String / Character Conversion Question

[mikeb]

Re: String / Character Conversion Question

mikeb wrote:[color=blue]
> anon wrote:
>[color=green]
>> This is where I saw it. So I looked and I saw they started to change the
>> names at the system level and then I said, how did they manage to do
>> this.
>>
>> http://www.semdesigns.com/Products/O...onExample.html
>>
>>[/color]
>
> it's hard to know what they're doing in the example, but there are a
> couple of comments that I think I can make:
>
> 1) using statements (of the namespace sort) do not get compiled down to
> IL - they're used by the C# compiler to make dealing with nested
> namespace names more convenient. However, the emited IL always deals
> with the full typenames, so I'm not sure how a decompiler would generate
> using statements, except by noting which nested namespaces are used in
> the entire assembly and emitting a using statement for some or all of
> those. In this case, the using statements would not magically appear in
> the same order in the decompiled source as they were in the original
> source as they seem to do in the example.
>
> 2) More importantly, there are no types from the System.Globaliz ation
> namespace being used in the example. If no types from that namespace
> are used, then the decompiler would be free to put pretty much any
> namespace it wanted in place of "using System.Globaliz ation;". However,
> I'm at a loss as to why it would decide to do anything with
> System.Globaliz ation if no types from that namespace are used.
>
> Looking at the example some more, I notice that the following namespaces
> get renamed:
>
> antlr
> antlr.collectio ns
> System.Globaliz ation
> System.IO
>
>
> These seem to correspond to the namespaces that don't actually get used.
> That would explain why they can rename those namespaces, but it doesn't
> explain why they'd have anything at all for those namespaces in the
> decompiled code. Maybe I'm mistaken in my point #1, but I don't think so.
>
>[/color]

I see now that the obfuscator is not obfuscating compiled IL, but
obfuscating directly from the source. As noted by Jon Skeet, that's not
a particularly useful thing to do. I guess it gets you a certain level
of obfuscated names in any assembly compiled from the obfuscated source,
but the tricks they pull with using \uXXXX encoded characters won't buy
a single thing once compiled.

However, it does explain how they can rename get the using statements.

It's a simple as:

The namespaces are not used, so they can rename them however they want.
To get the obfuscated source to compile, they would need to provide a
namespace somewhere that the compiler can match up with or there's a
compiler error. There doesn't need to be anything useful in that
namespace, however.

One thing that I am still curious about is that they rename the
Hashtable class. This causes a compiler error. I believe that this is a
mistake in their obfuscation example. Hashtable should have been
included in the list of public items that should not be renamed.

....<snip>...

--
mikeb

[mikeb]

Re: String / Character Conversion Question

mikeb wrote:[color=blue]
> anon wrote:
>[color=green]
>> This is where I saw it. So I looked and I saw they started to change the
>> names at the system level and then I said, how did they manage to do
>> this.
>>
>> http://www.semdesigns.com/Products/O...onExample.html
>>
>>[/color]
>
> it's hard to know what they're doing in the example, but there are a
> couple of comments that I think I can make:
>
> 1) using statements (of the namespace sort) do not get compiled down to
> IL - they're used by the C# compiler to make dealing with nested
> namespace names more convenient. However, the emited IL always deals
> with the full typenames, so I'm not sure how a decompiler would generate
> using statements, except by noting which nested namespaces are used in
> the entire assembly and emitting a using statement for some or all of
> those. In this case, the using statements would not magically appear in
> the same order in the decompiled source as they were in the original
> source as they seem to do in the example.
>
> 2) More importantly, there are no types from the System.Globaliz ation
> namespace being used in the example. If no types from that namespace
> are used, then the decompiler would be free to put pretty much any
> namespace it wanted in place of "using System.Globaliz ation;". However,
> I'm at a loss as to why it would decide to do anything with
> System.Globaliz ation if no types from that namespace are used.
>
> Looking at the example some more, I notice that the following namespaces
> get renamed:
>
> antlr
> antlr.collectio ns
> System.Globaliz ation
> System.IO
>
>
> These seem to correspond to the namespaces that don't actually get used.
> That would explain why they can rename those namespaces, but it doesn't
> explain why they'd have anything at all for those namespaces in the
> decompiled code. Maybe I'm mistaken in my point #1, but I don't think so.
>
>[/color]

I see now that the obfuscator is not obfuscating compiled IL, but
obfuscating directly from the source. As noted by Jon Skeet, that's not
a particularly useful thing to do. I guess it gets you a certain level
of obfuscated names in any assembly compiled from the obfuscated source,
but the tricks they pull with using \uXXXX encoded characters won't buy
a single thing once compiled.

However, it does explain how they can rename get the using statements.

It's a simple as:

The namespaces are not used, so they can rename them however they want.
To get the obfuscated source to compile, they would need to provide a
namespace somewhere that the compiler can match up with or there's a
compiler error. There doesn't need to be anything useful in that
namespace, however.

One thing that I am still curious about is that they rename the
Hashtable class. This causes a compiler error. I believe that this is a
mistake in their obfuscation example. Hashtable should have been
included in the list of public items that should not be renamed.

....<snip>...

--
mikeb

[Jon Skeet [C# MVP]]

Re: String / Character Conversion Question

anon <anon@hotmail.c om> wrote:[color=blue]
> Do you think these guys know something we don't know? At least for changing
> the names to system classes?
>
> But in regards to obfuscating source code, let's say if you did compile it
> and then decompiled it.
>
> The decompiled version would like or be similar to the source code which
> would be obfuscated anyway.[/color]

Well, the decompiled source code wouldn't have the \uxxxx bits in when
they're not needed, and it would have appropriate line breaks. For
instance, here's a similar program to the one they were talking about,
but done by hand:

using System;class \u0051{static void \u004d\u0061\u0 069\u006e()
{\u0043\u006f\u 006e\u0073\u006 f\u006c\u0065.\ u0057rite\u004c ine
("\u0048\u0065\ u006c\u006c\u00 6f");}}

(It could be made worse, but that'll do...)

Looks pretty bad, right? Until you run it through a decompiler, which
gives (for the Main method, for instance):

private static void Main()
{
Console.WriteLi ne("Hello");
}

The only bit of obfuscation left is the class name (Q).
[color=blue]
> The name changes would be, at least to me, a somewhat considerable hurdle to
> figure out or use the source code in the first place. You would have only a
> glimmer of an idea of what the source code did as you could not read that
> anyway.[/color]

Absolutely. Obfuscators renaming code is absolutely great - it's the
extra "features" they're promoting (like putting everything on one
line, changing some of the text to include unicode escapes, etc) which
make no odds in the long run.

--
Jon Skeet - <skeet@pobox.co m>

http://www.pobox.com/~skeet

If replying to the group, please do not mail me too

[Jon Skeet [C# MVP]]

Re: String / Character Conversion Question

anon <anon@hotmail.c om> wrote:[color=blue]
> Do you think these guys know something we don't know? At least for changing
> the names to system classes?
>
> But in regards to obfuscating source code, let's say if you did compile it
> and then decompiled it.
>
> The decompiled version would like or be similar to the source code which
> would be obfuscated anyway.[/color]

Well, the decompiled source code wouldn't have the \uxxxx bits in when
they're not needed, and it would have appropriate line breaks. For
instance, here's a similar program to the one they were talking about,
but done by hand:

using System;class \u0051{static void \u004d\u0061\u0 069\u006e()
{\u0043\u006f\u 006e\u0073\u006 f\u006c\u0065.\ u0057rite\u004c ine
("\u0048\u0065\ u006c\u006c\u00 6f");}}

(It could be made worse, but that'll do...)

Looks pretty bad, right? Until you run it through a decompiler, which
gives (for the Main method, for instance):

private static void Main()
{
Console.WriteLi ne("Hello");
}

The only bit of obfuscation left is the class name (Q).
[color=blue]
> The name changes would be, at least to me, a somewhat considerable hurdle to
> figure out or use the source code in the first place. You would have only a
> glimmer of an idea of what the source code did as you could not read that
> anyway.[/color]

Absolutely. Obfuscators renaming code is absolutely great - it's the
extra "features" they're promoting (like putting everything on one
line, changing some of the text to include unicode escapes, etc) which
make no odds in the long run.

--
Jon Skeet - <skeet@pobox.co m>

http://www.pobox.com/~skeet

If replying to the group, please do not mail me too

[anon]

Re: String / Character Conversion Question

see below...


"Jon Skeet [C# MVP]" <skeet@pobox.co m> wrote in message
news:MPG.1af2d3 e27b51d4f298a73 1@msnews.micros oft.com...[color=blue]
> anon <anon@hotmail.c om> wrote:[color=green]
> > Do you think these guys know something we don't know? At least for[/color][/color]
changing[color=blue][color=green]
> > the names to system classes?
> >
> > But in regards to obfuscating source code, let's say if you did compile[/color][/color]
it[color=blue][color=green]
> > and then decompiled it.
> >
> > The decompiled version would like or be similar to the source code which
> > would be obfuscated anyway.[/color]
>
> Well, the decompiled source code wouldn't have the \uxxxx bits in when
> they're not needed, and it would have appropriate line breaks. For
> instance, here's a similar program to the one they were talking about,
> but done by hand:
>
> using System;class \u0051{static void \u004d\u0061\u0 069\u006e()
> {\u0043\u006f\u 006e\u0073\u006 f\u006c\u0065.\ u0057rite\u004c ine
> ("\u0048\u0065\ u006c\u006c\u00 6f");}}
>
> (It could be made worse, but that'll do...)
>
> Looks pretty bad, right? Until you run it through a decompiler, which
> gives (for the Main method, for instance):[/color]




When you say run it through a decompiler, Is that the very first step?

Or do you mean (1st) compile, then (2nd) decompile?

And which decompiler would you be talking about?




[color=blue]
>
> private static void Main()
> {
> Console.WriteLi ne("Hello");
> }
>
> The only bit of obfuscation left is the class name (Q).
>[color=green]
> > The name changes would be, at least to me, a somewhat considerable[/color][/color]
hurdle to[color=blue][color=green]
> > figure out or use the source code in the first place. You would have[/color][/color]
only a[color=blue][color=green]
> > glimmer of an idea of what the source code did as you could not read[/color][/color]
that[color=blue][color=green]
> > anyway.[/color]
>
> Absolutely. Obfuscators renaming code is absolutely great - it's the
> extra "features" they're promoting (like putting everything on one
> line, changing some of the text to include unicode escapes, etc) which
> make no odds in the long run.
>
> --
> Jon Skeet - <skeet@pobox.co m>
> http://www.pobox.com/~skeet
> If replying to the group, please do not mail me too[/color]

[anon]

Re: String / Character Conversion Question

see below...


"Jon Skeet [C# MVP]" <skeet@pobox.co m> wrote in message
news:MPG.1af2d3 e27b51d4f298a73 1@msnews.micros oft.com...[color=blue]
> anon <anon@hotmail.c om> wrote:[color=green]
> > Do you think these guys know something we don't know? At least for[/color][/color]
changing[color=blue][color=green]
> > the names to system classes?
> >
> > But in regards to obfuscating source code, let's say if you did compile[/color][/color]
it[color=blue][color=green]
> > and then decompiled it.
> >
> > The decompiled version would like or be similar to the source code which
> > would be obfuscated anyway.[/color]
>
> Well, the decompiled source code wouldn't have the \uxxxx bits in when
> they're not needed, and it would have appropriate line breaks. For
> instance, here's a similar program to the one they were talking about,
> but done by hand:
>
> using System;class \u0051{static void \u004d\u0061\u0 069\u006e()
> {\u0043\u006f\u 006e\u0073\u006 f\u006c\u0065.\ u0057rite\u004c ine
> ("\u0048\u0065\ u006c\u006c\u00 6f");}}
>
> (It could be made worse, but that'll do...)
>
> Looks pretty bad, right? Until you run it through a decompiler, which
> gives (for the Main method, for instance):[/color]




When you say run it through a decompiler, Is that the very first step?

Or do you mean (1st) compile, then (2nd) decompile?

And which decompiler would you be talking about?




[color=blue]
>
> private static void Main()
> {
> Console.WriteLi ne("Hello");
> }
>
> The only bit of obfuscation left is the class name (Q).
>[color=green]
> > The name changes would be, at least to me, a somewhat considerable[/color][/color]
hurdle to[color=blue][color=green]
> > figure out or use the source code in the first place. You would have[/color][/color]
only a[color=blue][color=green]
> > glimmer of an idea of what the source code did as you could not read[/color][/color]
that[color=blue][color=green]
> > anyway.[/color]
>
> Absolutely. Obfuscators renaming code is absolutely great - it's the
> extra "features" they're promoting (like putting everything on one
> line, changing some of the text to include unicode escapes, etc) which
> make no odds in the long run.
>
> --
> Jon Skeet - <skeet@pobox.co m>
> http://www.pobox.com/~skeet
> If replying to the group, please do not mail me too[/color]

[Jon Skeet [C# MVP]]

Re: String / Character Conversion Question

anon <anon@hotmail.c om> wrote:[color=blue][color=green]
> > Looks pretty bad, right? Until you run it through a decompiler, which
> > gives (for the Main method, for instance):[/color]
>
> When you say run it through a decompiler, Is that the very first step?
>
> Or do you mean (1st) compile, then (2nd) decompile?[/color]

You'd compile first - but typically the only reason for obfuscation is
to protect your binaries anyway. If you don't want people reading your
source code, why give them it in any form to start with?
[color=blue]
> And which decompiler would you be talking about?[/color]

That was using Reflector, but I believe I'd get the same result with
others.

--
Jon Skeet - <skeet@pobox.co m>

http://www.pobox.com/~skeet

If replying to the group, please do not mail me too

[Jon Skeet [C# MVP]]

Re: String / Character Conversion Question

anon <anon@hotmail.c om> wrote:[color=blue][color=green]
> > Looks pretty bad, right? Until you run it through a decompiler, which
> > gives (for the Main method, for instance):[/color]
>
> When you say run it through a decompiler, Is that the very first step?
>
> Or do you mean (1st) compile, then (2nd) decompile?[/color]

You'd compile first - but typically the only reason for obfuscation is
to protect your binaries anyway. If you don't want people reading your
source code, why give them it in any form to start with?
[color=blue]
> And which decompiler would you be talking about?[/color]

That was using Reflector, but I believe I'd get the same result with
others.

--
Jon Skeet - <skeet@pobox.co m>

http://www.pobox.com/~skeet

If replying to the group, please do not mail me too