3

I have a bit of a unique problem. Basically, I work on a .Net obfuscator. An obfuscated assembly gets bad IL that crashes. I need to debug this obfuscated IL and figure out why it crashes.

My current approach is:

  1. Disassemble assembly with ildasm
  2. Import the IL code into Visual Studio and attempt to compile, debug, and reproduce it there.

My problem is that Visual Studio doesn't seem to like .il files. How do I get it to treat IL files like they should?

Also, don't suggest this method. I tried it and the bug magically disappears upon recompiling it..

Community
  • 1
  • 1
Earlz
  • 62,085
  • 98
  • 303
  • 499
  • Something is probably using reflection and doesn't like names being changed around...(but maybe you already knew that). Does the obfuscator give you a debugging database or symbols table? If so you may be able to just attach a debugger normally and step through. Maybe I'm off-base though – lc. Aug 29 '12 at 15:55
  • Did you already try PEVerify on the obfuscated assembly? – svick Aug 29 '12 at 16:19
  • @lc. No reflection, though there is a bit of unmanaged code – Earlz Aug 29 '12 at 16:54
  • @svick Yes. It's all verified – Earlz Aug 29 '12 at 16:54
  • How about data-binding where you specify strings for object names? Maybe the obfuscator didn't pick them all up and change them? – lc. Aug 29 '12 at 16:56
  • @lc. Our obfuscator would detect them and exclude them, but this particular assembly doesn't have anything like that. It's also not renaming, it's only obscuring the control-flow. (expanding if's into redundant switches and reordering and a few other things) – Earlz Aug 29 '12 at 16:57

1 Answers1

1

When I had a similar problem, I used .NET Reflector with Deblector plugin (it was maybe 3-4 years ago). Now Reflector is not free, but I think you can use a trial version for simple debugging. It looks like .NET Reflector Pro contains the same features as an old Reflector + Deblector, so you can debug pure IL code. BTW, you can still use Deblector, as the new version supports Reflector 7 - http://deblector.codeplex.com/releases/view/93326

vladich
  • 568
  • 6
  • 9