如何在.NET 中逆向混淆？
混淆只是混淆非公共变量/成员的名称吗？如果是这样，是否不可能编写一个应用程序，至少将这些名称更改为更易读的名称，例如“variable1”等，然后提取仍然可以编译的整个代码？
Is obfuscation only about garbling the names of non-public variables/members? If so, would it not be possible to write an application that would at least change these names more readible ones like "variable1", etc, and then extract the whole code that can still be compiled?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
不，它的意义远不止于此，尤其是对于更复杂的混淆器。它们可以生成大多数语言无法表达的IL，并且其中的逻辑流程极其混乱，甚至连最好的工具都感到困惑。只要有大量时间，您就可以做到这一点（可能需要大量手工时间），并且混淆器和反混淆器之间肯定存在军备竞赛 - 但您大大低估了这里的技术。
另请注意，许多混淆器会查看整个应用程序（而不仅仅是一个程序集），因此它们也可以更改公共 API。
No, it is about a lot more, especially with more sophisticated obfuscators. They can produce IL that cannot be expressed in most languages, and where the logic flow is horribly tangled to befuddle the best of tools. With lots of time you can do it (probably lots by hand), and there is certainly an arms race between the obfuscators and deobfuscators - but you vastly underestimate the technology here.
Also, note that many obfuscators look at an entire application (not just one assembly), so they can change the public API too.
这当然是混淆器的开始。尽管一些混淆器也会加密字符串和其他类似的技巧，使得对程序集进行逆向工程变得非常困难。
当然，由于运行时需要在完成所有这些之后运行程序集，因此坚定的黑客有可能对其进行逆向工程:)
That is certainly the start of an obfuscator. Though some obfuscators will also encrypt strings and other such tricks to make it very difficult to reverse engineer the assembly.
Of course, since the runtime needs to run the assembly after all of this, it is possible for a determined hacker to reverse engineer it :)
有“反混淆器”工具可以撤消多种混淆技术，例如解密字符串、删除代理方法、对虚拟化代码进行虚拟化、删除反调试代码、删除垃圾类、恢复方法参数和字段的类型等等...
一个非常强大的工具是 de4dot。
但还有更多。
There are 'deobfuscator' tools to undo several obfuscation techniques like Decrypt strings, Remove proxy methods, Devirtualize virtualized code, Remove anti-debug code, Remove junk classes, Restore the types of method parameters and fields and more...
One very powerful tool is de4dot.
But there are more.
混淆是将有意义的名称（如
accountBalance）更改为无意义的名称（如a1）。该应用程序显然仍然可以工作，但理解其中的算法会更加困难。
Obfuscation is about changing meaningful names like
accountBalanceto meaningless ones likea1.The application will obviously still work, but it will be more difficult to understand the algorithms inside it.
这取决于所使用的混淆技术。混淆变量名只是问题的一部分。许多混淆工具同时执行某种程序流混淆，这将使进一步的代码理解变得复杂。最后，混淆后的 IL 在大多数编程语言中都无法轻松表达（如果有的话）。
重命名变量和字段也不会帮助你太多，因为有很多变量1，变量2..不会帮助你理解你所读到的内容。
It's depend upon the obfuscation technology used. Obsfucating variable name is only one part of the issue. A lot of obfuscation tools perform some kind of program flow obfuscation at the same time, which will complicate further code comprehension. At the end, the obfuscated IL won't be expressible easily (if at all) in most programming languages.
Renaming the variables and fields won't help you much either, as having a lot of variable1, variable2.. won't help you to understand what you read.