如何用dnSpy逆向.NET DLL中DataZipCompression.LoadString算法

场景描述 #

我正在使用dnSpy逆向分析一个.NET DLL文件，遇到一个可将文件解压缩并解密为XML字符串的方法，核心代码片段如下：

<Module>.DataZipCompression.LoadString(
    <Module>.?A0xdbfabc02.g_pDataZipCompression, 
    ref basic_string<wchar_t, std::char_traits<wchar_t>, std::allocator<wchar_t>>, 
    ref basic_string<char, std::char_traits<char>, std::allocator<char>>, 
    true
);

完整代码片段：

basic_string<char,std::char_traits<char>,std::allocator<char> > basic_string<char,std::char_traits<char>,std::allocator<char>_u0020>;
                        <Module>.std.basic_string<char,std::char_traits<char>,std::allocator<char> >.{ctor}(ref basic_string<char,std::char_traits<char>,std::allocator<char>_u0020>);
                        try
                        {
                            <Module>.DataZipCompression.LoadString(<Module>.?A0xdbfabc02.g_pDataZipCompression, ref basic_string<wchar_t,std::char_traits<wchar_t>,std::allocator<wchar_t>_u0020>4, ref basic_string<char,std::char_traits<char>,std::allocator<char>_u0020>, true);
                            byte[] array3 = new byte[<Module>.std.basic_string<char,std::char_traits<char>,std::allocator<char> >.length(ref basic_string<char,std::char_traits<char>,std::allocator<char>_u0020>)];
                            for (int i = 0; i < array3.Length; i++)
                            {
                                sbyte* ptr3 = <Module>.std.basic_string<char,std::char_traits<char>,std::allocator<char> >.[](ref basic_string<char,std::char_traits<char>,std::allocator<char>_u0020>, (uint)i);
                                array3[i] = (byte)(*ptr3);
                            }
                            UTF8Encoding utf8Encoding = new UTF8Encoding();
                            string @string = utf8Encoding.GetString(array3);
                            XmlDocument xmlDocument = new XmlDocument();
                            xmlDocument.LoadXml(@string);
                            dataContainerProperties = genericSerializer.FromXmlStringIgnoreParentName(xmlDocument.OuterXml);
                        }
                        catch
                        {
                            <Module>.___CxxCallUnwindDtor(ldftn(std.basic_string<char,std::char_traits<char>,std::allocator<char> >.{dtor}), (void*)(&basic_string<char,std::char_traits<char>,std::allocator<char>_u0020>));
                            throw;
                        }
                        <Module>.std.basic_string<char,std::char_traits<char>,std::allocator<char> >.{dtor}(ref basic_string<char,std::char_traits<char>,std::allocator<char>_u0020>);

该方法执行后，内存中会生成解压缩并解密后的XML字符串。我的目标是理解DataZipCompression.LoadString所使用的算法，从而在DLL外部复现其解压缩与解密流程。

已尝试操作 #

• 使用dnSpy反编译DLL，定位到DataZipCompression类及LoadString方法
• 分析该方法的参数与返回值
• 尝试追踪数据在方法中的流转过程

内容的提问来源于stack exchange，提问作者Kirill Shchitaev