_0050: ldstr "\u7cfb\u7edf\u6b63\u5728\u521d\u59cb\u5316"
    L_0055: callvirt instance void i::a(string)
    L_005a: nop
    L_005b: ldsfld class i a::k
    L_0060: callvirt instance void [System.Windows.Forms]System.Windows.Forms.Control::Show()
    L_0065: nop
    L_0066: call void [System.Windows.Forms]System.Windows.Forms.Application::DoEvents()
    L_006b: nop
    L_006c: ldsfld class i a::k
    L_0071: stloc.0

    L_007d: br.s L_0099
    L_007f: newobj instance void i::.ctor()
    L_0084: stsfld class i a::k

    L_0097: br.s L_004b
    L_0099: ldloc.0
    L_009a: ret
}
2009-5-21 08:46
0
游客
登录 | 注册 方可回帖
返回
//