CODEWITHSUNDEEP
.netc#-4.0reverse-engineeringilspy
NoobTom
NoobTom

Reputation: 555

Reverse Engineering .NET C# what does this line means?

I've the following line retrieved with ilSpy

p[var1] = (t[var1] + z.c[var1 % z.c.Length]) % 'Ā';

p,t and c are char array[].

my question is: how can he + characters? t[var1]+z.c[someNumber] are 2 characters and then he module the result with a number 'A' at the end.

Upvotes: 2

Views: 320

Answers (3)

Igor Korkhov
Igor Korkhov

Reputation: 8558

As Oded pointed out, the expression retrieved by ilSpy is syntactically valid, yet I think the original code was different.

The code of Ā (U+0100, Latin Capital Letter A With Macron) is 256, which suggests that that t, c, and p represent some string in a single-byte encoding such as ASCII. Then the code you got from ilSpy does make sense. For example (I just renamed t, c, and p):

encrypted[index] = (source[index] + z.passPhrase[index % z.passPhrase.Length]) % 256;

Here we have a simple encryptor, which cyclically adds some passphrase to the original string.

Upvotes: 0

Botz3000
Botz3000

Reputation: 39670

If you add characters, you are actually calling the Int operator+, because addition is not defined on char. Basically, chars are numeric values (just displayed differently), too, so that's no problem. He probably mods the result with 'Ā' (numeric value: 256) so that the result is in the range of a 1 byte char.

Upvotes: 0

Oded
Oded

Reputation: 499382

char is an integral type, just like int and long are, so you can add them together and use % on the value of a char instance.

In the same way that you can add ints and % them.

This explains why the above works.

What it means is a different question and is not so apparent. It could be the char was used because of its range, but is used as an integral type. It cold be that this is a function that converts lowercase characters to upper case (or vice versa), but without more context it is impossible to tell.

It is entirely possible that the decompiler you are using has misinterpreted (or couldn't fully interpret) the IL and is presenting you with something equivalent to the IL, but that is not the same as the original code.

Upvotes: 4

Related Questions