2012-01-23 02:58:31 +08:00
|
|
|
|
/*
|
2014-03-12 05:15:43 +08:00
|
|
|
|
Copyright (C) 2011-2014 de4dot@gmail.com
|
2012-01-23 02:58:31 +08:00
|
|
|
|
|
|
|
|
|
This file is part of de4dot.
|
|
|
|
|
|
|
|
|
|
de4dot is free software: you can redistribute it and/or modify
|
|
|
|
|
it under the terms of the GNU General Public License as published by
|
|
|
|
|
the Free Software Foundation, either version 3 of the License, or
|
|
|
|
|
(at your option) any later version.
|
|
|
|
|
|
|
|
|
|
de4dot is distributed in the hope that it will be useful,
|
|
|
|
|
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
|
GNU General Public License for more details.
|
|
|
|
|
|
|
|
|
|
You should have received a copy of the GNU General Public License
|
|
|
|
|
along with de4dot. If not, see <http://www.gnu.org/licenses/>.
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
using System;
|
2012-03-14 03:28:01 +08:00
|
|
|
|
using System.Collections.Generic;
|
2012-12-20 09:06:09 +08:00
|
|
|
|
using dnlib.DotNet;
|
|
|
|
|
using dnlib.DotNet.Emit;
|
2012-01-23 02:58:31 +08:00
|
|
|
|
using de4dot.blocks;
|
|
|
|
|
|
|
|
|
|
namespace de4dot.code.deobfuscators.DeepSea {
|
|
|
|
|
abstract class ResolverBase {
|
2012-11-09 07:21:45 +08:00
|
|
|
|
protected ModuleDefMD module;
|
2012-01-24 10:22:59 +08:00
|
|
|
|
protected ISimpleDeobfuscator simpleDeobfuscator;
|
|
|
|
|
protected IDeobfuscator deob;
|
2012-11-02 22:57:11 +08:00
|
|
|
|
protected MethodDef initMethod;
|
|
|
|
|
protected MethodDef resolveHandler;
|
2012-03-17 21:50:56 +08:00
|
|
|
|
protected FrameworkType frameworkType;
|
2012-01-23 02:58:31 +08:00
|
|
|
|
|
2012-11-02 22:57:11 +08:00
|
|
|
|
public MethodDef InitMethod {
|
2012-01-23 02:58:31 +08:00
|
|
|
|
get { return initMethod; }
|
|
|
|
|
}
|
|
|
|
|
|
2012-11-02 22:57:11 +08:00
|
|
|
|
public MethodDef HandlerMethod {
|
2012-01-23 02:58:31 +08:00
|
|
|
|
get { return resolveHandler; }
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
public bool Detected {
|
|
|
|
|
get { return initMethod != null; }
|
|
|
|
|
}
|
|
|
|
|
|
2012-11-09 07:21:45 +08:00
|
|
|
|
public ResolverBase(ModuleDefMD module, ISimpleDeobfuscator simpleDeobfuscator, IDeobfuscator deob) {
|
2012-01-23 02:58:31 +08:00
|
|
|
|
this.module = module;
|
2013-01-19 20:03:57 +08:00
|
|
|
|
this.frameworkType = DotNetUtils.GetFrameworkType(module);
|
2012-01-24 10:22:59 +08:00
|
|
|
|
this.simpleDeobfuscator = simpleDeobfuscator;
|
|
|
|
|
this.deob = deob;
|
2012-01-23 02:58:31 +08:00
|
|
|
|
}
|
|
|
|
|
|
2013-01-19 20:03:57 +08:00
|
|
|
|
public void Find() {
|
|
|
|
|
if (CheckCalledMethods(DotNetUtils.GetModuleTypeCctor(module)))
|
2012-01-23 02:58:31 +08:00
|
|
|
|
return;
|
2013-01-19 20:03:57 +08:00
|
|
|
|
if (CheckCalledMethods(module.EntryPoint))
|
2012-01-23 02:58:31 +08:00
|
|
|
|
return;
|
|
|
|
|
}
|
|
|
|
|
|
2013-01-19 20:03:57 +08:00
|
|
|
|
bool CheckCalledMethods(MethodDef checkMethod) {
|
2012-01-23 02:58:31 +08:00
|
|
|
|
if (checkMethod == null || checkMethod.Body == null)
|
|
|
|
|
return false;
|
|
|
|
|
|
2013-01-19 20:03:57 +08:00
|
|
|
|
foreach (var method in DotNetUtils.GetCalledMethods(module, checkMethod)) {
|
2012-01-23 02:58:31 +08:00
|
|
|
|
if (method.Name == ".cctor" || method.Name == ".ctor")
|
|
|
|
|
continue;
|
2013-01-19 20:03:57 +08:00
|
|
|
|
if (!method.IsStatic || !DotNetUtils.IsMethod(method, "System.Void", "()"))
|
2012-01-23 02:58:31 +08:00
|
|
|
|
continue;
|
|
|
|
|
|
2013-01-19 20:03:57 +08:00
|
|
|
|
if (CheckResolverInitMethod(method))
|
2012-01-23 02:58:31 +08:00
|
|
|
|
return true;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
return false;
|
|
|
|
|
}
|
|
|
|
|
|
2013-01-19 20:03:57 +08:00
|
|
|
|
bool CheckResolverInitMethod(MethodDef resolverInitMethod) {
|
2012-01-23 02:58:31 +08:00
|
|
|
|
if (resolverInitMethod == null || resolverInitMethod.Body == null)
|
|
|
|
|
return false;
|
2012-03-17 21:50:56 +08:00
|
|
|
|
if (resolverInitMethod.Body.ExceptionHandlers.Count != 1)
|
|
|
|
|
return false;
|
|
|
|
|
|
|
|
|
|
switch (frameworkType) {
|
|
|
|
|
case FrameworkType.Silverlight:
|
2013-01-19 20:03:57 +08:00
|
|
|
|
return CheckResolverInitMethodSilverlight(resolverInitMethod);
|
2012-03-17 21:50:56 +08:00
|
|
|
|
default:
|
2013-01-19 20:03:57 +08:00
|
|
|
|
return CheckResolverInitMethodDesktop(resolverInitMethod);
|
2012-03-17 21:50:56 +08:00
|
|
|
|
}
|
|
|
|
|
}
|
2012-01-23 02:58:31 +08:00
|
|
|
|
|
2013-01-19 20:03:57 +08:00
|
|
|
|
bool CheckResolverInitMethodDesktop(MethodDef resolverInitMethod) {
|
|
|
|
|
simpleDeobfuscator.Deobfuscate(resolverInitMethod);
|
|
|
|
|
if (!CheckResolverInitMethodInternal(resolverInitMethod))
|
2012-01-24 11:44:23 +08:00
|
|
|
|
return false;
|
|
|
|
|
|
2013-01-19 20:03:57 +08:00
|
|
|
|
foreach (var resolveHandlerMethod in GetLdftnMethods(resolverInitMethod)) {
|
|
|
|
|
if (!CheckHandlerMethodDesktop(resolveHandlerMethod))
|
2012-03-14 03:28:01 +08:00
|
|
|
|
continue;
|
2012-01-23 02:58:31 +08:00
|
|
|
|
|
2012-03-14 03:28:01 +08:00
|
|
|
|
initMethod = resolverInitMethod;
|
|
|
|
|
resolveHandler = resolveHandlerMethod;
|
|
|
|
|
return true;
|
|
|
|
|
}
|
2012-01-23 02:58:31 +08:00
|
|
|
|
|
2012-03-14 03:28:01 +08:00
|
|
|
|
return false;
|
2012-01-23 02:58:31 +08:00
|
|
|
|
}
|
|
|
|
|
|
2013-01-19 20:03:57 +08:00
|
|
|
|
protected virtual bool CheckResolverInitMethodSilverlight(MethodDef resolverInitMethod) {
|
2012-03-17 21:50:56 +08:00
|
|
|
|
return false;
|
|
|
|
|
}
|
|
|
|
|
|
2013-01-19 20:03:57 +08:00
|
|
|
|
protected abstract bool CheckResolverInitMethodInternal(MethodDef resolverInitMethod);
|
2012-01-24 11:44:23 +08:00
|
|
|
|
|
2013-01-19 20:03:57 +08:00
|
|
|
|
IEnumerable<MethodDef> GetLdftnMethods(MethodDef method) {
|
2012-11-02 22:57:11 +08:00
|
|
|
|
var list = new List<MethodDef>();
|
2012-01-23 02:58:31 +08:00
|
|
|
|
foreach (var instr in method.Body.Instructions) {
|
|
|
|
|
if (instr.OpCode.Code != Code.Ldftn)
|
|
|
|
|
continue;
|
2012-11-02 22:57:11 +08:00
|
|
|
|
var loadedMethod = instr.Operand as MethodDef;
|
2012-01-23 02:58:31 +08:00
|
|
|
|
if (loadedMethod != null)
|
2012-03-14 03:28:01 +08:00
|
|
|
|
list.Add(loadedMethod);
|
2012-01-23 02:58:31 +08:00
|
|
|
|
}
|
2012-03-14 03:28:01 +08:00
|
|
|
|
return list;
|
2012-01-23 02:58:31 +08:00
|
|
|
|
}
|
|
|
|
|
|
2013-01-19 20:03:57 +08:00
|
|
|
|
bool CheckHandlerMethodDesktop(MethodDef handler) {
|
2012-01-24 11:24:44 +08:00
|
|
|
|
if (handler == null || handler.Body == null || !handler.IsStatic)
|
2012-01-23 02:58:31 +08:00
|
|
|
|
return false;
|
2013-01-19 20:03:57 +08:00
|
|
|
|
if (!DotNetUtils.IsMethod(handler, "System.Reflection.Assembly", "(System.Object,System.ResolveEventArgs)"))
|
2012-01-23 02:58:31 +08:00
|
|
|
|
return false;
|
2013-01-19 20:03:57 +08:00
|
|
|
|
return CheckHandlerMethodDesktopInternal(handler);
|
2012-01-23 02:58:31 +08:00
|
|
|
|
}
|
|
|
|
|
|
2013-01-19 20:03:57 +08:00
|
|
|
|
protected abstract bool CheckHandlerMethodDesktopInternal(MethodDef handler);
|
2012-01-23 02:58:31 +08:00
|
|
|
|
|
2012-03-17 21:05:54 +08:00
|
|
|
|
// 3.0.3.41 - 3.0.4.44
|
2013-01-19 20:03:57 +08:00
|
|
|
|
protected static byte[] DecryptResourceV3Old(EmbeddedResource resource) {
|
|
|
|
|
return DecryptResourceV3Old(resource.GetResourceData());
|
2012-03-17 21:05:54 +08:00
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// 3.0.3.41 - 3.0.4.44
|
2013-01-19 20:03:57 +08:00
|
|
|
|
protected static byte[] DecryptResourceV3Old(byte[] data) {
|
|
|
|
|
return DecryptResource(data, 0, data.Length, 0);
|
2012-03-17 21:05:54 +08:00
|
|
|
|
}
|
2012-05-12 01:38:31 +08:00
|
|
|
|
|
2013-01-19 20:03:57 +08:00
|
|
|
|
protected static byte[] DecryptResourceV41SL(EmbeddedResource resource) {
|
2012-05-12 01:38:31 +08:00
|
|
|
|
var data = resource.GetResourceData();
|
|
|
|
|
byte k = data[0];
|
|
|
|
|
for (int i = 0; i < data.Length - 1; i++)
|
|
|
|
|
data[i + 1] ^= (byte)((k << (i & 5)) + i);
|
2013-01-19 20:03:57 +08:00
|
|
|
|
return InflateIfNeeded(data, 1, data.Length - 1);
|
2012-05-12 01:38:31 +08:00
|
|
|
|
}
|
2012-03-17 21:05:54 +08:00
|
|
|
|
|
2013-01-19 20:03:57 +08:00
|
|
|
|
protected static byte[] DecryptResourceV3(EmbeddedResource resource) {
|
|
|
|
|
return DecryptResourceV3(resource.GetResourceData());
|
2012-01-24 10:22:59 +08:00
|
|
|
|
}
|
|
|
|
|
|
2013-01-19 20:03:57 +08:00
|
|
|
|
protected static byte[] DecryptResourceV3(byte[] data) {
|
|
|
|
|
return DecryptResource(data, 1, data.Length - 1, data[0]);
|
2012-01-24 10:22:59 +08:00
|
|
|
|
}
|
|
|
|
|
|
2013-01-19 20:03:57 +08:00
|
|
|
|
protected static byte[] DecryptResourceV4(byte[] data, int magic) {
|
|
|
|
|
return DecryptResource(data, 0, data.Length, magic);
|
2012-01-24 10:22:59 +08:00
|
|
|
|
}
|
|
|
|
|
|
2013-01-19 20:03:57 +08:00
|
|
|
|
protected static byte[] DecryptResource(byte[] data, int start, int len, int magic) {
|
2012-01-24 10:22:59 +08:00
|
|
|
|
for (int i = start; i < start + len; i++)
|
|
|
|
|
data[i] ^= (byte)(i - start + magic);
|
2013-01-19 20:03:57 +08:00
|
|
|
|
return InflateIfNeeded(data, start, len);
|
2012-05-10 04:24:39 +08:00
|
|
|
|
}
|
|
|
|
|
|
2013-01-19 20:03:57 +08:00
|
|
|
|
protected static byte[] InflateIfNeeded(byte[] data) {
|
|
|
|
|
return InflateIfNeeded(data, 0, data.Length);
|
2012-05-10 04:24:39 +08:00
|
|
|
|
}
|
2012-01-23 02:58:31 +08:00
|
|
|
|
|
2013-01-19 20:03:57 +08:00
|
|
|
|
protected static byte[] InflateIfNeeded(byte[] data, int start, int len) {
|
2012-01-24 10:22:59 +08:00
|
|
|
|
if (BitConverter.ToInt16(data, start) != 0x5A4D)
|
2013-01-19 20:03:57 +08:00
|
|
|
|
return DeobUtils.Inflate(data, start, len, true);
|
2012-01-23 02:58:31 +08:00
|
|
|
|
|
2012-01-24 10:22:59 +08:00
|
|
|
|
var data2 = new byte[len];
|
|
|
|
|
Array.Copy(data, start, data2, 0, data2.Length);
|
2012-01-23 02:58:31 +08:00
|
|
|
|
return data2;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|