de-obfuscate a file

manlyboy

Is there some way I can de-obfuscate a text/html file. I can use the UI to de-obfuscate the stack trace but I need to de-obfuscate a whole log file.

Jessica R

Hi there,

Thanks for your post!

It should be fine to copy and paste the log file contents into the decode stack trace box. Are you getting any errors trying to do this?

manlyboy

Thanks for your response.

I am doing this with very small files now without problem but in some cases the file can be over 2-3 meg in size. These are log files in text or html format.

I know about the map files so all I seek is a C# method that uses the correct map file to (I presume) search and replace.

Jessica R

Ah I see, thanks for clarifying!

You can use the Helpers.DecodeStackTrace method from the SmartAssembly.SDK.dll in C:Program FilesRed GateSmartAssembly 6SDKinSmartAssembly.SDK.dll. With this method, you can decode strings as needed.

(Just a note: you need to be on a machine where SmartAssembly is installed and connected to the appropriate database/map file folder for this to work)

Hope that helps!

manlyboy

Thank you. Works well.

manlyboy

Hi again,

I have come across a performance issue in that I must read a binary log file that consists of hundreds if not thousands of 'packets' that each contain a single log entry. Each log entry contains a number of fields but the only one we are interested in is the 'Title' field. That field holds the obfuscated text.

At present I call

logEntry.Title =Helpers.DecodeStackTrace(ReadString(reader, titleSize));

each and every time.

If I could at least set what would be the constant vales that your Helper uses in the first call to Helpers and then pass that to Helpers in subsequent calls it should reduce the overhead considerably. Alternatively, can I cache the required Helpers data?

Is the SDK available in solution format so that I could amend it myself?

manlyboy

bump

Jessica R

Hi there,

So sorry for the delay! I'm afraid that DecodeStackTrace and other methods from the SmartAssembly.SDK.dll contain code that needs to be protected so we're not able to provide the solution to customize it.

The SDK is quite limited at the moment as the only decoding related function is the one DecodeStackTrace(string) method, but I've gone ahead and logged a feature request to add more options (logged as SA-1871). Apologies there isn't anything to help with this performance issue at the moment!