2011-10-23 19:43:32 +08:00
|
|
|
|
/*
|
2012-01-10 06:02:47 +08:00
|
|
|
|
Copyright (C) 2011-2012 de4dot@gmail.com
|
2011-10-23 19:43:32 +08:00
|
|
|
|
|
|
|
|
|
This file is part of de4dot.
|
|
|
|
|
|
|
|
|
|
de4dot is free software: you can redistribute it and/or modify
|
|
|
|
|
it under the terms of the GNU General Public License as published by
|
|
|
|
|
the Free Software Foundation, either version 3 of the License, or
|
|
|
|
|
(at your option) any later version.
|
|
|
|
|
|
|
|
|
|
de4dot is distributed in the hope that it will be useful,
|
|
|
|
|
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
|
GNU General Public License for more details.
|
|
|
|
|
|
|
|
|
|
You should have received a copy of the GNU General Public License
|
|
|
|
|
along with de4dot. If not, see <http://www.gnu.org/licenses/>.
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
using System;
|
|
|
|
|
using System.Collections.Generic;
|
|
|
|
|
using Mono.Cecil;
|
|
|
|
|
using Mono.Cecil.Cil;
|
|
|
|
|
using de4dot.blocks;
|
|
|
|
|
|
2011-12-09 16:02:06 +08:00
|
|
|
|
namespace de4dot.code.deobfuscators.CryptoObfuscator {
|
2012-05-29 17:13:39 +08:00
|
|
|
|
class ProxyCallFixer : ProxyCallFixer2 {
|
2011-10-23 19:43:32 +08:00
|
|
|
|
Dictionary<MethodDefinition, ProxyCreatorType> methodToType = new Dictionary<MethodDefinition, ProxyCreatorType>();
|
|
|
|
|
|
2012-05-29 17:13:39 +08:00
|
|
|
|
public ProxyCallFixer(ModuleDefinition module)
|
2011-10-23 19:43:32 +08:00
|
|
|
|
: base(module) {
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
enum ProxyCreatorType {
|
|
|
|
|
None,
|
|
|
|
|
CallOrCallvirt,
|
|
|
|
|
CallCtor,
|
|
|
|
|
Newobj,
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
class Context {
|
|
|
|
|
public int typeToken;
|
|
|
|
|
public int methodToken;
|
|
|
|
|
public int declaringTypeToken;
|
|
|
|
|
public ProxyCreatorType proxyCreatorType;
|
|
|
|
|
public Context(int typeToken, int methodToken, int declaringTypeToken, ProxyCreatorType proxyCreatorType) {
|
|
|
|
|
this.typeToken = typeToken;
|
|
|
|
|
this.methodToken = methodToken;
|
|
|
|
|
this.declaringTypeToken = declaringTypeToken;
|
|
|
|
|
this.proxyCreatorType = proxyCreatorType;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
protected override object checkCctor(TypeDefinition type, MethodDefinition cctor) {
|
|
|
|
|
var instructions = cctor.Body.Instructions;
|
|
|
|
|
for (int i = 0; i < instructions.Count; i++) {
|
|
|
|
|
var instrs = DotNetUtils.getInstructions(instructions, i, OpCodes.Ldc_I4, OpCodes.Ldc_I4, OpCodes.Ldc_I4, OpCodes.Call);
|
|
|
|
|
if (instrs == null)
|
|
|
|
|
continue;
|
|
|
|
|
|
|
|
|
|
int typeToken = (int)instrs[0].Operand;
|
|
|
|
|
int methodToken = (int)instrs[1].Operand;
|
|
|
|
|
int declaringTypeToken = (int)instrs[2].Operand;
|
|
|
|
|
var createMethod = instrs[3].Operand as MethodDefinition;
|
|
|
|
|
|
|
|
|
|
ProxyCreatorType proxyCreatorType;
|
|
|
|
|
if (!methodToType.TryGetValue(createMethod, out proxyCreatorType))
|
|
|
|
|
continue;
|
|
|
|
|
|
|
|
|
|
return new Context(typeToken, methodToken, declaringTypeToken, proxyCreatorType);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
return null;
|
|
|
|
|
}
|
|
|
|
|
|
2012-05-29 17:13:39 +08:00
|
|
|
|
protected override Dictionary<FieldDefinition, MethodDefinition> getFieldToMethodDictionary(TypeDefinition type) {
|
|
|
|
|
var dict = new Dictionary<FieldDefinition, MethodDefinition>();
|
2011-10-23 19:43:32 +08:00
|
|
|
|
foreach (var method in type.Methods) {
|
2011-10-26 20:29:57 +08:00
|
|
|
|
if (!method.IsStatic || !method.HasBody || method.Name == ".cctor")
|
2011-10-23 19:43:32 +08:00
|
|
|
|
continue;
|
|
|
|
|
|
|
|
|
|
var instructions = method.Body.Instructions;
|
|
|
|
|
for (int i = 0; i < instructions.Count; i++) {
|
|
|
|
|
var instr = instructions[i];
|
|
|
|
|
if (instr.OpCode.Code != Code.Ldsfld)
|
|
|
|
|
continue;
|
|
|
|
|
|
2012-05-29 17:13:39 +08:00
|
|
|
|
dict[(FieldDefinition)instr.Operand] = method;
|
2011-10-23 19:43:32 +08:00
|
|
|
|
break;
|
|
|
|
|
}
|
|
|
|
|
}
|
2012-05-29 17:13:39 +08:00
|
|
|
|
return dict;
|
2011-10-23 19:43:32 +08:00
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
protected override void getCallInfo(object context, FieldDefinition field, out MethodReference calledMethod, out OpCode callOpcode) {
|
|
|
|
|
var ctx = (Context)context;
|
|
|
|
|
|
|
|
|
|
switch (ctx.proxyCreatorType) {
|
|
|
|
|
case ProxyCreatorType.CallOrCallvirt:
|
|
|
|
|
callOpcode = field.IsFamilyOrAssembly ? OpCodes.Callvirt : OpCodes.Call;
|
|
|
|
|
break;
|
|
|
|
|
case ProxyCreatorType.CallCtor:
|
|
|
|
|
callOpcode = OpCodes.Call;
|
|
|
|
|
break;
|
|
|
|
|
case ProxyCreatorType.Newobj:
|
|
|
|
|
callOpcode = OpCodes.Newobj;
|
|
|
|
|
break;
|
|
|
|
|
default:
|
|
|
|
|
throw new ApplicationException(string.Format("Invalid proxy creator type: {0}", ctx.proxyCreatorType));
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
calledMethod = module.LookupToken(ctx.methodToken) as MethodReference;
|
|
|
|
|
}
|
|
|
|
|
|
2011-10-23 23:23:33 +08:00
|
|
|
|
public void findDelegateCreator() {
|
2011-10-23 19:43:32 +08:00
|
|
|
|
foreach (var type in module.Types) {
|
|
|
|
|
var createMethod = getProxyCreateMethod(type);
|
|
|
|
|
if (createMethod == null)
|
|
|
|
|
continue;
|
|
|
|
|
|
|
|
|
|
var proxyCreatorType = getProxyCreatorType(type, createMethod);
|
|
|
|
|
if (proxyCreatorType == ProxyCreatorType.None)
|
|
|
|
|
continue;
|
|
|
|
|
methodToType[createMethod] = proxyCreatorType;
|
|
|
|
|
setDelegateCreatorMethod(createMethod);
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
MethodDefinition getProxyCreateMethod(TypeDefinition type) {
|
|
|
|
|
if (DotNetUtils.findFieldType(type, "System.ModuleHandle", true) == null)
|
|
|
|
|
return null;
|
2012-07-11 08:15:33 +08:00
|
|
|
|
if (type.Fields.Count < 1 || type.Fields.Count > 7)
|
2012-04-16 05:42:11 +08:00
|
|
|
|
return null;
|
2011-10-23 19:43:32 +08:00
|
|
|
|
|
|
|
|
|
MethodDefinition createMethod = null;
|
|
|
|
|
foreach (var m in type.Methods) {
|
|
|
|
|
if (m.Name == ".ctor" || m.Name == ".cctor")
|
|
|
|
|
continue;
|
2011-10-23 23:23:33 +08:00
|
|
|
|
if (createMethod == null && DotNetUtils.isMethod(m, "System.Void", "(System.Int32,System.Int32,System.Int32)")) {
|
2011-10-23 19:43:32 +08:00
|
|
|
|
createMethod = m;
|
|
|
|
|
continue;
|
|
|
|
|
}
|
2011-12-15 23:16:21 +08:00
|
|
|
|
continue;
|
2011-10-23 19:43:32 +08:00
|
|
|
|
}
|
2011-10-23 23:23:33 +08:00
|
|
|
|
if (createMethod == null || !createMethod.HasBody)
|
2011-10-23 19:43:32 +08:00
|
|
|
|
return null;
|
2012-03-15 09:19:35 +08:00
|
|
|
|
if (!DeobUtils.hasInteger(createMethod, 0xFFFFFF))
|
2011-10-23 19:43:32 +08:00
|
|
|
|
return null;
|
|
|
|
|
|
|
|
|
|
return createMethod;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
ProxyCreatorType getProxyCreatorType(TypeDefinition type, MethodDefinition createMethod) {
|
|
|
|
|
int numCalls = 0, numCallvirts = 0, numNewobjs = 0;
|
|
|
|
|
foreach (var instr in createMethod.Body.Instructions) {
|
|
|
|
|
if (instr.OpCode.Code != Code.Ldsfld)
|
|
|
|
|
continue;
|
|
|
|
|
var field = instr.Operand as FieldReference;
|
|
|
|
|
if (field == null)
|
|
|
|
|
continue;
|
|
|
|
|
switch (field.FullName) {
|
|
|
|
|
case "System.Reflection.Emit.OpCode System.Reflection.Emit.OpCodes::Call":
|
|
|
|
|
numCalls++;
|
|
|
|
|
break;
|
|
|
|
|
case "System.Reflection.Emit.OpCode System.Reflection.Emit.OpCodes::Callvirt":
|
|
|
|
|
numCallvirts++;
|
|
|
|
|
break;
|
|
|
|
|
case "System.Reflection.Emit.OpCode System.Reflection.Emit.OpCodes::Newobj":
|
|
|
|
|
numNewobjs++;
|
|
|
|
|
break;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if (numCalls == 1 && numCallvirts == 1 && numNewobjs == 0)
|
|
|
|
|
return ProxyCreatorType.CallOrCallvirt;
|
|
|
|
|
if (numCalls == 1 && numCallvirts == 0 && numNewobjs == 0)
|
|
|
|
|
return ProxyCreatorType.CallCtor;
|
|
|
|
|
if (numCalls == 0 && numCallvirts == 0 && numNewobjs == 1)
|
|
|
|
|
return ProxyCreatorType.Newobj;
|
|
|
|
|
return ProxyCreatorType.None;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|