2011-09-22 10:55:30 +08:00
|
|
|
|
/*
|
2014-03-12 05:15:43 +08:00
|
|
|
|
Copyright (C) 2011-2014 de4dot@gmail.com
|
2011-09-22 10:55:30 +08:00
|
|
|
|
|
|
|
|
|
This file is part of de4dot.
|
|
|
|
|
|
|
|
|
|
de4dot is free software: you can redistribute it and/or modify
|
|
|
|
|
it under the terms of the GNU General Public License as published by
|
|
|
|
|
the Free Software Foundation, either version 3 of the License, or
|
|
|
|
|
(at your option) any later version.
|
|
|
|
|
|
|
|
|
|
de4dot is distributed in the hope that it will be useful,
|
|
|
|
|
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
|
GNU General Public License for more details.
|
|
|
|
|
|
|
|
|
|
You should have received a copy of the GNU General Public License
|
|
|
|
|
along with de4dot. If not, see <http://www.gnu.org/licenses/>.
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
using System;
|
|
|
|
|
using System.Collections.Generic;
|
|
|
|
|
using System.Text;
|
2012-12-20 09:06:09 +08:00
|
|
|
|
using dnlib.DotNet;
|
2011-12-09 16:02:06 +08:00
|
|
|
|
using de4dot.code;
|
|
|
|
|
using de4dot.code.deobfuscators;
|
2015-05-17 19:30:06 +08:00
|
|
|
|
using System.IO;
|
|
|
|
|
using System.Reflection;
|
2011-09-22 10:55:30 +08:00
|
|
|
|
|
2011-12-09 16:02:06 +08:00
|
|
|
|
namespace de4dot.cui {
|
2012-02-15 04:51:31 +08:00
|
|
|
|
class ExitException : Exception {
|
|
|
|
|
public readonly int code;
|
|
|
|
|
public ExitException(int code) {
|
|
|
|
|
this.code = code;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
2012-03-29 10:58:10 +08:00
|
|
|
|
class Program {
|
2013-01-19 20:03:57 +08:00
|
|
|
|
static IList<IDeobfuscatorInfo> deobfuscatorInfos = CreateDeobfuscatorInfos();
|
2011-09-22 10:55:30 +08:00
|
|
|
|
|
2015-05-17 19:30:06 +08:00
|
|
|
|
static IList<IDeobfuscatorInfo> LoadPlugin(string assembly) {
|
|
|
|
|
var plugins = new List<IDeobfuscatorInfo>();
|
|
|
|
|
try {
|
|
|
|
|
foreach (Type item in Assembly.LoadFile(assembly).GetTypes()) {
|
|
|
|
|
var interfaces = new List<Type>(item.GetInterfaces());
|
|
|
|
|
if (item.IsClass && interfaces.Contains(typeof(IDeobfuscatorInfo)))
|
|
|
|
|
plugins.Add((IDeobfuscatorInfo)Activator.CreateInstance(item));
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
catch {
|
|
|
|
|
}
|
|
|
|
|
return plugins;
|
|
|
|
|
}
|
|
|
|
|
|
2015-05-23 03:17:57 +08:00
|
|
|
|
public static void GetPlugins(string directory, ref Dictionary<string, IDeobfuscatorInfo> result) {
|
2015-05-17 19:58:57 +08:00
|
|
|
|
var plugins = new List<IDeobfuscatorInfo>();
|
2015-05-17 19:30:06 +08:00
|
|
|
|
try {
|
|
|
|
|
var files = Directory.GetFiles(directory, "deobfuscator.*.dll", SearchOption.TopDirectoryOnly);
|
|
|
|
|
foreach (var file in files)
|
|
|
|
|
plugins.AddRange(LoadPlugin(Path.GetFullPath(file)));
|
|
|
|
|
}
|
|
|
|
|
catch {
|
|
|
|
|
}
|
2015-05-23 03:17:57 +08:00
|
|
|
|
foreach(var p in plugins)
|
|
|
|
|
result[p.Type] = p;
|
2015-05-17 19:30:06 +08:00
|
|
|
|
}
|
|
|
|
|
|
2013-01-19 20:03:57 +08:00
|
|
|
|
static IList<IDeobfuscatorInfo> CreateDeobfuscatorInfos() {
|
2015-05-17 19:30:06 +08:00
|
|
|
|
var local = new List<IDeobfuscatorInfo> {
|
2011-12-09 16:02:06 +08:00
|
|
|
|
new de4dot.code.deobfuscators.Unknown.DeobfuscatorInfo(),
|
2012-11-07 12:17:45 +08:00
|
|
|
|
new de4dot.code.deobfuscators.Agile_NET.DeobfuscatorInfo(),
|
2012-01-08 03:27:07 +08:00
|
|
|
|
new de4dot.code.deobfuscators.Babel_NET.DeobfuscatorInfo(),
|
2012-05-30 01:14:41 +08:00
|
|
|
|
new de4dot.code.deobfuscators.CodeFort.DeobfuscatorInfo(),
|
2012-06-27 21:21:42 +08:00
|
|
|
|
new de4dot.code.deobfuscators.CodeVeil.DeobfuscatorInfo(),
|
2012-05-26 06:52:38 +08:00
|
|
|
|
new de4dot.code.deobfuscators.CodeWall.DeobfuscatorInfo(),
|
2011-12-09 16:02:06 +08:00
|
|
|
|
new de4dot.code.deobfuscators.CryptoObfuscator.DeobfuscatorInfo(),
|
2012-01-23 02:58:31 +08:00
|
|
|
|
new de4dot.code.deobfuscators.DeepSea.DeobfuscatorInfo(),
|
2011-12-09 16:02:06 +08:00
|
|
|
|
new de4dot.code.deobfuscators.Dotfuscator.DeobfuscatorInfo(),
|
2011-12-22 01:55:36 +08:00
|
|
|
|
new de4dot.code.deobfuscators.dotNET_Reactor.v3.DeobfuscatorInfo(),
|
|
|
|
|
new de4dot.code.deobfuscators.dotNET_Reactor.v4.DeobfuscatorInfo(),
|
2012-02-12 23:46:39 +08:00
|
|
|
|
new de4dot.code.deobfuscators.Eazfuscator_NET.DeobfuscatorInfo(),
|
2011-12-29 15:26:36 +08:00
|
|
|
|
new de4dot.code.deobfuscators.Goliath_NET.DeobfuscatorInfo(),
|
2012-06-04 10:20:43 +08:00
|
|
|
|
new de4dot.code.deobfuscators.ILProtector.DeobfuscatorInfo(),
|
2012-11-18 14:34:51 +08:00
|
|
|
|
new de4dot.code.deobfuscators.MaxtoCode.DeobfuscatorInfo(),
|
2012-11-07 08:52:15 +08:00
|
|
|
|
new de4dot.code.deobfuscators.MPRESS.DeobfuscatorInfo(),
|
2012-11-07 00:21:56 +08:00
|
|
|
|
new de4dot.code.deobfuscators.Rummage.DeobfuscatorInfo(),
|
2011-12-31 20:14:02 +08:00
|
|
|
|
new de4dot.code.deobfuscators.Skater_NET.DeobfuscatorInfo(),
|
2011-12-09 16:02:06 +08:00
|
|
|
|
new de4dot.code.deobfuscators.SmartAssembly.DeobfuscatorInfo(),
|
2012-11-15 02:29:29 +08:00
|
|
|
|
new de4dot.code.deobfuscators.Spices_Net.DeobfuscatorInfo(),
|
2012-11-06 22:53:01 +08:00
|
|
|
|
new de4dot.code.deobfuscators.Xenocode.DeobfuscatorInfo(),
|
2011-09-22 10:55:30 +08:00
|
|
|
|
};
|
2015-05-23 03:17:57 +08:00
|
|
|
|
var dict = new Dictionary<string, IDeobfuscatorInfo>();
|
|
|
|
|
foreach (var d in local)
|
|
|
|
|
dict[d.Type] = d;
|
2015-05-17 19:30:06 +08:00
|
|
|
|
string pluginDir = Path.Combine(AppDomain.CurrentDomain.BaseDirectory, "bin");
|
2015-05-23 03:17:57 +08:00
|
|
|
|
GetPlugins(pluginDir, ref dict);
|
|
|
|
|
return new List<IDeobfuscatorInfo>(dict.Values);
|
2011-09-22 10:55:30 +08:00
|
|
|
|
}
|
|
|
|
|
|
2013-11-16 04:55:09 +08:00
|
|
|
|
public static int Main(string[] args) {
|
2012-02-15 04:51:31 +08:00
|
|
|
|
int exitCode = 0;
|
|
|
|
|
|
2012-11-11 12:31:11 +08:00
|
|
|
|
const string showAllMessagesEnvName = "SHOWALLMESSAGES";
|
2011-09-22 10:55:30 +08:00
|
|
|
|
try {
|
2011-09-28 07:27:46 +08:00
|
|
|
|
if (Console.OutputEncoding.IsSingleByte)
|
|
|
|
|
Console.OutputEncoding = new UTF8Encoding(false);
|
2011-09-22 10:55:30 +08:00
|
|
|
|
|
2013-01-19 20:03:57 +08:00
|
|
|
|
Logger.Instance.CanIgnoreMessages = !HasEnv(showAllMessagesEnvName);
|
2012-11-11 12:31:11 +08:00
|
|
|
|
|
|
|
|
|
Logger.n("");
|
2014-03-12 05:15:43 +08:00
|
|
|
|
Logger.n("de4dot v{0} Copyright (C) 2011-2014 de4dot@gmail.com", System.Reflection.Assembly.GetExecutingAssembly().GetName().Version);
|
2014-04-15 03:56:17 +08:00
|
|
|
|
Logger.n("Latest version and source code: https://github.com/0xd4d/de4dot");
|
2015-05-17 19:30:06 +08:00
|
|
|
|
Logger.n("{0} deobfuscator modules loaded!", deobfuscatorInfos.Count);
|
2012-11-11 12:31:11 +08:00
|
|
|
|
Logger.n("");
|
2011-09-22 10:55:30 +08:00
|
|
|
|
|
|
|
|
|
var options = new FilesDeobfuscator.Options();
|
2013-01-19 20:03:57 +08:00
|
|
|
|
ParseCommandLine(args, options);
|
|
|
|
|
new FilesDeobfuscator(options).DoIt();
|
2011-09-22 10:55:30 +08:00
|
|
|
|
}
|
2012-02-15 04:51:31 +08:00
|
|
|
|
catch (ExitException ex) {
|
|
|
|
|
exitCode = ex.code;
|
|
|
|
|
}
|
2011-09-22 10:55:30 +08:00
|
|
|
|
catch (UserException ex) {
|
2012-12-08 19:33:01 +08:00
|
|
|
|
Logger.Instance.LogErrorDontIgnore("{0}", ex.Message);
|
2012-02-15 04:51:31 +08:00
|
|
|
|
exitCode = 1;
|
2011-09-22 10:55:30 +08:00
|
|
|
|
}
|
|
|
|
|
catch (Exception ex) {
|
2013-01-19 20:03:57 +08:00
|
|
|
|
if (PrintFullStackTrace()) {
|
|
|
|
|
PrintStackTrace(ex);
|
2014-09-14 14:35:08 +08:00
|
|
|
|
Logger.Instance.LogErrorDontIgnore("\nTry the latest version!");
|
2012-05-10 01:32:52 +08:00
|
|
|
|
}
|
|
|
|
|
else {
|
2012-11-18 10:20:40 +08:00
|
|
|
|
Logger.Instance.LogErrorDontIgnore("\n\n");
|
|
|
|
|
Logger.Instance.LogErrorDontIgnore("Hmmmm... something didn't work. Try the latest version.");
|
2012-05-10 01:32:52 +08:00
|
|
|
|
}
|
2012-02-15 04:51:31 +08:00
|
|
|
|
exitCode = 1;
|
2011-09-22 10:55:30 +08:00
|
|
|
|
}
|
|
|
|
|
|
2012-11-11 12:31:11 +08:00
|
|
|
|
if (Logger.Instance.NumIgnoredMessages > 0) {
|
2013-11-18 01:11:14 +08:00
|
|
|
|
if (Logger.Instance.NumIgnoredMessages == 1)
|
|
|
|
|
Logger.n("Ignored {0} warning/error", Logger.Instance.NumIgnoredMessages);
|
|
|
|
|
else
|
|
|
|
|
Logger.n("Ignored {0} warnings/errors", Logger.Instance.NumIgnoredMessages);
|
2012-11-18 10:02:12 +08:00
|
|
|
|
Logger.n("Use -v/-vv option or set environment variable {0}=1 to see all messages", showAllMessagesEnvName);
|
2012-11-11 12:31:11 +08:00
|
|
|
|
}
|
|
|
|
|
|
2013-01-19 20:03:57 +08:00
|
|
|
|
if (IsN00bUser()) {
|
2012-02-15 04:51:31 +08:00
|
|
|
|
Console.Error.WriteLine("\n\nPress any key to exit...\n");
|
|
|
|
|
try {
|
|
|
|
|
Console.ReadKey(true);
|
|
|
|
|
}
|
|
|
|
|
catch (InvalidOperationException) {
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
return exitCode;
|
|
|
|
|
}
|
|
|
|
|
|
2013-01-19 20:03:57 +08:00
|
|
|
|
static bool PrintFullStackTrace() {
|
2012-11-11 12:31:11 +08:00
|
|
|
|
if (!Logger.Instance.IgnoresEvent(LoggerEvent.Verbose))
|
2012-05-10 01:32:52 +08:00
|
|
|
|
return true;
|
2013-01-19 20:03:57 +08:00
|
|
|
|
if (HasEnv("STACKTRACE"))
|
2012-05-10 01:32:52 +08:00
|
|
|
|
return true;
|
|
|
|
|
|
|
|
|
|
return false;
|
|
|
|
|
}
|
|
|
|
|
|
2013-01-19 20:03:57 +08:00
|
|
|
|
static bool HasEnv(string name) {
|
2012-05-10 01:32:52 +08:00
|
|
|
|
foreach (var tmp in Environment.GetEnvironmentVariables().Keys) {
|
|
|
|
|
var env = tmp as string;
|
|
|
|
|
if (env == null)
|
|
|
|
|
continue;
|
|
|
|
|
if (string.Equals(env, name, StringComparison.OrdinalIgnoreCase))
|
|
|
|
|
return true;
|
|
|
|
|
}
|
|
|
|
|
return false;
|
|
|
|
|
}
|
|
|
|
|
|
2013-01-19 20:03:57 +08:00
|
|
|
|
static bool IsN00bUser() {
|
|
|
|
|
if (HasEnv("VisualStudioDir"))
|
2012-02-15 04:51:31 +08:00
|
|
|
|
return false;
|
2013-01-19 20:03:57 +08:00
|
|
|
|
return HasEnv("windir") && !HasEnv("PROMPT");
|
2011-09-22 10:55:30 +08:00
|
|
|
|
}
|
|
|
|
|
|
2013-01-19 20:03:57 +08:00
|
|
|
|
public static void PrintStackTrace(Exception ex) {
|
|
|
|
|
PrintStackTrace(ex, LoggerEvent.Error);
|
2012-07-07 13:11:32 +08:00
|
|
|
|
}
|
|
|
|
|
|
2013-01-19 20:03:57 +08:00
|
|
|
|
public static void PrintStackTrace(Exception ex, LoggerEvent loggerEvent) {
|
2011-12-09 16:02:06 +08:00
|
|
|
|
var line = new string('-', 78);
|
2012-11-11 12:31:11 +08:00
|
|
|
|
Logger.Instance.Log(false, null, loggerEvent, "\n\n");
|
|
|
|
|
Logger.Instance.Log(false, null, loggerEvent, line);
|
|
|
|
|
Logger.Instance.Log(false, null, loggerEvent, "Stack trace:\n{0}", ex.StackTrace);
|
2012-12-13 23:30:52 +08:00
|
|
|
|
Logger.Instance.Log(false, null, loggerEvent, "\n\nCaught an exception:\n");
|
2012-11-11 12:31:11 +08:00
|
|
|
|
Logger.Instance.Log(false, null, loggerEvent, line);
|
|
|
|
|
Logger.Instance.Log(false, null, loggerEvent, "Message:");
|
|
|
|
|
Logger.Instance.Log(false, null, loggerEvent, " {0}", ex.Message);
|
|
|
|
|
Logger.Instance.Log(false, null, loggerEvent, "Type:");
|
|
|
|
|
Logger.Instance.Log(false, null, loggerEvent, " {0}", ex.GetType());
|
|
|
|
|
Logger.Instance.Log(false, null, loggerEvent, line);
|
2011-12-09 16:02:06 +08:00
|
|
|
|
}
|
|
|
|
|
|
2013-01-19 20:03:57 +08:00
|
|
|
|
static void ParseCommandLine(string[] args, FilesDeobfuscator.Options options) {
|
|
|
|
|
new CommandLineParser(deobfuscatorInfos, options).Parse(args);
|
2011-09-22 10:55:30 +08:00
|
|
|
|
|
2012-11-11 12:31:11 +08:00
|
|
|
|
Logger.vv("Args:");
|
2013-01-19 20:03:57 +08:00
|
|
|
|
Logger.Instance.Indent();
|
2011-09-22 10:55:30 +08:00
|
|
|
|
foreach (var arg in args)
|
2013-01-19 20:03:57 +08:00
|
|
|
|
Logger.vv("{0}", Utils.ToCsharpString(arg));
|
|
|
|
|
Logger.Instance.DeIndent();
|
2011-09-22 10:55:30 +08:00
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|