0xd4d/de4dot — Issue #17: Unknown Obfuscator + SmartAssembly 6.5.0.1037
Author: high6
Created: 2012-01-14 10:30:19+00:00
State: open

Attribute says SmartAssembly 6.5.0.1037 but there was also another obfuscator used after it. You can find the assembly here http://www.mediafire.com/?8i9rdqlxdcbssuc .

Here is what I have researched so far.

There is no delegate masking instead it uses methods for masking calls. These methods always end with 2 int parameters which are xored inside the method to decide whats called.

Class9.Class6.smethod_7(0xbb, 0xa3);

internal static void smethod_7(int int_0, int int_1)
{
switch ((int_1 ^ int_0))
{
case 0x18:
Application.EnableVisualStyles();
return;

case 0x19:
Process.EnterDebugMode();
return;

case 0x1a:
Application.Exit();
return;
}
}

Resources are compressed into an assembly and encrypted with a simple xor cipher. Here is the code I used to decrypt it.

var bytes = File.ReadAllBytes("file");
int key = bytes[0];
var output = new byte[bytes.Length - 1];
for (int i = 0; i < output.Length; i++)
{
output[i] = (byte)(bytes[i + 1] ^ ((byte)((i + key) & 0xff)));
}
var decompressed = new MemoryStream();
using (var stream = new DeflateStream(new MemoryStream(output), CompressionMode.Decompress, true))
{
int read;
byte[] temp = new byte[0x400];
while ((read = stream.Read(temp, 0, temp.Length)) > 0x0)
{
decompressed.Write(temp, 0, read);
}
}

String encryption is a bit different. Strings aren't in a resource. Instead they are embedded in the string decrypt method. Callers pass an index which has been xored. The string decrypt method xors it to get the index, checks if the string has been cached, if not then finds its raw data, decrypts it xoring with a key string inside the method "᩠㇯ಓ㋵ᓃ㭑", caches it and then returns it.

Let me know if I can assist you.