. NET obfuscation principle (i)

1. Il Foundation, what is IL

2. The simplest of confusion

3. What is the process of confusion, its advantages and disadvantages

4. Anti-confusing actual combat (principle + tool article)

5. The new generation of. NET Code Protection encryption Tool Maxtocode Fundamentals

6. Other means of protection

Okay, today we're going to talk about IL in basic ――.net.

I believe you all know whether you use C # or vb.net or C + + managed, the last compiled is the Il language assembly.

What is IL, it is an intermediate language byte code, exists in the high-level language and the machine code one kind of intermediate language. Its role is to establish a "unified" operation. NET running environment, so that net can cross platform (however, from the actual point of view, MS is not allowed net cross-platform, at least 3 years will not, or even longer. In fact, Cross-platform also nothing good, look at Java, known as a compilation, to run, the result becomes a compilation, debugging everywhere. I've never seen a lot of good Java-written tools in the Windows system, and maybe it's why I don't always pay attention to it. ）。

Sorry, just again digress, recently thought old interrupted, alas, this is a bad phenomenon. The format of IL is very similar to the format of assembly language, the difference is that IL language is more understandable than assembly language, because it can directly invoke the encapsulated object, and the running logic is consistent with the high-level language, so basically the same.

We can't make a systematic introduction to IL, so we use a very simple C # code, let's look at it: (Everything starts with simplicity, familiarity begins to complicate)

This code does not make sense, I just want to increase the amount of calculation, do the intensity test when I write this. Let's see how this code translates into what the IL will look like. C # code contrast, basically still relatively clear, may have some friends have been ldarg, Starg, ldloc, stloc confused, oh, in fact, see ripe release is good, he can be better than MOV, ah, behind the variable refers to also than the EAX register clear I. Method public Hidebysig instance Int32 Level3 (Int32 a) CIL managed

. method means that the area is a range of methods that refers to the contents of {}

Public Hidebysig instance is the property of this method

Int32 is the inverse value of this method, if the sub in the vb.net is translated here, the return value is void

Level3 is the method name, with the original code one to

Int32 A is the entry parameter, with the original code one to

CIL managed is a managed method

Because one of the main characteristics of net is metadata, and it takes a lot of program information, so basically, IL and C # very much. It is an old saying that everything is good and has its disadvantages.

{

. maxstack 2//Max Heap Quantity 2

This value can be computed from the exchange requirements in the code

. Locals init ([0] string s,//The type definition of the Exchange variable can be seen very clearly here.

Three variables with a parameter (or return value) are here

[1] unsigned int8[] b,

[2] class [Mscorlib]system.text.asciiencoding asii,

[3] int32 cs$00000003$00000000)



Here's the code area.



Il_0000:ldstr "215dsgfdart42315s"//Assignment Word Fule

il_0005:stloc.0//Assign value to variable feel like push

il_0006:newobj instance void [Mscorlib]system.text.asciiencoding::.ctor ()

Create a System.Text.ASCIIEncoding object

IL_000B:STLOC.2//Assignment to Variable

IL_000C:LDLOC.2//Remove System.Text.ASCIIEncoding object feel like Pop

il_000d:ldloc.0//Fetch string

Il_000e:callvirt instance unsigned int8[] [Mscorlib]system.text.encoding::getbytes (String)//Convert

IL_0013:STLOC.1//Give the result to byte[]

Il_0014:ldarg.1//

IL_0015:LDLOC.1//Remove byte[]

Il_0016:ldlen//Calculation length

IL_0017:CONV.I4//

Il_0018:add//Add with a

Il_0019:starg.s A

il_001b:ldarg.0//

Il_001c:ldarg.1

Il_001d:call instance Int32 Name1.strong::level4 (Int32)//Call Level4 method