0

I am working on reverse engineering, Now I have I condition line of while statement

while (!flag && \u0003\u001A\u0007.\u0001(this.\u0001, 0, false))

That it is meets these lines in IL Language

270 030B    ldloc.0
271 030C    brtrue.s    278 (0320) ret 
272 030E    ldarg.0
273 030F    ldfld   class [mscorlib]System.Threading.ManualResetEvent 
  'A.\u0015\u001f\u0003'::'\u0001'
274 0314    ldc.i4.0
275 0315    ldc.i4.0
276 0316    call    bool 'A.\u0003\u001a\a'::'\u0001'(object, int32, bool)
277 031B    brtrue  3 (0007) ldarg.0

I want to delete && \u0003\u001A\u0007.\u0001(this.\u0001, 0, false) from IL statements, How can I do that?

JustMe
  • 6,065
  • 3
  • 19
  • 17
  • checkout dnspy https://github.com/0xd4d/dnSpy – Irdis Jun 15 '20 at 19:53
  • @Irdis , I am already using dnspy, I can't use edit C# method or class because it causes some errors on compiler, therefore I chose "Edit IL", but can't understanding to remove some statements like I shown above – JustMe Jun 15 '20 at 20:01
  • It seems like you corrupt stack, so make sure you've deleted `030F 0314 0315` instructions, also when function call finished it returns boolean value on the top of the stack so replace `0316` with `ldc.i4.1` or `ldc.i4.0` – Irdis Jun 16 '20 at 09:55
  • and also it seems like `030E` should be deleted since following `ldfld` replaces the top value on the stack (pops object, pushes its field). – Irdis Jun 16 '20 at 10:04
  • the code is obfuscated, did you tried de-obfuscating before editing? – Paweł Łukasik Jun 18 '20 at 10:04

0 Answers0