Help! Obfuscated Assembly-Csharp

[Crz666]

Hello fellow gamers and game lovers,

I`m working on understanding the Code behind a game and searching someone experienced with deobfuscating and decompiling their c-sharp assembly (it seems ist a method used in other korean games as well)

I´ve managed to get close to open decompiled assembly-sharp.dll but the functions are still obfuscated and with the known Tools i dont get any further. Debugging through ilspy shows the functional opcode stream gives a bytestream of [255,1,255...] Filled with bytecode 255 which is opcode for {break}.

Anyone here knows more? I thought i could learn more about game and might write an Emulator Software for Server.

If you have some Input and not want to publicate it, you also can write me a pm. I might can honorate it by a few $.

Crz

Edit :

Just to explain what i did yet :

I unpacked the APK then unpacked the unity assets. Remaining were a few dll and the Assembly-CSharp.dll. I´ve managed to take a dll dump via memory dump and had a dll with PE-Headers. I removed first levels of obfuscation through de4dot. Now remaining are functional data. ILSpy, Reflector and other tools doesnt decompile functional content. I downloaded ilspy source and started to debug through mono.cecil.Codereader and found out the content of functions always have a certain crypted bytestream. I checked all refered assemblies to find the source of cryption but Im stuck there.


Edit2: I´ve uploaded the dll for others to look into

 

[Crz666]

I´ve thought i show some samples from IDA maybe someone actually have an Idea :

.method public hidebysig specialname instance float32 get_currentAnimationTime()
  {
    .maxstack 3
    .locals init (float32 V0,
                  int32 V1,
                  class [UnityEngine]UnityEngine.AnimationClip V2)
    .byte 0xFF, 0, 0, 1, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF
    .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF
    .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF
    .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF
    .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF
    .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF
    .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF
    .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF
    .byte 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF

this is on close to every function. And i dont know how to deobfuscate

 

[creif]

I have now same problem with my APK, can anyone help to deobfuscate?

 

[Jeff232]

same here