I'm trying to decompile a dll which is in .net 4.6. After using de4dot to decompile and deobfuscate the dll there are bunch of classes in it. I came across two functions(?) named __fieldref
and __untypedstackalloc
as below:
void* voidPtr = (void*)__untypedstackalloc(12);
RuntimeHelpers.InitializeArray((Array)numArray, __fieldref(Class73.class76_0));
and Class73
is:
[CompilerGenerated]
internal sealed class Class73
{
internal static readonly Class73.Class78 class78_0;
internal static readonly Class73.Class76 class76_0;
internal static readonly Class73.Class74 class74_0;
internal static readonly Class73.Class75 class75_0;
internal static readonly Class73.Class77 class77_0;
internal static readonly Class73.Class74 class74_1;
internal static readonly Class73.Class77 class77_1;
internal static readonly Class73.Class74 class74_2;
[StructLayout(LayoutKind.Explicit, Size = 16, Pack = 1)]
private struct Class74
{
}
[StructLayout(LayoutKind.Explicit, Size = 32, Pack = 1)]
private struct Class75
{
}
[StructLayout(LayoutKind.Explicit, Size = 128, Pack = 1)]
private struct Class76
{
}
[StructLayout(LayoutKind.Explicit, Size = 256, Pack = 1)]
private struct Class77
{
}
[StructLayout(LayoutKind.Explicit, Size = 1024, Pack = 1)]
private struct Class78
{
}
}
I need to compile this project but these 2 unknown functions cause error. I want to be able to write these two functions to solve the problem. Any idea about what these functions do and how i can reverse engineer them?
For __untypedstackalloc(12)
i created a static method that stackallocs with thedefined size (12 in this example) and returns it.
edit:
__untypedstackalloc
is used in one of methods as below:
internal static unsafe string smethod_1(byte[] byte_0)
{
// ISSUE: untyped stack allocation
void* voidPtr = (void*)__untypedstackalloc(12);
*(int*)voidPtr = 0;
*(int*)((IntPtr)voidPtr + 4) = 0;
while (*(int*)((IntPtr)voidPtr + 4) < byte_0.Length && (byte_0[*(int*)((IntPtr)voidPtr + 4)] != (byte)0 || byte_0[*(int*)((IntPtr)voidPtr + 4) + 1] != (byte)0))
{
*(int*)voidPtr = *(int*)voidPtr + 1;
*(int*)((IntPtr)voidPtr + 4) = *(int*)((IntPtr)voidPtr + 4) + 2;
}
byte[] bytes = new byte[*(int*)voidPtr * 2];
*(int*)((IntPtr)voidPtr + 8) = 0;
while (*(int*)((IntPtr)voidPtr + 8) < *(int*)voidPtr * 2)
{
bytes[*(int*)((IntPtr)voidPtr + 8)] = byte_0[*(int*)((IntPtr)voidPtr + 8)];
*(int*)((IntPtr)voidPtr + 8) = *(int*)((IntPtr)voidPtr + 8) + 1;
}
return Encoding.Unicode.GetString(bytes);
}