Read (to understand) hexa code in Project that decompiled by Reflector

Question

I used .NET reflector 5.1.5.0 to decompiled a file have extension: .exe. After export to project, I have some classes with many "special" characters :(

For exampe:

• Label_065C (why original label name was converted...)

• Match matchBaseTag = new Regex(@"(?<=base\s+href\=[\x27\x22])(?[^\x27\x22]*)(?=[\x27\x22])").Match(Result); (I think x27 is a hexa code)

• Copyright \x00a9 ... Corporation 2008
• if (this.SiteID == 0xce)
• addArticle.Parameters.Add("@Title", SqlDbType.NVarChar, 0x100).Value

I want to ask that why values (that bold) were changed! and how to I can understand their real value (orignal)

Sorry because my English is not good and thanks a lot! (I'm waiting for your response :( )

Answer 1

The information in the binary file is just the content of the string after the compiler has interpreted any escape sequences etc - it's the raw text data, not the source. Likewise the values for things like SiteID comparisons are just integers.

Reflector comes up with some source which would compile to the same binary code - it doesn't know whether you used a hex literal or a decimal one, etc. You can change the number format it uses under View / Options / Disassembler, forcing it to hex or decimal or leaving it to decide. It doesn't look like there's a similar option for determining how to decompile non-ASCII characters - it would be nice if it could use the \uXXXX form instead of \x, IMO.

I don't know about the "label" bit as you haven't given enough context about where you're seeing it or what it was before.

Answer 2

you can set number format to decimal in View-> options->Disassembler->Number Format

Answer 3

Usually when there is a difference between Reflector's representation and what I think it should be - I use ILDasm. I think the integer problems can be fixed by what Jon and najmeddine said. The strings are alittle harder (like the copyright attribute value and your regular expression string).

String constants (things in quotes in your source code) are stored as unicode byte sequences in the binary file (in either the blob or user strings heaps). You can see exactly what is in your binary by using ILDasm if you do the following: 0. Load your assembly in ILDasm 1. View->Meta Info check Raw:Heaps 2. View->Meta Info click Show!

If if you do a search for "copyright" it will mostlikely be in the blob heap (attribute values use a different serialization to bytes and are in the blob heap with other binary values) and for you RegEx string it should be in the user strings heap.

Once you've looked at the value in ILDasm, you see what is actually in the assembly ... if there is a difference between that and what Reflector shows ... chances are Reflector is doing a best effort decoding of a binary string to escape non readable characters into a more readable format. Since there are several possible encodings/decodings Reflecor sometimes shows a valid string - but just not decoded correctly (like the \x27 anc \x22 decodings for ' and ").

So in short, your values haven't changed in the assembly (most likely) it is just Reflector is not decoding it correctly into the original string.