System.Enum value names

 

greetings -

 

i'm analyzing potential malware , has been obfuscated tool. there are, unsurprisingly, interesting tricks tool performs, 1 stands out: of literal value names in enum same. how possible? i've looked on section 8.5.2 of ecma 335 spec covers cil , runtime, , way enums described aliases existing types seems allude possible, since enum values distinguishable value alone. how type system differentiate this?

 

here disassembly:

 

code snippet

.class public auto ansi sealed enum1
    extends [mscorlib]system.enum
{
    .field public static literal valuetype test.enum1 value1 = int32(4)

    .field public static literal valuetype test.enum1 value1 = int32(2)

    .field public static literal valuetype test.enum1 value1 = int32(1)

    .field public static literal valuetype test.enum1 value1 = int32(0)

    .field public specialname rtspecialname int32 value__

}

 

 

it doesn't need to.  constants, literal values enums inserted il @ initial compile-time, names of values irrelevant unless accessed via reflection.

 

.NET Framework  >  Common Language Runtime Internals and Architecture