Decrypts an xenocode-encrypted string

Many. net Program Obfuscators are used for protection during release. xenocode 2005 should be said to be one of the many.
Xenocode uses an inserted class to protect strings in the Assembly.
This article will combine reflector and reflection technology to decrypt the strings encrypted in the Assembly.

First, we use reflector to diser the original program and find the string we want to decrypt.Code.

For example:

This. response. serialnumber = string. Intern (response. _ response ("\ udbac \ ue2b7 \ ue9bb \ uf0af \ uf7b8 \ ufeb3 \ u05a8 \ u0c61", 0x555ddb55 ));

Find the string to be decrypted and write the reflection call code.

Class Program
{
Public static void main ()
{
// The installer set. test.exe is the name of the obfuscated Assembly file.
Assembly ASM = assembly. loadfrom (@ "test.exe ");

// Obtain the decryption type (including its namespace) inserted by the xenocode, which corresponds to the class name before the preceding string. the obfuscation results may be different each time.
Type type = ASM. GetType ("x293b01486f981425. x1110bdd110cdcea4 ");

// String and decryption Parameters
Object [] parameters = {"\ udbac \ ue2b7 \ ue9bb \ uf0af \ uf7b8 \ ufeb3 \ u05a8 \ u0c61", 0x555ddb55 };
Type [] paramtypes = new type [parameters. Length];
For (INT I = 0; I <parameters. length; I ++)
Paramtypes [I] = parameters [I]. GetType ();

// Call the decryption method
Bindingflags flags = bindingflags. Public | bindingflags. Static;
Methodinfo method = type. getmethod ("_ d574bb1a8f3e9cbc", flags, null, paramtypes, null );
Object result = method. Invoke (null, parameters );

// Display the decryption result
Console. writeline (result );

Console. writeline ("Press ENTER key to exit ...");
Console. Readline ();
}
}