+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Blackhat Training (https://hackforums.net/forumdisplay.php?fid=405)
+----- Forum: Reverse Engineering (https://hackforums.net/forumdisplay.php?fid=229)
+----- Thread: Decompile dll file (.Net) to C# (/showthread.php?tid=6271934)
Decompile dll file (.Net) to C# - minix6800 - May 26, 2024
hello,
I need a bit of help to decompile a dll file so I can understand how the code achieves its purpose
hps://apps.autodesk.com/RVT/en/Detail/Index?id=2118236460569478369&appLang=en&os=Win64]Lock_it
I have unpacked the MSI and tried to de-compile the dll file using Dotpeek.
The issue is some part of the decompiled code is not read-able
example of part of code here
private static string \u0036([In] int obj0, [In] int obj1, [In] int obj2)
{
string str = Encoding.UTF8.GetString(\u0030F8CC8D7\u002D8DA3\u002D41B3\u002DABE8\u002D532D486F9A6F.\u0034, obj1, obj2);
\u0030F8CC8D7\u002D8DA3\u002D41B3\u002DABE8\u002D532D486F9A6F.\u0035[obj0] = str;
return str;
}
public static string \u00A0()
{
return \u0030F8CC8D7\u002D8DA3\u002D41B3\u002DABE8\u002D532D486F9A6F.\u0035[0] ?? \u0030F8CC8D7\u002D8DA3\u002D41B3\u002DABE8\u002D532D486F9A6F.\u0036(0, 0, 12);
}
public static string \u1680()
{
return \u0030F8CC8D7\u002D8DA3\u002D41B3\u002DABE8\u002D532D486F9A6F.\u0035[1] ?? \u0030F8CC8D7\u002D8DA3\u002D41B3\u002DABE8\u002D532D486F9A6F.\u0036(1, 12, 7);
}
is it possible to get clean code that I can study and understand how it was done.
Thanks
This is the msi file
hps://drive. google. com/file/d/1AihgomaxKOQJ6aXpixDcPW950BJlnUtV/view?usp=drive_link
This is the dll file I have extracted
h**ps://drive. google. com/file/d/1V_ZKOLR7rR8pTgGCfiwZZb3m1ekS12-T/view?usp=sharing
RE: Decompile dll file (.Net) to C# - notagh0st - May 28, 2024
(May 26, 2024 04:59 AM)minix6800 Wrote: hello,
I need a bit of help to decompile a dll file so I can understand how the code achieves its purpose
hps://apps.autodesk.com/RVT/en/Detail/Index?id=2118236460569478369&appLang=en&os=Win64]Lock_it
I have unpacked the MSI and tried to de-compile the dll file using Dotpeek.
The issue is some part of the decompiled code is not read-able
example of part of code here
private static string \u0036([In] int obj0, [In] int obj1, [In] int obj2)
{
string str = Encoding.UTF8.GetString(\u0030F8CC8D7\u002D8DA3\u002D41B3\u002DABE8\u002D532D486F9A6F.\u0034, obj1, obj2);
\u0030F8CC8D7\u002D8DA3\u002D41B3\u002DABE8\u002D532D486F9A6F.\u0035[obj0] = str;
return str;
}
public static string \u00A0()
{
return \u0030F8CC8D7\u002D8DA3\u002D41B3\u002DABE8\u002D532D486F9A6F.\u0035[0] ?? \u0030F8CC8D7\u002D8DA3\u002D41B3\u002DABE8\u002D532D486F9A6F.\u0036(0, 0, 12);
}
public static string \u1680()
{
return \u0030F8CC8D7\u002D8DA3\u002D41B3\u002DABE8\u002D532D486F9A6F.\u0035[1] ?? \u0030F8CC8D7\u002D8DA3\u002D41B3\u002DABE8\u002D532D486F9A6F.\u0036(1, 12, 7);
}
is it possible to get clean code that I can study and understand how it was done.
Thanks
This is the msi file
hps://drive. google. com/file/d/1AihgomaxKOQJ6aXpixDcPW950BJlnUtV/view?usp=drive_link
This is the dll file I have extracted
h**ps://drive. google. com/file/d/1V_ZKOLR7rR8pTgGCfiwZZb3m1ekS12-T/view?usp=sharing
These are just unicode characters that can be converted back into text, but even after doing that, it appears that all of the variable and function names are still obfuscated. i.e.
Code
public static string \u1680()
{
return \u0030F8CC8D7\u002D8DA3\u002D41B3\u002DABE8\u002D532D486F9A6F.\u0035[1] ?? \u0030F8CC8D7\u002D8DA3\u002D41B3\u002DABE8\u002D532D486F9A6F.\u0036(1, 12, 7);
}Becomes...
Code
public static string ()
{
return 0F8CC8D7-8DA3-41B3-ABE8-532D486F9A6F.5[1] ?? 0F8CC8D7-8DA3-41B3-ABE8-532D486F9A6F.6(1, 12, 7);
}So it cleans it up a little bit, but you'll still need to go through and rename everything as you go, i.e. 0F8CC8D7-8DA3-41B3-ABE8-532D486F9A6F appears to be some sort of static class, or object, figure out what 5 and 6() do and maybe it'll give you an idea of what you should rename that to. When it comes to obfuscated code, you can send small amounts of it to Chat GPT and see if it can take a crack at renaming the obfuscated code to give everything names that make more sense - sometimes it works, sometimes it doesn't, but if it does, it can save you a lot of time.
Edit: You can copy and paste all the code here: https://checkserp.com/encode/unicode/ and it will automatically convert all of the unicode characters to their normal text representation.
Edit 2: On second look, the unicode parts look like they're just junk filler code with a bunch of \u00 characters. Doesn't change anything about what methodology you need to use to go at it that I mentioned above, though.
RE: Decompile dll file (.Net) to C# - minix6800 - May 28, 2024
@notagh0st
Thanks for your help
RE: Decompile dll file (.Net) to C# - kasins39458 - May 30, 2024
try using de4dot to deobfuscate it
RE: Decompile dll file (.Net) to C# - minix6800 - May 31, 2024
thanks for the suggestion, I tried it and didn't have much luck with it
thanks anyway