2011-12-01 01:28:48 +08:00
|
|
|
|
/*
|
2015-10-30 05:45:26 +08:00
|
|
|
|
Copyright (C) 2011-2015 de4dot@gmail.com
|
2011-12-01 01:28:48 +08:00
|
|
|
|
|
|
|
|
|
This file is part of de4dot.
|
|
|
|
|
|
|
|
|
|
de4dot is free software: you can redistribute it and/or modify
|
|
|
|
|
it under the terms of the GNU General Public License as published by
|
|
|
|
|
the Free Software Foundation, either version 3 of the License, or
|
|
|
|
|
(at your option) any later version.
|
|
|
|
|
|
|
|
|
|
de4dot is distributed in the hope that it will be useful,
|
|
|
|
|
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
|
GNU General Public License for more details.
|
|
|
|
|
|
|
|
|
|
You should have received a copy of the GNU General Public License
|
|
|
|
|
along with de4dot. If not, see <http://www.gnu.org/licenses/>.
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
using System;
|
2011-12-01 21:16:23 +08:00
|
|
|
|
using System.IO;
|
2011-12-01 01:28:48 +08:00
|
|
|
|
using ICSharpCode.SharpZipLib.Zip.Compression;
|
2012-12-20 09:06:09 +08:00
|
|
|
|
using dnlib.PE;
|
|
|
|
|
using dnlib.IO;
|
|
|
|
|
using dnlib.DotNet;
|
2011-12-01 01:28:48 +08:00
|
|
|
|
|
2011-12-22 01:55:36 +08:00
|
|
|
|
namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 {
|
2011-12-01 01:28:48 +08:00
|
|
|
|
class NativeImageUnpacker {
|
2012-11-18 01:57:36 +08:00
|
|
|
|
MyPEImage peImage;
|
2011-12-01 21:16:23 +08:00
|
|
|
|
bool isNet1x;
|
2012-12-04 09:29:41 +08:00
|
|
|
|
const int loaderHeaderSizeV45 = 14;
|
2011-12-01 01:28:48 +08:00
|
|
|
|
|
2012-11-18 01:57:36 +08:00
|
|
|
|
public NativeImageUnpacker(IPEImage peImage) {
|
|
|
|
|
this.peImage = new MyPEImage(peImage);
|
2011-12-01 01:28:48 +08:00
|
|
|
|
}
|
|
|
|
|
|
2013-01-19 20:03:57 +08:00
|
|
|
|
public byte[] Unpack() {
|
2012-11-18 01:57:36 +08:00
|
|
|
|
if (peImage.PEImage.Win32Resources == null)
|
2011-12-01 01:28:48 +08:00
|
|
|
|
return null;
|
2012-11-18 01:57:36 +08:00
|
|
|
|
var dataEntry = peImage.PEImage.Win32Resources.Find(10, "__", 0);
|
2011-12-01 01:28:48 +08:00
|
|
|
|
if (dataEntry == null)
|
|
|
|
|
return null;
|
|
|
|
|
|
2012-11-18 01:57:36 +08:00
|
|
|
|
var encryptedData = dataEntry.Data.ReadAllBytes();
|
2011-12-01 01:28:48 +08:00
|
|
|
|
|
2013-01-19 20:03:57 +08:00
|
|
|
|
var keyData = GetKeyData();
|
2011-12-01 02:06:25 +08:00
|
|
|
|
if (keyData == null)
|
|
|
|
|
return null;
|
2011-12-01 01:28:48 +08:00
|
|
|
|
var decrypter = new NativeFileDecrypter(keyData);
|
2013-01-19 20:03:57 +08:00
|
|
|
|
decrypter.Decrypt(encryptedData, 0, encryptedData.Length);
|
2011-12-01 01:28:48 +08:00
|
|
|
|
|
2011-12-01 21:16:23 +08:00
|
|
|
|
byte[] inflatedData;
|
2012-01-03 05:35:02 +08:00
|
|
|
|
if (isNet1x)
|
2013-01-19 20:03:57 +08:00
|
|
|
|
inflatedData = DeobUtils.Inflate(encryptedData, false);
|
2011-12-01 21:16:23 +08:00
|
|
|
|
else {
|
|
|
|
|
int inflatedSize = BitConverter.ToInt32(encryptedData, 0);
|
|
|
|
|
inflatedData = new byte[inflatedSize];
|
2012-01-03 05:35:02 +08:00
|
|
|
|
var inflater = new Inflater(false);
|
2011-12-01 21:16:23 +08:00
|
|
|
|
inflater.SetInput(encryptedData, 4, encryptedData.Length - 4);
|
|
|
|
|
int count = inflater.Inflate(inflatedData);
|
|
|
|
|
if (count != inflatedSize)
|
|
|
|
|
return null;
|
|
|
|
|
}
|
2011-12-01 01:28:48 +08:00
|
|
|
|
|
2012-12-04 09:29:41 +08:00
|
|
|
|
// CLR 1.x or DNR v4.0 - v4.4
|
|
|
|
|
if (BitConverter.ToInt16(inflatedData, 0) == 0x5A4D)
|
|
|
|
|
return inflatedData;
|
|
|
|
|
|
|
|
|
|
// DNR v4.5
|
|
|
|
|
if (BitConverter.ToInt16(inflatedData, loaderHeaderSizeV45) == 0x5A4D)
|
2013-01-19 20:03:57 +08:00
|
|
|
|
return UnpackLoader(inflatedData);
|
2012-12-04 09:29:41 +08:00
|
|
|
|
|
|
|
|
|
return null;
|
|
|
|
|
}
|
|
|
|
|
|
2013-01-19 20:03:57 +08:00
|
|
|
|
static byte[] UnpackLoader(byte[] loaderData) {
|
2012-12-04 09:29:41 +08:00
|
|
|
|
var loaderBytes = new byte[loaderData.Length - loaderHeaderSizeV45];
|
|
|
|
|
Array.Copy(loaderData, loaderHeaderSizeV45, loaderBytes, 0, loaderBytes.Length);
|
2011-12-01 02:10:56 +08:00
|
|
|
|
|
2012-12-04 09:29:41 +08:00
|
|
|
|
try {
|
|
|
|
|
using (var asmLoader = ModuleDefMD.Load(loaderBytes)) {
|
|
|
|
|
if (asmLoader.Resources.Count == 0)
|
|
|
|
|
return null;
|
|
|
|
|
var resource = asmLoader.Resources[0] as EmbeddedResource;
|
|
|
|
|
if (resource == null)
|
|
|
|
|
return null;
|
|
|
|
|
|
|
|
|
|
return resource.Data.ReadAllBytes();
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
catch {
|
|
|
|
|
return null;
|
|
|
|
|
}
|
2011-12-01 01:28:48 +08:00
|
|
|
|
}
|
2011-12-01 02:06:25 +08:00
|
|
|
|
|
2012-12-04 09:29:41 +08:00
|
|
|
|
static readonly uint[] baseOffsets = new uint[] {
|
2011-12-01 02:06:25 +08:00
|
|
|
|
0x1C00, // DNR 4.0 & 4.1
|
|
|
|
|
0x1900, // DNR 4.2.7.5
|
2012-12-04 09:29:41 +08:00
|
|
|
|
0x1B60, // DNR 4.2.8.4, 4.3, 4.4, 4.5
|
|
|
|
|
0x700, // DNR 4.5.0.0
|
2011-12-01 02:06:25 +08:00
|
|
|
|
};
|
2012-12-04 09:29:41 +08:00
|
|
|
|
static readonly short[] decryptMethodPattern = new short[] {
|
2011-12-01 02:06:25 +08:00
|
|
|
|
/* 00 */ 0x83, 0xEC, 0x38, // sub esp, 38h
|
|
|
|
|
/* 03 */ 0x53, // push ebx
|
|
|
|
|
/* 04 */ 0xB0, -1, // mov al, ??h
|
|
|
|
|
/* 06 */ 0x88, 0x44, 0x24, 0x2B, // mov [esp+2Bh], al
|
|
|
|
|
/* 0A */ 0x88, 0x44, 0x24, 0x2F, // mov [esp+2Fh], al
|
|
|
|
|
/* 0E */ 0xB0, -1, // mov al, ??h
|
|
|
|
|
/* 10 */ 0x88, 0x44, 0x24, 0x30, // mov [esp+30h], al
|
|
|
|
|
/* 14 */ 0x88, 0x44, 0x24, 0x31, // mov [esp+31h], al
|
|
|
|
|
/* 18 */ 0x88, 0x44, 0x24, 0x33, // mov [esp+33h], al
|
|
|
|
|
/* 1C */ 0x55, // push ebp
|
|
|
|
|
/* 1D */ 0x56, // push esi
|
|
|
|
|
};
|
2012-12-04 09:29:41 +08:00
|
|
|
|
static readonly short[] startMethodNet1xPattern = new short[] {
|
2011-12-01 21:16:23 +08:00
|
|
|
|
/* 00 */ 0x55, // push ebp
|
|
|
|
|
/* 01 */ 0x8B, 0xEC, // mov ebp, esp
|
|
|
|
|
/* 03 */ 0xB9, 0x14, 0x00, 0x00, 0x00, // mov ecx, 14h
|
|
|
|
|
/* 08 */ 0x6A, 0x00, // push 0
|
|
|
|
|
/* 0A */ 0x6A, 0x00, // push 0
|
|
|
|
|
/* 0C */ 0x49, // dec ecx
|
|
|
|
|
/* 0D */ 0x75, 0xF9, // jnz short $-5
|
|
|
|
|
/* 0F */ 0x53, // push ebx
|
|
|
|
|
/* 10 */ 0x56, // push esi
|
|
|
|
|
/* 11 */ 0x57, // push edi
|
|
|
|
|
/* 12 */ 0xB8, -1, -1, -1, -1, // mov eax, offset XXXXXXXX
|
|
|
|
|
/* 17 */ 0xE8, -1, -1, -1, -1, // call YYYYYYYY
|
|
|
|
|
};
|
2013-01-19 20:03:57 +08:00
|
|
|
|
byte[] GetKeyData() {
|
2011-12-01 21:16:23 +08:00
|
|
|
|
isNet1x = false;
|
2011-12-01 02:06:25 +08:00
|
|
|
|
for (int i = 0; i < baseOffsets.Length; i++) {
|
2013-01-19 20:03:57 +08:00
|
|
|
|
var code = peImage.OffsetReadBytes(baseOffsets[i], decryptMethodPattern.Length);
|
|
|
|
|
if (DeobUtils.IsCode(decryptMethodPattern, code))
|
|
|
|
|
return GetKeyData(baseOffsets[i]);
|
2011-12-01 02:06:25 +08:00
|
|
|
|
}
|
|
|
|
|
|
2013-01-19 20:03:57 +08:00
|
|
|
|
var net1xCode = peImage.OffsetReadBytes(0x207E0, startMethodNet1xPattern.Length);
|
|
|
|
|
if (DeobUtils.IsCode(startMethodNet1xPattern, net1xCode)) {
|
2011-12-01 21:16:23 +08:00
|
|
|
|
isNet1x = true;
|
|
|
|
|
return new byte[6] { 0x34, 0x38, 0x63, 0x65, 0x7A, 0x35 };
|
|
|
|
|
}
|
2011-12-01 02:06:25 +08:00
|
|
|
|
|
|
|
|
|
return null;
|
|
|
|
|
}
|
|
|
|
|
|
2013-01-19 20:03:57 +08:00
|
|
|
|
byte[] GetKeyData(uint baseOffset) {
|
2011-12-01 02:06:25 +08:00
|
|
|
|
return new byte[6] {
|
2013-01-19 20:03:57 +08:00
|
|
|
|
peImage.OffsetReadByte(baseOffset + 5),
|
|
|
|
|
peImage.OffsetReadByte(baseOffset + 0xF),
|
|
|
|
|
peImage.OffsetReadByte(baseOffset + 0x58),
|
|
|
|
|
peImage.OffsetReadByte(baseOffset + 0x6D),
|
|
|
|
|
peImage.OffsetReadByte(baseOffset + 0x98),
|
|
|
|
|
peImage.OffsetReadByte(baseOffset + 0xA6),
|
2011-12-01 02:06:25 +08:00
|
|
|
|
};
|
|
|
|
|
}
|
2011-12-01 01:28:48 +08:00
|
|
|
|
}
|
|
|
|
|
}
|