unknown function in decompiled dll

149 views Asked by At

I'm trying to decompile a dll which is in .net 4.6. After using de4dot to decompile and deobfuscate the dll there are bunch of classes in it. I came across two functions(?) named __fieldref and __untypedstackalloc as below:

void* voidPtr = (void*)__untypedstackalloc(12);
RuntimeHelpers.InitializeArray((Array)numArray, __fieldref(Class73.class76_0));

and Class73 is:

[CompilerGenerated]
    internal sealed class Class73
    {
        internal static readonly Class73.Class78 class78_0;
        internal static readonly Class73.Class76 class76_0;
        internal static readonly Class73.Class74 class74_0;
        internal static readonly Class73.Class75 class75_0;
        internal static readonly Class73.Class77 class77_0;
        internal static readonly Class73.Class74 class74_1;
        internal static readonly Class73.Class77 class77_1;
        internal static readonly Class73.Class74 class74_2;

        [StructLayout(LayoutKind.Explicit, Size = 16, Pack = 1)]
        private struct Class74
        {
        }

        [StructLayout(LayoutKind.Explicit, Size = 32, Pack = 1)]
        private struct Class75
        {
        }

        [StructLayout(LayoutKind.Explicit, Size = 128, Pack = 1)]
        private struct Class76
        {
        }

        [StructLayout(LayoutKind.Explicit, Size = 256, Pack = 1)]
        private struct Class77
        {
        }

        [StructLayout(LayoutKind.Explicit, Size = 1024, Pack = 1)]
        private struct Class78
        {
        }
    }

I need to compile this project but these 2 unknown functions cause error. I want to be able to write these two functions to solve the problem. Any idea about what these functions do and how i can reverse engineer them?

For __untypedstackalloc(12) i created a static method that stackallocs with thedefined size (12 in this example) and returns it.

edit: __untypedstackalloc is used in one of methods as below:

internal static unsafe string smethod_1(byte[] byte_0)
        {
            // ISSUE: untyped stack allocation
            void* voidPtr = (void*)__untypedstackalloc(12);
            *(int*)voidPtr = 0;
            *(int*)((IntPtr)voidPtr + 4) = 0;
            while (*(int*)((IntPtr)voidPtr + 4) < byte_0.Length && (byte_0[*(int*)((IntPtr)voidPtr + 4)] != (byte)0 || byte_0[*(int*)((IntPtr)voidPtr + 4) + 1] != (byte)0))
            {
                *(int*)voidPtr = *(int*)voidPtr + 1;
                *(int*)((IntPtr)voidPtr + 4) = *(int*)((IntPtr)voidPtr + 4) + 2;
            }
            byte[] bytes = new byte[*(int*)voidPtr * 2];
            *(int*)((IntPtr)voidPtr + 8) = 0;
            while (*(int*)((IntPtr)voidPtr + 8) < *(int*)voidPtr * 2)
            {
                bytes[*(int*)((IntPtr)voidPtr + 8)] = byte_0[*(int*)((IntPtr)voidPtr + 8)];
                *(int*)((IntPtr)voidPtr + 8) = *(int*)((IntPtr)voidPtr + 8) + 1;
            }
            return Encoding.Unicode.GetString(bytes);
        }
0

There are 0 answers