Skip to content
  • Categories
  • Recent
  • Tags
  • Popular
  • World
  • Users
  • Groups
Skins
  • Light
  • Cerulean
  • Cosmo
  • Flatly
  • Journal
  • Litera
  • Lumen
  • Lux
  • Materia
  • Minty
  • Morph
  • Pulse
  • Sandstone
  • Simplex
  • Sketchy
  • Spacelab
  • United
  • Yeti
  • Zephyr
  • Dark
  • Cyborg
  • Darkly
  • Quartz
  • Slate
  • Solar
  • Superhero
  • Vapor

  • Default (No Skin)
  • No Skin
Collapse
Code Project
  1. Home
  2. Other Discussions
  3. The Weird and The Wonderful
  4. Fun with decompiled code.

Fun with decompiled code.

Scheduled Pinned Locked Moved The Weird and The Wonderful
csharpasp-netcomannouncement
13 Posts 7 Posters 1 Views 1 Watching
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • B Offline
    B Offline
    Brady Kelly
    wrote on last edited by
    #1

    I'm working on a decompiled version of a pre-compiled ASP.NET 2 web site. While the obscure names are to be expected, I'm not sdo sure that the original code didn't include horrors such as:

                        if (sQueryType == "NAME")
                        {
                            goto Label\_00AA;
                        }
    

    [snip]
    Label_00AA:
    sQ = sQ + "[Name] LIKE '%" + sQuery + "%'";
    goto Label_00EF;
    [snip]
    Label_00EF:
    sE = "";
    DataView dvSel = new DataView();
    DataView dvNot = new DataView();
    [the processing starts here]

    Daily WTF Memes

    D G P L 4 Replies Last reply
    0
    • B Brady Kelly

      I'm working on a decompiled version of a pre-compiled ASP.NET 2 web site. While the obscure names are to be expected, I'm not sdo sure that the original code didn't include horrors such as:

                          if (sQueryType == "NAME")
                          {
                              goto Label\_00AA;
                          }
      

      [snip]
      Label_00AA:
      sQ = sQ + "[Name] LIKE '%" + sQuery + "%'";
      goto Label_00EF;
      [snip]
      Label_00EF:
      sE = "";
      DataView dvSel = new DataView();
      DataView dvNot = new DataView();
      [the processing starts here]

      Daily WTF Memes

      D Offline
      D Offline
      DrWheetos
      wrote on last edited by
      #2

      That SQL's a tad inefficient! I hope it's not a large table that's being queried...

      J 1 Reply Last reply
      0
      • B Brady Kelly

        I'm working on a decompiled version of a pre-compiled ASP.NET 2 web site. While the obscure names are to be expected, I'm not sdo sure that the original code didn't include horrors such as:

                            if (sQueryType == "NAME")
                            {
                                goto Label\_00AA;
                            }
        

        [snip]
        Label_00AA:
        sQ = sQ + "[Name] LIKE '%" + sQuery + "%'";
        goto Label_00EF;
        [snip]
        Label_00EF:
        sE = "";
        DataView dvSel = new DataView();
        DataView dvNot = new DataView();
        [the processing starts here]

        Daily WTF Memes

        G Offline
        G Offline
        Graham Bradshaw
        wrote on last edited by
        #3

        I don't get it. Where's the horror?

        B 1 Reply Last reply
        0
        • B Brady Kelly

          I'm working on a decompiled version of a pre-compiled ASP.NET 2 web site. While the obscure names are to be expected, I'm not sdo sure that the original code didn't include horrors such as:

                              if (sQueryType == "NAME")
                              {
                                  goto Label\_00AA;
                              }
          

          [snip]
          Label_00AA:
          sQ = sQ + "[Name] LIKE '%" + sQuery + "%'";
          goto Label_00EF;
          [snip]
          Label_00EF:
          sE = "";
          DataView dvSel = new DataView();
          DataView dvNot = new DataView();
          [the processing starts here]

          Daily WTF Memes

          P Offline
          P Offline
          Paul Conrad
          wrote on last edited by
          #4

          Yuck.

          "The clue train passed his station without stopping." - John Simmons / outlaw programmer "Real programmers just throw a bunch of 1s and 0s at the computer to see what sticks" - Pete O'Hanlon "Not only do you continue to babble nonsense, you can't even correctly remember the nonsense you babbled just minutes ago." - Rob Graham

          1 Reply Last reply
          0
          • G Graham Bradshaw

            I don't get it. Where's the horror?

            B Offline
            B Offline
            Brady Kelly
            wrote on last edited by
            #5

            Goto's used for conditional blocks, mixed in with normal if...then...else blocks.

            A SINGLE-PHOTON TURNSTILE, a device in which photons are emitted one at a time under controlled circumstances, has been created by a team of scientists from Stanford (US), Hamamatsu Photonics (Japan), and NTT (Japan). Essentially the researchers use the quantization of electrical conductance to produce a quantization of photon emission. They put together a quantum well (the frontier between two thin semiconductor layers) containing a single electron (other electrons are dissuaded from entering because of a "Coulomb blockade" effect) with a quantum well containing a lone (comparably Coulomb blockaded) hole, and then cycle the voltage across the whole stack of layers in such a way that the lone electron and lone hole meet, mate, and make a lone photon. The resulting device, which operates at mK temperatures, is typically a tiny post some 700 nm tall and with a diameter of 200-1000 nm. (J. Kim et al., Nature, 11 February 1999.)

            G 1 Reply Last reply
            0
            • B Brady Kelly

              Goto's used for conditional blocks, mixed in with normal if...then...else blocks.

              A SINGLE-PHOTON TURNSTILE, a device in which photons are emitted one at a time under controlled circumstances, has been created by a team of scientists from Stanford (US), Hamamatsu Photonics (Japan), and NTT (Japan). Essentially the researchers use the quantization of electrical conductance to produce a quantization of photon emission. They put together a quantum well (the frontier between two thin semiconductor layers) containing a single electron (other electrons are dissuaded from entering because of a "Coulomb blockade" effect) with a quantum well containing a lone (comparably Coulomb blockaded) hole, and then cycle the voltage across the whole stack of layers in such a way that the lone electron and lone hole meet, mate, and make a lone photon. The resulting device, which operates at mK temperatures, is typically a tiny post some 700 nm tall and with a diameter of 200-1000 nm. (J. Kim et al., Nature, 11 February 1999.)

              G Offline
              G Offline
              Graham Bradshaw
              wrote on last edited by
              #6

              But it's decompiled code. You can't expect the same structure that a human coder would produce. Humans code for readability and maintainability. Optimising compilers code for performance. Try looking at the assembler output from a C++ compiler sometime. You can't move for JMP, JNE and JNZ instructions...

              B 1 Reply Last reply
              0
              • G Graham Bradshaw

                But it's decompiled code. You can't expect the same structure that a human coder would produce. Humans code for readability and maintainability. Optimising compilers code for performance. Try looking at the assembler output from a C++ compiler sometime. You can't move for JMP, JNE and JNZ instructions...

                B Offline
                B Offline
                Brady Kelly
                wrote on last edited by
                #7

                It's still a horror. ;P

                A SINGLE-PHOTON TURNSTILE, a device in which photons are emitted one at a time under controlled circumstances, has been created by a team of scientists from Stanford (US), Hamamatsu Photonics (Japan), and NTT (Japan). Essentially the researchers use the quantization of electrical conductance to produce a quantization of photon emission. They put together a quantum well (the frontier between two thin semiconductor layers) containing a single electron (other electrons are dissuaded from entering because of a "Coulomb blockade" effect) with a quantum well containing a lone (comparably Coulomb blockaded) hole, and then cycle the voltage across the whole stack of layers in such a way that the lone electron and lone hole meet, mate, and make a lone photon. The resulting device, which operates at mK temperatures, is typically a tiny post some 700 nm tall and with a diameter of 200-1000 nm. (J. Kim et al., Nature, 11 February 1999.)

                G 1 Reply Last reply
                0
                • B Brady Kelly

                  It's still a horror. ;P

                  A SINGLE-PHOTON TURNSTILE, a device in which photons are emitted one at a time under controlled circumstances, has been created by a team of scientists from Stanford (US), Hamamatsu Photonics (Japan), and NTT (Japan). Essentially the researchers use the quantization of electrical conductance to produce a quantization of photon emission. They put together a quantum well (the frontier between two thin semiconductor layers) containing a single electron (other electrons are dissuaded from entering because of a "Coulomb blockade" effect) with a quantum well containing a lone (comparably Coulomb blockaded) hole, and then cycle the voltage across the whole stack of layers in such a way that the lone electron and lone hole meet, mate, and make a lone photon. The resulting device, which operates at mK temperatures, is typically a tiny post some 700 nm tall and with a diameter of 200-1000 nm. (J. Kim et al., Nature, 11 February 1999.)

                  G Offline
                  G Offline
                  Graham Bradshaw
                  wrote on last edited by
                  #8

                  Brady Kelly wrote:

                  It's still a horror.

                  Still don't see why. The compiler's just doing its job - optimising the code for speed or size as appropriate. It's not supposed to be read by humans, so it doesn't matter in the slightest that it doesn't conform to a human's idea of well-structured code.

                  1 Reply Last reply
                  0
                  • B Brady Kelly

                    I'm working on a decompiled version of a pre-compiled ASP.NET 2 web site. While the obscure names are to be expected, I'm not sdo sure that the original code didn't include horrors such as:

                                        if (sQueryType == "NAME")
                                        {
                                            goto Label\_00AA;
                                        }
                    

                    [snip]
                    Label_00AA:
                    sQ = sQ + "[Name] LIKE '%" + sQuery + "%'";
                    goto Label_00EF;
                    [snip]
                    Label_00EF:
                    sE = "";
                    DataView dvSel = new DataView();
                    DataView dvNot = new DataView();
                    [the processing starts here]

                    Daily WTF Memes

                    L Offline
                    L Offline
                    leppie
                    wrote on last edited by
                    #9

                    Sorry Brady, you FAIL. Set Reflector options not to optimize C#. Full of branches/goto's ! In fact you would barely be able to read the non-optimized C# from compilation.

                    xacc.ide - now with TabsToSpaces support
                    IronScheme - 1.0 alpha 4a out now (29 May 2008)

                    B 1 Reply Last reply
                    0
                    • L leppie

                      Sorry Brady, you FAIL. Set Reflector options not to optimize C#. Full of branches/goto's ! In fact you would barely be able to read the non-optimized C# from compilation.

                      xacc.ide - now with TabsToSpaces support
                      IronScheme - 1.0 alpha 4a out now (29 May 2008)

                      B Offline
                      B Offline
                      Brady Kelly
                      wrote on last edited by
                      #10

                      leppie wrote:

                      Sorry Brady, you FAIL. Set Reflector options not to optimize C#. Full of branches/goto's ! In fact you would barely be able to read the non-optimized C# from compilation.

                      So I must apply a setting that makes the output barely readable? ;P

                      Daily WTF Memes

                      Y 1 Reply Last reply
                      0
                      • B Brady Kelly

                        leppie wrote:

                        Sorry Brady, you FAIL. Set Reflector options not to optimize C#. Full of branches/goto's ! In fact you would barely be able to read the non-optimized C# from compilation.

                        So I must apply a setting that makes the output barely readable? ;P

                        Daily WTF Memes

                        Y Offline
                        Y Offline
                        yonjuro
                        wrote on last edited by
                        #11

                        Looks like that might be a good place to test for a SQL injection attack.

                        B 1 Reply Last reply
                        0
                        • D DrWheetos

                          That SQL's a tad inefficient! I hope it's not a large table that's being queried...

                          J Offline
                          J Offline
                          Jerry Jeremiah
                          wrote on last edited by
                          #12

                          Not only that. Think of the SQL injection you could do...

                          1 Reply Last reply
                          0
                          • Y yonjuro

                            Looks like that might be a good place to test for a SQL injection attack.

                            B Offline
                            B Offline
                            Brady Kelly
                            wrote on last edited by
                            #13

                            There is way too much code like that, with direct SQL concats. I am only briefed to add two reports to the system, not secure it. Hell, if I were to decode all the decompiled code and use parametrised queries, I could probably buy a new car with the earnings.

                            Daily WTF Memes

                            1 Reply Last reply
                            0
                            Reply
                            • Reply as topic
                            Log in to reply
                            • Oldest to Newest
                            • Newest to Oldest
                            • Most Votes


                            • Login

                            • Don't have an account? Register

                            • Login or register to search.
                            • First post
                              Last post
                            0
                            • Categories
                            • Recent
                            • Tags
                            • Popular
                            • World
                            • Users
                            • Groups