.net反编译后发现代码混淆了，求助
本帖最后由 wjp16351 于 2013-02-28 17:56:42 编辑 一个dll文件，通过Reflector反编译后 发现代码混淆了，具体反编译后的代码如下：
public class GetS
{
private static int AA85qUeMJ7LBM)FlQDDEclAD9AtZ(int num1, string text1)
{
text1 = text1.ToLower();
IList<StatStructure> CS$1$0000 = WebsiteConfig.AFZk3du(num1);
if ((CS$1$0000 != null) && (CS$1$0000.Count > 0))
{
foreach (StatStructure structure in CS$1$0000)
{
if (structure.Type == 1)
{
string[] strArray = structure.Rule.Split(new char[] { ';', 0xff1b }, StringSplitOptions.RemoveEmptyEntries);
foreach (string str in strArray)
{
if (text1.IndexOf(str.ToLower().Trim()) > -1)
{
return structure.id;
}
if (((str.IndexOf(A06LxsBj0VQKH.AA85qUeMJ7LBM)FlQDDEclAD9AtZ.AGaa("XgA=")) == 0) && (str.LastIndexOf(A06LxsBj0VQKH.AA85qUeMJ7LBM)FlQDDEclAD9AtZ.AGaa("JAA=")) == str.Length)) && (new Regex(str.Trim(), RegexOptions.IgnoreCase).Matches(text1).Count > 0))
{
return structure.id;
}
}
}
}
}
return 0;
}
private static int ABVaqkgK(int num1, string text1)
{
text1 = text1.ToLower();
IList<StatStructure> CS$1$0000 = WebsiteConfig.AFZk3du(num1);
if ((CS$1$0000 != null) && (CS$1$0000.Count > 0))
{
foreach (StatStructure structure in CS$1$0000)
{
if (structure.Type == 0)
{
string[] strArray = structure.Rule.Split(new char[] { ';', 0xff1b }, StringSplitOptions.RemoveEmptyEntries);
foreach (string str in strArray)
{
if (text1.IndexOf(str.ToLower().Trim()) > -1)
{
return structure.id;
}
if (((str.IndexOf(A06LxsBj0VQKH.AA85qUeMJ7LBM)FlQDDEclAD9AtZ.AGaa("XgA=")) == 0) && (str.LastIndexOf(A06LxsBj0VQKH.AA85qUeMJ7LBM)FlQDDEclAD9AtZ.AGaa("JAA=")) == (str.Length - 1))) && (new Regex(str.Trim(), RegexOptions.IgnoreCase).Matches(text1).Count > 0))
{
return structure.id;
}
}
}
}
}
return 0;
}
private static string ACZ9()
{
if ((HttpContext.Current.Request.QueryString[A06LxsBj0VQKH.AA85qUeMJ7LBM)FlQDDEclAD9AtZ.AGaa("cgBlAGYAZQByAGUAcgA=")] != null) && (HttpContext.Current.Request.QueryString[A06LxsBj0VQKH.AA85qUeMJ7LBM)FlQDDEclAD9AtZ.AGaa("cgBlAGYAZQByAGUAcgA=")].Length > 0))
{
return HttpContext.Current.Request.QueryString[A06LxsBj0VQKH.AA85qUeMJ7LBM)FlQDDEclAD9AtZ.AGaa("cgBlAGYAZQByAGUAcgA=")].ToLower().Trim();
}
if ((HttpContext.Current.Request.QueryString[A06LxsBj0VQKH.AA85qUeMJ7LBM)FlQDDEclAD9AtZ.AGaa("SgBzAGwAbwBjAGEAdABpAG8AbgA=")] != null) && (HttpContext.Current.Request.QueryString[A06LxsBj0VQKH.AA85qUeMJ7LBM)FlQDDEclAD9AtZ.AGaa("SgBzAGwAbwBjAGEAdABpAG8AbgA=")].ToLower() == A06LxsBj0VQKH.AA85qUeMJ7LBM)FlQDDEclAD9AtZ.AGaa("dAByAHUAZQA=")))
{
return A06LxsBj0VQKH.AA85qUeMJ7LBM)FlQDDEclAD9AtZ.AGaa("SgBTAPONbI91mGKXGv/gZdVsl1/ld3dRU09lZ5Bu");
}
return "";
}
private static string ADZpe()
{
if (HttpContext.Current.Request.QueryString[A06LxsBj0VQKH.AA85qUeMJ7LBM)FlQDDEclAD9AtZ.AGaa("bABvAGMAYQB0AGkAbwBuAA==")] != null)
{
return HttpContext.Current.Request.QueryString[A06LxsBj0VQKH.AA85qUeMJ7LBM)FlQDDEclAD9AtZ.AGaa("bABvAGMAYQB0AGkAbwBuAA==")].ToLower().Trim();
}
if (HttpContext.Current.Request.ServerVariables[A06LxsBj0VQKH.AA85qUeMJ7LBM)FlQDDEclAD9AtZ.AGaa("SABUAFQAUABfAFIARQBGAEUAUgBFAFIA")] != null)
{
return HttpContext.Current.Request.ServerVariables[A06LxsBj0VQKH.AA85qUeMJ7LBM)FlQDDEclAD9AtZ.AGaa("SABUAFQAUABfAFIARQBGAEUAUgBFAFIA")].ToLower().Trim();
}
return "";
}
private string AEEJOXG(string text1)
{
string CS$1$0000 = A06LxsBj0VQKH.AA85qUeMJ7LBM)FlQDDEclAD9AtZ.AGaa("MAA=");
Process process = new Process();
process.StartInfo.FileName = A06LxsBj0VQKH.AA85qUeMJ7LBM)FlQDDEclAD9AtZ.AGaa("bgBiAHQAcwB0AGEAdAA=");
process.StartInfo.Arguments = A06LxsBj0VQKH.AA85qUeMJ7LBM)FlQDDEclAD9AtZ.AGaa("LQBhACAA") + text1;
process.StartInfo.UseShellExecute = false;
process.StartInfo.CreateNoWindow = true;
process.StartInfo.RedirectStandardOutput = true;
process.Start();
string str = process.StandardOutput.ReadToEnd();
int index = str.IndexOf(A06LxsBj0VQKH.AA85qUeMJ7LBM)FlQDDEclAD9AtZ.AGaa("TQBBAEMAIABBAGQAZAByAGUAcwBzACAAPQA="));
if (index > 0)
{
CS$1$0000 = str.Substring(index + 14, 0x11);
}
HttpContext.Current.Response.Cookies[A06LxsBj0VQKH.AA85qUeMJ7LBM)FlQDDEclAD9AtZ.AGaa("TQBhAGMA")].Value = CS$1$0000;
HttpContext.Current.Response.Cookies[A06LxsBj0VQKH.AA85qUeMJ7LBM)FlQDDEclAD9AtZ.AGaa("TQBhAGMA")].Expires = DateTime.Now.AddMonths(1);
return CS$1$0000;
}
