Search code examples
c#obfuscationdecompiling

What does "-~~--~-~~" mean in obfuscated C# code?


I'm hunting for a potential logic bomb in some C# code, which is obfuscated.

Using JetBrains DotPeek, Visual Studio and some search&replace I was able to mostly reconstruct an executable program that can undergo some dynamic analysis.

Problem: the only part that does not compile is the following statement, or whatever it is

-~~--~-~~

Examples: (taken from very different places in the code

short num11 = (short)((int)Deobfuscate._0023_003Dzv2V9Fh_V8ugFUxzftdmW5kq_KcfL._0023_003DzRw6ZUmZ68LAF2yi85xpB68sAa34J() ^ (int)(short)-~~--~-~~-~(995664381 ^ num1 ^ num2));
if ((Deobfuscate._0023_003DzorSRCcTOYKrh3x9df3y4zTUV7xtN & (Deobfuscate._0023_003Dz277oJx4nAbXTNVLUpThNrwpfFcLe) - ~~-~-~-~(-1146824238 - num1 - num2)) == (Deobfuscate._0023_003Dz277oJx4nAbXTNVLUpThNrwpfFcLe)0)
                Deobfuscate._0023_003Dz2gVGGuaOv4QwjTSyzGr7X5yxc453 = (-995626251 ^ num1) + num2;

int[] numArray = new int[4]
  {
    0,
    0,
    0,
    ~-~--~~-~-1863408518
  };

  numArray[1] = -~~--~-~~105240205;
  numArray[2] = -~~--~~-~-~445034824;
  numArray[0] = ~--~~--~~-~-393837398;
  int f6EjAc8IXjjzuWiO4 = this._0023_003Dz14FRLF6EjAC8_iXJjzuWiO4_003D;
  int tUvT87zJtuOmYrdE = this._0023_003Dzwdghyzouofs_0024tUVT87zJtuOmYRdE;
  int num1 = -~-~-~~-~1640531528;
  int num2 = -~~--~-~~957401313;

Take for example the following decompiled/obfuscated C# statement: int num2 = -~~--~-~~957401313;. What does it mean? C# does not recognize it as a valid statement, but indeed it's result of decompiling some IL code.


Solution

    • - is just negation
    • ~ is bitwise NOT. Since C# requires two's complement integer representation, then ~x == -x - 1 for all X.
    • -- is the autodecrement operator, but it's only valid on lvalues, which numeric literals are not. I think this is a bug in the decompiler that forget to separate the minus signs.

    So, a slightly de-obfuscated version of your last block of code is:

    numArray[1] = -105240204;
    numArray[2] = -445034826;
    numArray[0] = 393837396;
    int f6EjAc8IXjjzuWiO4 = this._0023_003Dz14FRLF6EjAC8_iXJjzuWiO4_003D;
    int tUvT87zJtuOmYrdE = this._0023_003Dzwdghyzouofs_0024tUVT87zJtuOmYRdE;
    int num1 = -1640531527;
    int num2 = -957401312;