这些符号在反编译代码中是什么

Question

I decompiled an executable and cant understand what are these symbols in the source code (C#). I would paste source examples here but as I tried pasting, the special characters in the decompiled source are not printable here in this editor. So i'm taking few snip images and pasting links here so anyone can see, so examples are:

what I am guessing is that this source code is obfuscated right? And that these symbols are OK to exist in the MSIL, but when translated as is in C#, they make for illegal characters. Is that right? Any suggestions on how do I get past this, like do a replace-all on this stuff?

Answer 1

MSIL has very lax rules for what is allowed as an identifier name. Obsfuscators intentionally choose chars which C# cannot represent so you can't roundtrip to C#.

You can decompile to IL however and be able to compile the project.

Also look at C#'s unicode identifiers . You can have unicode escape code inside of C# identifiers which is surprising to many. Example:

class @class
{
   public static void @static(bool @bool) {
      if (@bool)
         System.Console.WriteLine("true");
      else
         System.Console.WriteLine("false");
   }   
}
class Class1
{
   static void M() {
      cl\u0061ss.st\u0061tic(true);
   }
}

Answer 2

You could look at the file with a hex editor, figure out the 'rules' of these values, and then you might be able to write yourself a program that would convert them to ascii representations with some prefix - ie, obs_627 or whatever.

Of course you can only change names which will be referred to only from within the codebase you are changing. Any external linkage to these special names, or internal use of whatever the equivalent of reflection is, would break. If there's reason to expect either of these are the case, then it would be a wasted effort.

Answer 3

These are from the old MS-DOS ANSI character set.

The first example you posted contains ASCII line drawing characters. IIRC, they started around 172 decimal (0xAC hex) or so.

The second and third contain ASCII characters between 1 and 31 decimal (0x01-0x1F in hex notation).

You can't copy and paste them because the characters displayed don't exist in most modern fonts.