一段防止反编译的代码(托管代码),看能不能防主

[YiYanXiYin]

有空看看：
有兴趣的朋友来攻克一个难关

请看下面的代码：


using System;
using System.Text;
using System.Text.RegularExpressions;
using System.Web.Mail;
using System.Threading;



namespace NewDemo
{
class A
{
private string p = "y";
private string p1="*";
private string p2="&";
private string p3="&d*";
private string p4="#a";
private string p5="k";
private string p6="#|";
private string p7="{";
private string p8="d+";
private string p9="_7";
private string p10="+";
private string p11="]";
private string p12="}";
private string p13="-1";
private string p14="?";
private string p15="9";
private string p16="c";
private string p17="u";
private string p18="<";
private string p19="_xi";
private string p20="1&";
private string p21="op";
private string p22=".";
private string p23="yan";
private string p24="";

public string Password()
{
return p24 + p24 + p23 + p19 + p13 + p24 + p24 + p15 + p2 + p1 + p24 + p24;
}
}

class Demo
{
static void Main()
{
A a = new A();
Console.WriteLine( a.Password() );
return;

}
}
}

现在如果没有源代码，只有一个exe,当然不会有console.writeline这一行了。
你能不能得出 Password() 的返回值？

当然这个exe被混淆了。

混淆结果如下：

namespace NewDemo
{
using System;

internal class a
{
// Methods
public a()
{
this.a = "y";
this.@as = "*";
this.@as = "&";
this.@as = "&d*";
this.@as = "#a";
this.@as = "k";
this.@as = "#|";
this.@as = "{";
this.@as = "d+";
this.@as = "_7";
this.@as = "+";
this.@as = "]";
this.@as = "}";
this.@as = "-1";
this.@as = "?";
this.@as = "9";
this.@as = "c";
this.@as = "u";
this.@as = "<";
this.@as = "_xi";
this.@as = "1&";
this.@as = "op";
this.@as = ".";
this.@as = "yan";
this.@as = "";
}

public string Password()
{
string[] textArray1 = new string[] { this.@as, this.@as, this.@as, this.@as, this.@as, this.@as, this.@as, this.@as, this.@as, this.@as, this.@as, this.@as } ;
return string.Concat(textArray1);
}


// Fields
private string a;
private string @as;
private string @as;
private string @as;
private string @as;
private string @as;
private string @as;
private string @as;
private string @as;
private string @as;
private string @as;
private string @as;
private string @as;
private string @as;
private string @as;
private string @as;
private string @as;
private string @as;
private string @as;
private string @as;
private string @as;
private string @as;
private string @as;
private string @as;
private string @as;
}
}


这就是混淆结果

你能知道password为多少？


我的目的就是为了防止反编译（当然绝对的防止是不可能，做到要花很大的力气就可以了），讨论一下能不能比较容易的被破解，如果那样的话，我将做进一步的修改

[YiYanXiYin]

ERPDotNet(), il代码是看不出来的
tiaoci(我挑刺，我快乐) , 当然,你说的对,不过,我的代码是用来测试的,最后Password()会变成private的

[tiaoci]

private也没有用，通过反射GetMethod这样，

私有函数也能得到

你就死了这条心吧 :)

[tiaoci]

要是真有反编译这种手段，

ＭＳ早就提出方案了

[tiaoci]

想想吧，就像windows这种序列号算法都会被破解(那个可是机器码)

你这种简单的加密有什么用

[哈哈007哈]

哈哈，你再怎么混淆都不行的拉，只要看懂il，你就不行呀

[YiYanXiYin]

反射能调用private method?我去试一下......


我的前提条件就是让破解稍稍复杂一点.当然没有奢望能真正防止破解.

[YiYanXiYin]

xiaxilin(good good study, day day up!)

现在你真的能看懂混淆后的代码?

[YiYanXiYin]

tiaoci(我挑刺，我快乐) ,请指点一下,怎么反射私有方法?我没找到方法.

[ERPDotNet]

我刚才用楼主的代码测试了一下,我用的混淆器是vs自带的那个功能比较差的, 再用IL DASM反汇编出来,除了变量名有些变化外,没有别的变化了,下面是主要部份的内容:

.class private auto ansi beforefieldinit a
extends [mscorlib]System.Object
{
.field private string a
.field private string b
.field private string c
.field private string d
.field private string e
.field private string f
.field private string g
.field private string h
.field private string i
.field private string j
.field private string k
.field private string l
.field private string m
.field private string n
.field private string o
.field private string p
.field private string q
.field private string r
.field private string s
.field private string t
.field private string u
.field private string v
.field private string w
.field private string x
.field private string y
.method public hidebysig instance string
a() cil managed
{
// Code size 126 (0x7e)
.maxstack 3
.locals init (string[] V_0)
IL_0000: ldc.i4.s 12
IL_0002: newarr [mscorlib]System.String
IL_0007: stloc.0
IL_0008: ldloc.0
IL_0009: ldc.i4.0
IL_000a: ldarg.0
IL_000b: ldfld string a::y
IL_0010: stelem.ref
IL_0011: ldloc.0
IL_0012: ldc.i4.1
IL_0013: ldarg.0
IL_0014: ldfld string a::y
IL_0019: stelem.ref
IL_001a: ldloc.0
IL_001b: ldc.i4.2
IL_001c: ldarg.0
IL_001d: ldfld string a::x
IL_0022: stelem.ref
IL_0023: ldloc.0
IL_0024: ldc.i4.3
IL_0025: ldarg.0
IL_0026: ldfld string a::t
IL_002b: stelem.ref
IL_002c: ldloc.0
IL_002d: ldc.i4.4
IL_002e: ldarg.0
IL_002f: ldfld string a::n
IL_0034: stelem.ref
IL_0035: ldloc.0
IL_0036: ldc.i4.5
IL_0037: ldarg.0
IL_0038: ldfld string a::y
IL_003d: stelem.ref
IL_003e: ldloc.0
IL_003f: ldc.i4.6
IL_0040: ldarg.0
IL_0041: ldfld string a::y
IL_0046: stelem.ref
IL_0047: ldloc.0
IL_0048: ldc.i4.7
IL_0049: ldarg.0
IL_004a: ldfld string a::p
IL_004f: stelem.ref
IL_0050: ldloc.0
IL_0051: ldc.i4.8
IL_0052: ldarg.0
IL_0053: ldfld string a::c
IL_0058: stelem.ref
IL_0059: ldloc.0
IL_005a: ldc.i4.s 9
IL_005c: ldarg.0
IL_005d: ldfld string a::b
IL_0062: stelem.ref
IL_0063: ldloc.0
IL_0064: ldc.i4.s 10
IL_0066: ldarg.0
IL_0067: ldfld string a::y
IL_006c: stelem.ref
IL_006d: ldloc.0
IL_006e: ldc.i4.s 11
IL_0070: ldarg.0
IL_0071: ldfld string a::y
IL_0076: stelem.ref
IL_0077: ldloc.0
IL_0078: call string [mscorlib]System.String::Concat(string[])
IL_007d: ret
} // end of method a::a

.method public hidebysig specialname rtspecialname
instance void .ctor() cil managed
{
// Code size 282 (0x11a)
.maxstack 2
IL_0000: ldarg.0
IL_0001: ldstr "y"
IL_0006: stfld string a::a
IL_000b: ldarg.0
IL_000c: ldstr "*"
IL_0011: stfld string a::b
IL_0016: ldarg.0
IL_0017: ldstr "&"
IL_001c: stfld string a::c
IL_0021: ldarg.0
IL_0022: ldstr "&d*"
IL_0027: stfld string a::d
IL_002c: ldarg.0
IL_002d: ldstr "#a"
IL_0032: stfld string a::e
IL_0037: ldarg.0
IL_0038: ldstr "k"
IL_003d: stfld string a::f
IL_0042: ldarg.0
IL_0043: ldstr "#|"
IL_0048: stfld string a::g
IL_004d: ldarg.0
IL_004e: ldstr "{"
IL_0053: stfld string a::h
IL_0058: ldarg.0
IL_0059: ldstr "d+"
IL_005e: stfld string a::i
IL_0063: ldarg.0
IL_0064: ldstr "_7"
IL_0069: stfld string a::j
IL_006e: ldarg.0
IL_006f: ldstr "+"
IL_0074: stfld string a::k
IL_0079: ldarg.0
IL_007a: ldstr "]"
IL_007f: stfld string a::l
IL_0084: ldarg.0
IL_0085: ldstr "}"
IL_008a: stfld string a::m
IL_008f: ldarg.0
IL_0090: ldstr "-1"
IL_0095: stfld string a::n
IL_009a: ldarg.0
IL_009b: ldstr "\?"
IL_00a0: stfld string a::o
IL_00a5: ldarg.0
IL_00a6: ldstr "9"
IL_00ab: stfld string a::p
IL_00b0: ldarg.0
IL_00b1: ldstr "c"
IL_00b6: stfld string a::q
IL_00bb: ldarg.0
IL_00bc: ldstr "u"
IL_00c1: stfld string a::r
IL_00c6: ldarg.0
IL_00c7: ldstr "<"
IL_00cc: stfld string a::s
IL_00d1: ldarg.0
IL_00d2: ldstr "_xi"
IL_00d7: stfld string a::t
IL_00dc: ldarg.0
IL_00dd: ldstr "1&"
IL_00e2: stfld string a::u
IL_00e7: ldarg.0
IL_00e8: ldstr "op"
IL_00ed: stfld string a::v
IL_00f2: ldarg.0
IL_00f3: ldstr "."
IL_00f8: stfld string a::w
IL_00fd: ldarg.0
IL_00fe: ldstr "yan"
IL_0103: stfld string a::x
IL_0108: ldarg.0
IL_0109: ldstr ""
IL_010e: stfld string a::y
IL_0113: ldarg.0
IL_0114: call instance void [mscorlib]System.Object::.ctor()
IL_0119: ret
} // end of method a::.ctor

} // end of class a

要不楼主将您自已的测试成果用IL DASM反汇编出来, 应该是很清楚的.

[zeusvenus]

效果不是很好，但努力可嘉！欣赏楼主自己做混淆技术！

[tiaoci]

to YiYanXiYin

BindingFlags.NonPublic 加上这个就能得到了，

然后这个方法就可以随便调用

[ERPDotNet]

混淆后怎么变量名全部变成了@as ? 这个不太合情理.
像这么简单的东西, 直接看MSIL就看出来了.

我的一个想法是某些关键的地方, 使用C++编写,混合托管代码和非托管代码,但这也仅是一个构思.

按照冰棍的说法, 没有不能破解的防破解办法.

[暗石绿]

Mark

[tiaoci]

不能，我根本不需要反编译，直接调用那个password方法就够了

加上你那个ｄｌｌ的引用，然后象下面这样

Type t = youAssembly.GetType("a");

Dump(t.GetMethod("Password",
BindingFlags.xxxx).Invoke(xxx));

基本上象这样就可以了

[diandian82]

mark

[YiYanXiYin]

我用的混淆器,可以将想混淆的所有成员变量以及方法名称全部混淆成@aa,都是同一个名字,所以il没有,反射也没用.

[YiYanXiYin]

SpDevelop混淆器(.Net) 1.0
我用的这个

[kongfh]

道高一尺魔高一丈。混淆是增加了反编译的难度，但是不能杜绝。就是微软也无可奈何。

[YiYanXiYin]

我这个不是单纯的使用混淆器的.