[minix6800]

hello,

I need a bit of help to decompile a dll file so I can understand how the code achieves its purpose
hps://apps.autodesk.com/RVT/en/Detail/Index?id=2118236460569478369&appLang=en&os=Win64]Lock_it

I have unpacked the MSI and tried to de-compile the dll file using Dotpeek.
The issue is some part of the decompiled code is not read-able
example of part of code here
private static string \u0036([In] int obj0, [In] int obj1, [In] int obj2)
{
string str = Encoding.UTF8.GetString(\u0030F8CC8D7\u002D8DA3\u002D41B3\u002DABE8\u002D532D486F9A6F.\u0034, obj1, obj2);
\u0030F8CC8D7\u002D8DA3\u002D41B3\u002DABE8\u002D532D486F9A6F.\u0035[obj0] = str;
return str;
}

public static string \u00A0()
{
return \u0030F8CC8D7\u002D8DA3\u002D41B3\u002DABE8\u002D532D486F9A6F.\u0035[0] ?? \u0030F8CC8D7\u002D8DA3\u002D41B3\u002DABE8\u002D532D486F9A6F.\u0036(0, 0, 12);
}

public static string \u1680()
{
return \u0030F8CC8D7\u002D8DA3\u002D41B3\u002DABE8\u002D532D486F9A6F.\u0035[1] ?? \u0030F8CC8D7\u002D8DA3\u002D41B3\u002DABE8\u002D532D486F9A6F.\u0036(1, 12, 7);
}

is it possible to get clean code that I can study and understand how it was done.

Thanks

---

This is the msi file
hps://drive. google. com/file/d/1AihgomaxKOQJ6aXpixDcPW950BJlnUtV/view?usp=drive_link
This is the dll file I have extracted
h**ps://drive. google. com/file/d/1V_ZKOLR7rR8pTgGCfiwZZb3m1ekS12-T/view?usp=sharing

[notagh0st]

hello,

I need a bit of help to decompile a dll file so I can understand how the code achieves its purpose
hps://apps.autodesk.com/RVT/en/Detail/Index?id=2118236460569478369&appLang=en&os=Win64]Lock_it

I have unpacked the MSI and tried to de-compile the dll file using Dotpeek.
The issue is some part of the decompiled code is not read-able
example of part of code here
private static string \u0036([In] int obj0, [In] int obj1, [In] int obj2)
{
string str = Encoding.UTF8.GetString(\u0030F8CC8D7\u002D8DA3\u002D41B3\u002DABE8\u002D532D486F9A6F.\u0034, obj1, obj2);
\u0030F8CC8D7\u002D8DA3\u002D41B3\u002DABE8\u002D532D486F9A6F.\u0035[obj0] = str;
return str;
}

public static string \u00A0()
{
return \u0030F8CC8D7\u002D8DA3\u002D41B3\u002DABE8\u002D532D486F9A6F.\u0035[0] ?? \u0030F8CC8D7\u002D8DA3\u002D41B3\u002DABE8\u002D532D486F9A6F.\u0036(0, 0, 12);
}

public static string \u1680()
{
return \u0030F8CC8D7\u002D8DA3\u002D41B3\u002DABE8\u002D532D486F9A6F.\u0035[1] ?? \u0030F8CC8D7\u002D8DA3\u002D41B3\u002DABE8\u002D532D486F9A6F.\u0036(1, 12, 7);
}

is it possible to get clean code that I can study and understand how it was done.

Thanks

---

This is the msi file
hps://drive. google. com/file/d/1AihgomaxKOQJ6aXpixDcPW950BJlnUtV/view?usp=drive_link
This is the dll file I have extracted
h**ps://drive. google. com/file/d/1V_ZKOLR7rR8pTgGCfiwZZb3m1ekS12-T/view?usp=sharing

These are just unicode characters that can be converted back into text, but even after doing that, it appears that all of the variable and function names are still obfuscated. i.e.

Code

public static string \u1680()
{
return \u0030F8CC8D7\u002D8DA3\u002D41B3\u002DABE8\u002D532D486F9A6F.\u0035[1] ?? \u0030F8CC8D7\u002D8DA3\u002D41B3\u002DABE8\u002D532D486F9A6F.\u0036(1, 12, 7);
}

Becomes...

Code

public static string  ()
{
return 0F8CC8D7-8DA3-41B3-ABE8-532D486F9A6F.5[1] ?? 0F8CC8D7-8DA3-41B3-ABE8-532D486F9A6F.6(1, 12, 7);
}

So it cleans it up a little bit, but you'll still need to go through and rename everything as you go, i.e. 0F8CC8D7-8DA3-41B3-ABE8-532D486F9A6F appears to be some sort of static class, or object, figure out what 5 and 6() do and maybe it'll give you an idea of what you should rename that to. When it comes to obfuscated code, you can send small amounts of it to Chat GPT and see if it can take a crack at renaming the obfuscated code to give everything names that make more sense - sometimes it works, sometimes it doesn't, but if it does, it can save you a lot of time.

Edit: You can copy and paste all the code here: https://checkserp.com/encode/unicode/ and it will automatically convert all of the unicode characters to their normal text representation.

Edit 2: On second look, the unicode parts look like they're just junk filler code with a bunch of \u00 characters. Doesn't change anything about what methodology you need to use to go at it that I mentioned above, though.

[minix6800]

@notagh0st
Thanks for your help

[kasins39458]

try using de4dot to deobfuscate it

[minix6800]

thanks for the suggestion, I tried it and didn't have much luck with it
thanks anyway