2012-06-04 10:20:43 +08:00
|
|
|
|
/*
|
2015-10-30 05:45:26 +08:00
|
|
|
|
Copyright (C) 2011-2015 de4dot@gmail.com
|
2012-06-04 10:20:43 +08:00
|
|
|
|
|
|
|
|
|
This file is part of de4dot.
|
|
|
|
|
|
|
|
|
|
de4dot is free software: you can redistribute it and/or modify
|
|
|
|
|
it under the terms of the GNU General Public License as published by
|
|
|
|
|
the Free Software Foundation, either version 3 of the License, or
|
|
|
|
|
(at your option) any later version.
|
|
|
|
|
|
|
|
|
|
de4dot is distributed in the hope that it will be useful,
|
|
|
|
|
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
|
GNU General Public License for more details.
|
|
|
|
|
|
|
|
|
|
You should have received a copy of the GNU General Public License
|
|
|
|
|
along with de4dot. If not, see <http://www.gnu.org/licenses/>.
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
using System;
|
|
|
|
|
using System.Collections.Generic;
|
2012-12-13 19:03:25 +08:00
|
|
|
|
using System.IO;
|
2012-12-20 09:06:09 +08:00
|
|
|
|
using dnlib.IO;
|
|
|
|
|
using dnlib.DotNet;
|
2012-06-04 10:20:43 +08:00
|
|
|
|
|
|
|
|
|
namespace de4dot.code.deobfuscators.ILProtector {
|
2013-10-26 23:25:58 +08:00
|
|
|
|
class StaticMethodsDecrypter : MethodsDecrypterBase {
|
2012-12-13 19:03:25 +08:00
|
|
|
|
IDecrypter decrypter;
|
|
|
|
|
|
|
|
|
|
interface IDecrypter {
|
|
|
|
|
string Version { get; }
|
2013-01-19 20:03:57 +08:00
|
|
|
|
byte[] GetMethodsData(EmbeddedResource resource);
|
2012-12-13 19:03:25 +08:00
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
class DecrypterBase : IDecrypter {
|
|
|
|
|
protected static readonly byte[] ilpPublicKeyToken = new byte[8] { 0x20, 0x12, 0xD3, 0xC0, 0x55, 0x1F, 0xE0, 0x3D };
|
|
|
|
|
|
|
|
|
|
protected string ilpVersion;
|
|
|
|
|
protected int startOffset;
|
|
|
|
|
protected byte[] decryptionKey;
|
|
|
|
|
protected int decryptionKeyMod;
|
|
|
|
|
|
|
|
|
|
public string Version {
|
|
|
|
|
get { return ilpVersion; }
|
|
|
|
|
}
|
|
|
|
|
|
2013-01-19 20:03:57 +08:00
|
|
|
|
protected void SetVersion(Version version) {
|
2012-12-13 19:03:25 +08:00
|
|
|
|
if (version.Revision == 0)
|
|
|
|
|
ilpVersion = string.Format("{0}.{1}.{2}", version.Major, version.Minor, version.Build);
|
|
|
|
|
else
|
|
|
|
|
ilpVersion = version.ToString();
|
|
|
|
|
}
|
|
|
|
|
|
2013-01-19 20:03:57 +08:00
|
|
|
|
public virtual byte[] GetMethodsData(EmbeddedResource resource) {
|
2012-12-13 19:03:25 +08:00
|
|
|
|
var reader = resource.Data;
|
|
|
|
|
reader.Position = startOffset;
|
|
|
|
|
if ((reader.ReadInt32() & 1) != 0)
|
2013-01-19 20:03:57 +08:00
|
|
|
|
return Decompress(reader);
|
2012-12-13 19:03:25 +08:00
|
|
|
|
else
|
|
|
|
|
return reader.ReadRemainingBytes();
|
|
|
|
|
}
|
|
|
|
|
|
2013-01-19 20:03:57 +08:00
|
|
|
|
byte[] Decompress(IBinaryReader reader) {
|
|
|
|
|
return Decompress(reader, decryptionKey, decryptionKeyMod);
|
2012-12-13 19:03:25 +08:00
|
|
|
|
}
|
|
|
|
|
|
2013-01-19 20:03:57 +08:00
|
|
|
|
static void Copy(byte[] src, int srcIndex, byte[] dst, int dstIndex, int size) {
|
2012-12-13 19:03:25 +08:00
|
|
|
|
for (int i = 0; i < size; i++)
|
|
|
|
|
dst[dstIndex++] = src[srcIndex++];
|
|
|
|
|
}
|
|
|
|
|
|
2013-01-19 20:03:57 +08:00
|
|
|
|
static byte[] Decompress(IBinaryReader reader, byte[] key, int keyMod) {
|
|
|
|
|
return Decompress(new byte[reader.Read7BitEncodedUInt32()], reader, key, keyMod);
|
2012-12-13 19:03:25 +08:00
|
|
|
|
}
|
|
|
|
|
|
2013-01-19 20:03:57 +08:00
|
|
|
|
protected static byte[] Decompress(byte[] decrypted, IBinaryReader reader, byte[] key, int keyMod) {
|
2012-12-13 19:03:25 +08:00
|
|
|
|
int destIndex = 0;
|
|
|
|
|
while (reader.Position < reader.Length) {
|
|
|
|
|
if (destIndex >= decrypted.Length)
|
|
|
|
|
break;
|
|
|
|
|
byte flags = reader.ReadByte();
|
|
|
|
|
for (int mask = 1; mask != 0x100; mask <<= 1) {
|
|
|
|
|
if (reader.Position >= reader.Length)
|
|
|
|
|
break;
|
|
|
|
|
if (destIndex >= decrypted.Length)
|
|
|
|
|
break;
|
|
|
|
|
if ((flags & mask) != 0) {
|
|
|
|
|
int displ = (int)reader.Read7BitEncodedUInt32();
|
|
|
|
|
int size = (int)reader.Read7BitEncodedUInt32();
|
2013-01-19 20:03:57 +08:00
|
|
|
|
Copy(decrypted, destIndex - displ, decrypted, destIndex, size);
|
2012-12-13 19:03:25 +08:00
|
|
|
|
destIndex += size;
|
|
|
|
|
}
|
|
|
|
|
else {
|
|
|
|
|
byte b = reader.ReadByte();
|
|
|
|
|
if (key != null)
|
|
|
|
|
b ^= key[destIndex % keyMod];
|
|
|
|
|
decrypted[destIndex++] = b;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
return decrypted;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// 1.0.0 - 1.0.4
|
|
|
|
|
class DecrypterV100 : DecrypterBase {
|
|
|
|
|
// This is the first four bytes of ILProtector's public key token
|
|
|
|
|
const uint RESOURCE_MAGIC = 0xC0D31220;
|
|
|
|
|
|
|
|
|
|
DecrypterV100(Version ilpVersion) {
|
2013-01-19 20:03:57 +08:00
|
|
|
|
SetVersion(ilpVersion);
|
2012-12-13 19:03:25 +08:00
|
|
|
|
this.startOffset = 8;
|
|
|
|
|
this.decryptionKey = ilpPublicKeyToken;
|
|
|
|
|
this.decryptionKeyMod = 8;
|
|
|
|
|
}
|
|
|
|
|
|
2013-01-19 20:03:57 +08:00
|
|
|
|
public static DecrypterV100 Create(IBinaryReader reader) {
|
2012-12-13 19:03:25 +08:00
|
|
|
|
reader.Position = 0;
|
|
|
|
|
if (reader.Length < 12)
|
|
|
|
|
return null;
|
|
|
|
|
if (reader.ReadUInt32() != RESOURCE_MAGIC)
|
|
|
|
|
return null;
|
|
|
|
|
|
|
|
|
|
return new DecrypterV100(new Version(reader.ReadByte(), reader.ReadByte(), reader.ReadByte(), reader.ReadByte()));
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// 1.0.5
|
|
|
|
|
class DecrypterV105 : DecrypterBase {
|
|
|
|
|
DecrypterV105(Version ilpVersion, byte[] key) {
|
2013-01-19 20:03:57 +08:00
|
|
|
|
SetVersion(ilpVersion);
|
2012-12-13 19:03:25 +08:00
|
|
|
|
this.startOffset = 0xA0;
|
|
|
|
|
this.decryptionKey = key;
|
|
|
|
|
this.decryptionKeyMod = key.Length - 1;
|
|
|
|
|
}
|
|
|
|
|
|
2013-01-19 20:03:57 +08:00
|
|
|
|
public static DecrypterV105 Create(IBinaryReader reader) {
|
2012-12-13 19:03:25 +08:00
|
|
|
|
reader.Position = 0;
|
|
|
|
|
if (reader.Length < 0xA4)
|
|
|
|
|
return null;
|
|
|
|
|
var key = reader.ReadBytes(0x94);
|
2013-01-19 20:03:57 +08:00
|
|
|
|
if (!Utils.Compare(reader.ReadBytes(8), ilpPublicKeyToken))
|
2012-12-13 19:03:25 +08:00
|
|
|
|
return null;
|
|
|
|
|
return new DecrypterV105(new Version(reader.ReadByte(), reader.ReadByte(), reader.ReadByte(), reader.ReadByte()), key);
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
2013-11-17 09:04:11 +08:00
|
|
|
|
// 1.0.6.x
|
2012-12-13 19:03:25 +08:00
|
|
|
|
class DecrypterV106 : DecrypterBase {
|
|
|
|
|
byte[] decryptionKey6;
|
|
|
|
|
byte[] decryptionKey7;
|
|
|
|
|
|
|
|
|
|
DecrypterV106(byte[] key0, byte[] key6, byte[] key7, int startOffset) {
|
2013-11-17 09:04:11 +08:00
|
|
|
|
this.ilpVersion = "1.0.6.x";
|
2012-12-13 19:03:25 +08:00
|
|
|
|
this.startOffset = startOffset;
|
|
|
|
|
this.decryptionKey = key0;
|
|
|
|
|
this.decryptionKey6 = key6;
|
|
|
|
|
this.decryptionKey7 = key7;
|
|
|
|
|
this.decryptionKeyMod = key0.Length - 1;
|
|
|
|
|
}
|
|
|
|
|
|
2013-01-19 20:03:57 +08:00
|
|
|
|
public static DecrypterV106 Create(IBinaryReader reader) {
|
2012-12-13 19:03:25 +08:00
|
|
|
|
try {
|
2012-12-13 21:03:31 +08:00
|
|
|
|
int keyXorOffs7 = (ReadByteAt(reader, 0) ^ ReadByteAt(reader, 2)) + 2;
|
|
|
|
|
reader.Position = keyXorOffs7 + (ReadByteAt(reader, 1) ^ ReadByteAt(reader, keyXorOffs7));
|
2012-12-13 19:03:25 +08:00
|
|
|
|
|
|
|
|
|
int sha1DataLen = reader.Read7BitEncodedInt32() + 0x80;
|
2012-12-13 21:03:31 +08:00
|
|
|
|
int keyXorOffs6 = (int)reader.Position;
|
2012-12-13 19:03:25 +08:00
|
|
|
|
int encryptedOffs = (int)reader.Position + sha1DataLen;
|
|
|
|
|
var sha1Data = reader.ReadBytes(sha1DataLen);
|
2013-01-19 20:03:57 +08:00
|
|
|
|
uint crc32 = CRC32.CheckSum(sha1Data);
|
2012-12-13 19:03:25 +08:00
|
|
|
|
|
|
|
|
|
reader.Position = reader.Length - 0x18;
|
|
|
|
|
uint origCrc32 = reader.ReadUInt32();
|
|
|
|
|
if (crc32 != origCrc32)
|
|
|
|
|
return null;
|
|
|
|
|
|
2013-01-19 20:03:57 +08:00
|
|
|
|
var key0 = DeobUtils.Sha1Sum(sha1Data); // 1.0.6.0
|
|
|
|
|
var key6 = GetKey(reader, key0, keyXorOffs6); // 1.0.6.6
|
2013-11-17 09:04:11 +08:00
|
|
|
|
var key7 = GetKey(reader, key0, keyXorOffs7); // 1.0.6.7
|
2012-12-13 19:03:25 +08:00
|
|
|
|
return new DecrypterV106(key0, key6, key7, encryptedOffs);
|
|
|
|
|
}
|
|
|
|
|
catch (IOException) {
|
|
|
|
|
return null;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
2013-01-19 20:03:57 +08:00
|
|
|
|
static byte[] GetKey(IBinaryReader reader, byte[] sha1Sum, int offs) {
|
2012-12-13 19:03:25 +08:00
|
|
|
|
var key = (byte[])sha1Sum.Clone();
|
|
|
|
|
reader.Position = offs;
|
2012-12-13 21:03:31 +08:00
|
|
|
|
for (int i = 0; i < key.Length; i++)
|
|
|
|
|
key[i] ^= reader.ReadByte();
|
2012-12-13 19:03:25 +08:00
|
|
|
|
return key;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static byte ReadByteAt(IBinaryReader reader, int offs) {
|
|
|
|
|
reader.Position = offs;
|
2012-12-13 21:03:31 +08:00
|
|
|
|
return reader.ReadByte();
|
2012-12-13 19:03:25 +08:00
|
|
|
|
}
|
|
|
|
|
|
2013-01-19 20:03:57 +08:00
|
|
|
|
public override byte[] GetMethodsData(EmbeddedResource resource) {
|
2012-12-13 19:03:25 +08:00
|
|
|
|
var reader = resource.Data;
|
2012-12-13 21:03:31 +08:00
|
|
|
|
reader.Position = startOffset;
|
|
|
|
|
var decrypted = new byte[reader.Read7BitEncodedUInt32()];
|
|
|
|
|
uint origCrc32 = reader.ReadUInt32();
|
|
|
|
|
long pos = reader.Position;
|
|
|
|
|
|
2012-12-13 19:03:25 +08:00
|
|
|
|
var keys = new byte[][] { decryptionKey, decryptionKey6, decryptionKey7 };
|
|
|
|
|
foreach (var key in keys) {
|
|
|
|
|
try {
|
2012-12-13 21:03:31 +08:00
|
|
|
|
reader.Position = pos;
|
2013-01-19 20:03:57 +08:00
|
|
|
|
Decompress(decrypted, reader, key, decryptionKeyMod);
|
|
|
|
|
uint crc32 = CRC32.CheckSum(decrypted);
|
2012-12-13 19:03:25 +08:00
|
|
|
|
if (crc32 == origCrc32)
|
|
|
|
|
return decrypted;
|
|
|
|
|
}
|
|
|
|
|
catch (OutOfMemoryException) {
|
|
|
|
|
}
|
|
|
|
|
catch (IOException) {
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
throw new ApplicationException("Could not decrypt methods data");
|
|
|
|
|
}
|
|
|
|
|
}
|
2012-06-04 10:20:43 +08:00
|
|
|
|
|
2012-12-13 19:03:25 +08:00
|
|
|
|
public string Version {
|
|
|
|
|
get { return decrypter == null ? null : decrypter.Version; }
|
2012-06-04 10:20:43 +08:00
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
public bool Detected {
|
|
|
|
|
get { return methodsResource != null; }
|
|
|
|
|
}
|
|
|
|
|
|
2013-10-26 23:25:58 +08:00
|
|
|
|
public StaticMethodsDecrypter(ModuleDefMD module, MainType mainType)
|
|
|
|
|
: base(module, mainType) {
|
2012-06-04 10:20:43 +08:00
|
|
|
|
}
|
|
|
|
|
|
2013-01-19 20:03:57 +08:00
|
|
|
|
public void Find() {
|
2012-06-04 10:20:43 +08:00
|
|
|
|
foreach (var tmp in module.Resources) {
|
|
|
|
|
var resource = tmp as EmbeddedResource;
|
|
|
|
|
if (resource == null)
|
|
|
|
|
continue;
|
2012-11-18 15:13:51 +08:00
|
|
|
|
var reader = resource.Data;
|
2012-11-20 08:15:27 +08:00
|
|
|
|
reader.Position = 0;
|
2013-01-19 20:03:57 +08:00
|
|
|
|
if (!CheckResourceV100(reader) &&
|
|
|
|
|
!CheckResourceV105(reader) &&
|
|
|
|
|
!CheckResourceV106(reader))
|
2012-06-04 10:20:43 +08:00
|
|
|
|
continue;
|
|
|
|
|
|
|
|
|
|
methodsResource = resource;
|
|
|
|
|
break;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
2013-01-19 20:03:57 +08:00
|
|
|
|
bool CheckResourceV100(IBinaryReader reader) {
|
|
|
|
|
decrypter = DecrypterV100.Create(reader);
|
2012-12-13 19:03:25 +08:00
|
|
|
|
return decrypter != null;
|
|
|
|
|
}
|
|
|
|
|
|
2013-01-19 20:03:57 +08:00
|
|
|
|
bool CheckResourceV105(IBinaryReader reader) {
|
|
|
|
|
decrypter = DecrypterV105.Create(reader);
|
2012-12-13 19:03:25 +08:00
|
|
|
|
return decrypter != null;
|
|
|
|
|
}
|
|
|
|
|
|
2013-01-19 20:03:57 +08:00
|
|
|
|
bool CheckResourceV106(IBinaryReader reader) {
|
|
|
|
|
decrypter = DecrypterV106.Create(reader);
|
2012-12-13 19:03:25 +08:00
|
|
|
|
return decrypter != null;
|
2012-07-01 10:21:52 +08:00
|
|
|
|
}
|
|
|
|
|
|
2013-10-26 23:25:58 +08:00
|
|
|
|
protected override void DecryptInternal() {
|
2012-12-13 19:03:25 +08:00
|
|
|
|
if (methodsResource == null || decrypter == null)
|
2012-06-04 10:20:43 +08:00
|
|
|
|
return;
|
|
|
|
|
|
2013-01-19 20:03:57 +08:00
|
|
|
|
foreach (var info in ReadMethodInfos(decrypter.GetMethodsData(methodsResource)))
|
2012-06-04 10:20:43 +08:00
|
|
|
|
methodInfos[info.id] = info;
|
|
|
|
|
}
|
|
|
|
|
|
2013-10-26 23:25:58 +08:00
|
|
|
|
static DecryptedMethodInfo[] ReadMethodInfos(byte[] data) {
|
|
|
|
|
var toOffset = new Dictionary<DecryptedMethodInfo, int>();
|
2012-11-18 15:13:51 +08:00
|
|
|
|
var reader = MemoryImageStream.Create(data);
|
|
|
|
|
int numMethods = (int)reader.Read7BitEncodedUInt32();
|
|
|
|
|
int totalCodeSize = (int)reader.Read7BitEncodedUInt32();
|
2013-10-26 23:25:58 +08:00
|
|
|
|
var methodInfos = new DecryptedMethodInfo[numMethods];
|
2012-06-04 10:20:43 +08:00
|
|
|
|
int offset = 0;
|
|
|
|
|
for (int i = 0; i < numMethods; i++) {
|
2012-11-18 15:13:51 +08:00
|
|
|
|
int id = (int)reader.Read7BitEncodedUInt32();
|
|
|
|
|
int size = (int)reader.Read7BitEncodedUInt32();
|
2013-10-26 23:25:58 +08:00
|
|
|
|
var info = new DecryptedMethodInfo(id, size);
|
|
|
|
|
methodInfos[i] = info;
|
|
|
|
|
toOffset[info] = offset;
|
2012-06-04 10:20:43 +08:00
|
|
|
|
offset += size;
|
|
|
|
|
}
|
2012-11-18 15:13:51 +08:00
|
|
|
|
long dataOffset = reader.Position;
|
2012-06-04 10:20:43 +08:00
|
|
|
|
foreach (var info in methodInfos) {
|
2013-10-26 23:25:58 +08:00
|
|
|
|
reader.Position = dataOffset + toOffset[info];
|
2012-11-18 15:13:51 +08:00
|
|
|
|
reader.Read(info.data, 0, info.data.Length);
|
2012-06-04 10:20:43 +08:00
|
|
|
|
}
|
|
|
|
|
return methodInfos;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|