I'm hunting for a potential logic bomb in some C# code, which is obfuscated.
Using JetBrains DotPeek, Visual Studio and some search&replace I was able to mostly reconstruct an executable program that can undergo some dynamic analysis.
Problem: the only part that does not compile is the following statement, or whatever it is
-~~--~-~~
Examples: (taken from very different places in the code
short num11 = (short)((int)Deobfuscate._0023_003Dzv2V9Fh_V8ugFUxzftdmW5kq_KcfL._0023_003DzRw6ZUmZ68LAF2yi85xpB68sAa34J() ^ (int)(short)-~~--~-~~-~(995664381 ^ num1 ^ num2));
if ((Deobfuscate._0023_003DzorSRCcTOYKrh3x9df3y4zTUV7xtN & (Deobfuscate._0023_003Dz277oJx4nAbXTNVLUpThNrwpfFcLe) - ~~-~-~-~(-1146824238 - num1 - num2)) == (Deobfuscate._0023_003Dz277oJx4nAbXTNVLUpThNrwpfFcLe)0)
Deobfuscate._0023_003Dz2gVGGuaOv4QwjTSyzGr7X5yxc453 = (-995626251 ^ num1) + num2;
int[] numArray = new int[4]
{
0,
0,
0,
~-~--~~-~-1863408518
};
numArray[1] = -~~--~-~~105240205;
numArray[2] = -~~--~~-~-~445034824;
numArray[0] = ~--~~--~~-~-393837398;
int f6EjAc8IXjjzuWiO4 = this._0023_003Dz14FRLF6EjAC8_iXJjzuWiO4_003D;
int tUvT87zJtuOmYrdE = this._0023_003Dzwdghyzouofs_0024tUVT87zJtuOmYRdE;
int num1 = -~-~-~~-~1640531528;
int num2 = -~~--~-~~957401313;
Take for example the following decompiled/obfuscated C# statement: int num2 = -~~--~-~~957401313;
. What does it mean? C# does not recognize it as a valid statement, but indeed it's result of decompiling some IL code.
-
is just negation~
is bitwise NOT. Since C# requires two's complement integer representation, then ~x == -x - 1
for all X.--
is the autodecrement operator, but it's only valid on lvalues, which numeric literals are not. I think this is a bug in the decompiler that forget to separate the minus signs.So, a slightly de-obfuscated version of your last block of code is:
numArray[1] = -105240204;
numArray[2] = -445034826;
numArray[0] = 393837396;
int f6EjAc8IXjjzuWiO4 = this._0023_003Dz14FRLF6EjAC8_iXJjzuWiO4_003D;
int tUvT87zJtuOmYrdE = this._0023_003Dzwdghyzouofs_0024tUVT87zJtuOmYRdE;
int num1 = -1640531527;
int num2 = -957401312;