2011-11-12 20:31:08 +08:00
|
|
|
|
/*
|
2012-01-10 06:02:47 +08:00
|
|
|
|
Copyright (C) 2011-2012 de4dot@gmail.com
|
2011-11-12 20:31:08 +08:00
|
|
|
|
|
|
|
|
|
This file is part of de4dot.
|
|
|
|
|
|
|
|
|
|
de4dot is free software: you can redistribute it and/or modify
|
|
|
|
|
it under the terms of the GNU General Public License as published by
|
|
|
|
|
the Free Software Foundation, either version 3 of the License, or
|
|
|
|
|
(at your option) any later version.
|
|
|
|
|
|
|
|
|
|
de4dot is distributed in the hope that it will be useful,
|
|
|
|
|
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
|
GNU General Public License for more details.
|
|
|
|
|
|
|
|
|
|
You should have received a copy of the GNU General Public License
|
|
|
|
|
along with de4dot. If not, see <http://www.gnu.org/licenses/>.
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
using System;
|
2012-11-02 22:57:11 +08:00
|
|
|
|
using dot10.DotNet;
|
|
|
|
|
using dot10.DotNet.Emit;
|
2011-11-12 20:31:08 +08:00
|
|
|
|
using de4dot.blocks;
|
|
|
|
|
|
2011-12-22 01:55:36 +08:00
|
|
|
|
namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 {
|
2011-11-12 22:15:47 +08:00
|
|
|
|
class AntiStrongName {
|
2012-11-02 22:57:11 +08:00
|
|
|
|
TypeDef decrypterType;
|
|
|
|
|
MethodDef antiStrongNameMethod;
|
2011-11-12 20:31:08 +08:00
|
|
|
|
|
2012-11-02 22:57:11 +08:00
|
|
|
|
public AntiStrongName(TypeDef decrypterType) {
|
2011-11-12 20:31:08 +08:00
|
|
|
|
this.decrypterType = decrypterType;
|
|
|
|
|
find();
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
public void find() {
|
|
|
|
|
if (decrypterType == null)
|
|
|
|
|
return;
|
|
|
|
|
|
2011-11-12 22:22:17 +08:00
|
|
|
|
if (checkType(decrypterType))
|
|
|
|
|
return;
|
|
|
|
|
|
|
|
|
|
foreach (var type in decrypterType.NestedTypes) {
|
|
|
|
|
if (checkType(type))
|
|
|
|
|
return;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
2012-11-02 22:57:11 +08:00
|
|
|
|
bool checkType(TypeDef type) {
|
2011-11-12 20:31:08 +08:00
|
|
|
|
var requiredTypes = new string[] {
|
|
|
|
|
"System.Byte[]",
|
|
|
|
|
"System.IO.MemoryStream",
|
|
|
|
|
"System.Security.Cryptography.CryptoStream",
|
|
|
|
|
"System.Security.Cryptography.MD5",
|
|
|
|
|
"System.Security.Cryptography.Rijndael",
|
|
|
|
|
};
|
|
|
|
|
|
2011-11-12 22:22:17 +08:00
|
|
|
|
foreach (var method in type.Methods) {
|
2011-11-12 20:31:08 +08:00
|
|
|
|
if (!method.IsStatic || method.Body == null)
|
|
|
|
|
continue;
|
|
|
|
|
if (method.Parameters.Count != 2)
|
|
|
|
|
continue;
|
|
|
|
|
if (!checkType(method.MethodReturnType.ReturnType.FullName, "System.String"))
|
|
|
|
|
continue;
|
|
|
|
|
if (!checkType(method.Parameters[0].ParameterType.FullName, "System.String"))
|
|
|
|
|
continue;
|
|
|
|
|
if (!checkType(method.Parameters[1].ParameterType.FullName, "System.String"))
|
|
|
|
|
continue;
|
|
|
|
|
|
|
|
|
|
var localTypes = new LocalTypes(method);
|
|
|
|
|
if (!localTypes.all(requiredTypes))
|
|
|
|
|
continue;
|
|
|
|
|
|
2011-11-12 22:22:17 +08:00
|
|
|
|
antiStrongNameMethod = method;
|
|
|
|
|
return true;
|
2011-11-12 20:31:08 +08:00
|
|
|
|
}
|
2011-11-12 22:22:17 +08:00
|
|
|
|
|
|
|
|
|
return false;
|
2011-11-12 20:31:08 +08:00
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static bool checkType(string type, string expectedType) {
|
|
|
|
|
return type == "System.Object" || type == expectedType;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
public bool remove(Blocks blocks) {
|
2011-11-12 22:22:17 +08:00
|
|
|
|
if (antiStrongNameMethod == null)
|
2011-11-12 20:31:08 +08:00
|
|
|
|
return false;
|
|
|
|
|
|
2011-11-12 22:22:17 +08:00
|
|
|
|
Block antiSnBlock;
|
2011-11-12 20:31:08 +08:00
|
|
|
|
int numInstructions;
|
2011-11-12 22:22:17 +08:00
|
|
|
|
if (!findBlock(blocks, out antiSnBlock, out numInstructions))
|
2011-11-12 20:31:08 +08:00
|
|
|
|
return false;
|
|
|
|
|
|
2011-11-12 22:22:17 +08:00
|
|
|
|
if (antiSnBlock.FallThrough == null || antiSnBlock.Targets == null || antiSnBlock.Targets.Count != 1)
|
2011-11-12 20:31:08 +08:00
|
|
|
|
throw new ApplicationException("Invalid state");
|
|
|
|
|
|
2011-11-12 22:22:17 +08:00
|
|
|
|
var goodBlock = antiSnBlock.Targets[0];
|
|
|
|
|
var badBlock = antiSnBlock.FallThrough;
|
2011-11-12 20:31:08 +08:00
|
|
|
|
|
2011-11-12 22:22:17 +08:00
|
|
|
|
antiSnBlock.replaceLastInstrsWithBranch(numInstructions, goodBlock);
|
2011-11-12 20:31:08 +08:00
|
|
|
|
|
2011-11-12 23:04:51 +08:00
|
|
|
|
if (badBlock.FallThrough == badBlock && badBlock.Sources.Count == 1 && badBlock.Targets == null) {
|
2011-12-15 23:17:04 +08:00
|
|
|
|
badBlock.Parent.removeGuaranteedDeadBlock(badBlock);
|
2011-11-12 23:04:51 +08:00
|
|
|
|
return true;
|
|
|
|
|
}
|
|
|
|
|
if (badBlock.Instructions.Count <= 1 && badBlock.LastInstr.OpCode.Code == Code.Nop) {
|
|
|
|
|
if (badBlock.FallThrough != null && badBlock.Targets == null && badBlock.Sources.Count == 0) {
|
|
|
|
|
var badBlock2 = badBlock.FallThrough;
|
|
|
|
|
if (badBlock2.FallThrough == badBlock2 && badBlock2.Sources.Count == 2 && badBlock2.Targets == null) {
|
2011-12-15 23:17:04 +08:00
|
|
|
|
badBlock.Parent.removeGuaranteedDeadBlock(badBlock);
|
|
|
|
|
badBlock2.Parent.removeGuaranteedDeadBlock(badBlock2);
|
2011-11-12 23:04:51 +08:00
|
|
|
|
return true;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|
2011-11-12 20:31:08 +08:00
|
|
|
|
|
2011-11-12 23:04:51 +08:00
|
|
|
|
throw new ApplicationException("Invalid state");
|
2011-11-12 20:31:08 +08:00
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
bool findBlock(Blocks blocks, out Block foundBlock, out int numInstructions) {
|
|
|
|
|
const int NUM_INSTRS = 11;
|
|
|
|
|
|
|
|
|
|
foreach (var block in blocks.MethodBlocks.getAllBlocks()) {
|
|
|
|
|
if (!block.LastInstr.isBrfalse())
|
|
|
|
|
continue;
|
|
|
|
|
|
|
|
|
|
var instructions = block.Instructions;
|
|
|
|
|
if (instructions.Count < NUM_INSTRS)
|
|
|
|
|
continue;
|
|
|
|
|
int i = instructions.Count - NUM_INSTRS;
|
|
|
|
|
if (instructions[i].OpCode.Code != Code.Ldtoken)
|
|
|
|
|
continue;
|
|
|
|
|
if (!(instructions[i].Operand is TypeReference))
|
|
|
|
|
continue;
|
|
|
|
|
if (!checkCall(instructions[i + 1], "System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)"))
|
|
|
|
|
continue;
|
|
|
|
|
if (!checkCall(instructions[i + 2], "System.Reflection.Assembly System.Type::get_Assembly()"))
|
|
|
|
|
continue;
|
|
|
|
|
if (!checkCall(instructions[i + 3], "System.Reflection.AssemblyName System.Reflection.Assembly::GetName()"))
|
|
|
|
|
continue;
|
|
|
|
|
if (!checkCall(instructions[i + 4], "System.Byte[] System.Reflection.AssemblyName::GetPublicKeyToken()"))
|
|
|
|
|
continue;
|
|
|
|
|
if (!checkCall(instructions[i + 5], "System.String System.Convert::ToBase64String(System.Byte[])"))
|
|
|
|
|
continue;
|
|
|
|
|
if (instructions[i + 6].OpCode.Code != Code.Ldstr)
|
|
|
|
|
continue;
|
2011-11-12 22:22:17 +08:00
|
|
|
|
if (!checkCall(instructions[i + 7], antiStrongNameMethod))
|
2011-11-12 20:31:08 +08:00
|
|
|
|
continue;
|
|
|
|
|
if (instructions[i + 8].OpCode.Code != Code.Ldstr)
|
|
|
|
|
continue;
|
|
|
|
|
if (!checkCall(instructions[i + 9], "System.Boolean System.String::op_Inequality(System.String,System.String)"))
|
|
|
|
|
continue;
|
|
|
|
|
|
|
|
|
|
numInstructions = NUM_INSTRS;
|
|
|
|
|
foundBlock = block;
|
|
|
|
|
return true;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
foundBlock = null;
|
|
|
|
|
numInstructions = 0;
|
|
|
|
|
return false;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static bool checkCall(Instr instr, string methodFullName) {
|
|
|
|
|
if (instr.OpCode.Code != Code.Call && instr.OpCode.Code != Code.Callvirt)
|
|
|
|
|
return false;
|
|
|
|
|
var calledMethod = instr.Operand as MethodReference;
|
|
|
|
|
if (calledMethod == null)
|
|
|
|
|
return false;
|
|
|
|
|
return calledMethod.FullName == methodFullName;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static bool checkCall(Instr instr, MethodReference expectedMethod) {
|
|
|
|
|
if (instr.OpCode.Code != Code.Call && instr.OpCode.Code != Code.Callvirt)
|
|
|
|
|
return false;
|
|
|
|
|
var calledMethod = instr.Operand as MethodReference;
|
|
|
|
|
if (calledMethod == null)
|
|
|
|
|
return false;
|
|
|
|
|
return MemberReferenceHelper.compareMethodReferenceAndDeclaringType(calledMethod, expectedMethod);
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|