2012-01-08 03:27:07 +08:00
|
|
|
|
/*
|
2012-01-10 06:04:52 +08:00
|
|
|
|
Copyright (C) 2011-2012 de4dot@gmail.com
|
2012-01-08 03:27:07 +08:00
|
|
|
|
|
|
|
|
|
This file is part of de4dot.
|
|
|
|
|
|
|
|
|
|
de4dot is free software: you can redistribute it and/or modify
|
|
|
|
|
it under the terms of the GNU General Public License as published by
|
|
|
|
|
the Free Software Foundation, either version 3 of the License, or
|
|
|
|
|
(at your option) any later version.
|
|
|
|
|
|
|
|
|
|
de4dot is distributed in the hope that it will be useful,
|
|
|
|
|
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
|
GNU General Public License for more details.
|
|
|
|
|
|
|
|
|
|
You should have received a copy of the GNU General Public License
|
|
|
|
|
along with de4dot. If not, see <http://www.gnu.org/licenses/>.
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
using System;
|
|
|
|
|
using System.Collections.Generic;
|
2012-11-02 22:57:11 +08:00
|
|
|
|
using dot10.DotNet;
|
|
|
|
|
using dot10.DotNet.Emit;
|
2012-01-08 03:27:07 +08:00
|
|
|
|
using de4dot.blocks;
|
|
|
|
|
|
|
|
|
|
namespace de4dot.code.deobfuscators.Babel_NET {
|
2012-05-29 17:13:39 +08:00
|
|
|
|
class ProxyCallFixer : ProxyCallFixer2 {
|
2012-11-22 16:14:51 +08:00
|
|
|
|
MethodDefAndDeclaringTypeDict<ProxyCreatorType> methodToType = new MethodDefAndDeclaringTypeDict<ProxyCreatorType>();
|
2012-01-08 03:27:07 +08:00
|
|
|
|
|
2012-11-08 14:06:46 +08:00
|
|
|
|
public ProxyCallFixer(ModuleDefMD module)
|
2012-01-08 03:27:07 +08:00
|
|
|
|
: base(module) {
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
enum ProxyCreatorType {
|
|
|
|
|
None,
|
|
|
|
|
CallOrCallvirt,
|
|
|
|
|
Newobj,
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
class Context {
|
2012-11-08 14:06:46 +08:00
|
|
|
|
public ITypeDefOrRef delegateType;
|
2012-01-08 03:27:07 +08:00
|
|
|
|
public int methodToken;
|
|
|
|
|
public int declaringTypeToken;
|
|
|
|
|
public ProxyCreatorType proxyCreatorType;
|
2012-11-08 14:06:46 +08:00
|
|
|
|
public Context(ITypeDefOrRef delegateType, int methodToken, int declaringTypeToken, ProxyCreatorType proxyCreatorType) {
|
2012-01-08 03:27:07 +08:00
|
|
|
|
this.delegateType = delegateType;
|
|
|
|
|
this.methodToken = methodToken;
|
|
|
|
|
this.declaringTypeToken = declaringTypeToken;
|
|
|
|
|
this.proxyCreatorType = proxyCreatorType;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
2012-01-14 04:30:49 +08:00
|
|
|
|
protected override bool ProxyCallIsObfuscated {
|
|
|
|
|
get { return true; }
|
|
|
|
|
}
|
|
|
|
|
|
2012-11-02 22:57:11 +08:00
|
|
|
|
protected override object checkCctor(TypeDef type, MethodDef cctor) {
|
2012-01-08 03:27:07 +08:00
|
|
|
|
var instructions = cctor.Body.Instructions;
|
|
|
|
|
for (int i = 0; i < instructions.Count; i++) {
|
2012-11-08 14:06:46 +08:00
|
|
|
|
ITypeDefOrRef delegateType;
|
|
|
|
|
IField delegateField;
|
|
|
|
|
IMethod createMethod;
|
2012-01-08 03:27:07 +08:00
|
|
|
|
int methodToken, declaringTypeToken;
|
|
|
|
|
var instrs = DotNetUtils.getInstructions(instructions, i, OpCodes.Ldtoken, OpCodes.Ldc_I4, OpCodes.Ldc_I4, OpCodes.Ldtoken, OpCodes.Call);
|
|
|
|
|
if (instrs != null) {
|
2012-11-08 14:06:46 +08:00
|
|
|
|
delegateType = instrs[0].Operand as ITypeDefOrRef;
|
|
|
|
|
methodToken = instrs[1].GetLdcI4Value();
|
|
|
|
|
declaringTypeToken = instrs[2].GetLdcI4Value();
|
|
|
|
|
delegateField = instrs[3].Operand as IField;
|
|
|
|
|
createMethod = instrs[4].Operand as IMethod;
|
2012-01-08 03:27:07 +08:00
|
|
|
|
}
|
|
|
|
|
else if ((instrs = DotNetUtils.getInstructions(instructions, i, OpCodes.Ldtoken, OpCodes.Ldc_I4, OpCodes.Ldtoken, OpCodes.Call)) != null) {
|
2012-11-08 14:06:46 +08:00
|
|
|
|
delegateType = instrs[0].Operand as ITypeDefOrRef;
|
|
|
|
|
methodToken = instrs[1].GetLdcI4Value();
|
2012-01-08 03:27:07 +08:00
|
|
|
|
declaringTypeToken = -1;
|
2012-11-08 14:06:46 +08:00
|
|
|
|
delegateField = instrs[2].Operand as IField;
|
|
|
|
|
createMethod = instrs[3].Operand as IMethod;
|
2012-01-08 03:27:07 +08:00
|
|
|
|
}
|
|
|
|
|
else
|
|
|
|
|
continue;
|
|
|
|
|
|
|
|
|
|
if (delegateType == null)
|
|
|
|
|
continue;
|
|
|
|
|
if (delegateField == null)
|
|
|
|
|
continue;
|
|
|
|
|
if (createMethod == null)
|
|
|
|
|
continue;
|
|
|
|
|
var proxyCreatorType = methodToType.find(createMethod);
|
|
|
|
|
if (proxyCreatorType == ProxyCreatorType.None)
|
|
|
|
|
continue;
|
|
|
|
|
|
|
|
|
|
return new Context(delegateType, methodToken, declaringTypeToken, proxyCreatorType);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
return null;
|
|
|
|
|
}
|
|
|
|
|
|
2012-11-08 14:06:46 +08:00
|
|
|
|
protected override void getCallInfo(object context, FieldDef field, out IMethod calledMethod, out OpCode callOpcode) {
|
2012-01-08 03:27:07 +08:00
|
|
|
|
var ctx = (Context)context;
|
|
|
|
|
|
|
|
|
|
switch (ctx.proxyCreatorType) {
|
|
|
|
|
case ProxyCreatorType.CallOrCallvirt:
|
|
|
|
|
callOpcode = field.IsAssembly ? OpCodes.Callvirt : OpCodes.Call;
|
|
|
|
|
break;
|
|
|
|
|
case ProxyCreatorType.Newobj:
|
|
|
|
|
callOpcode = OpCodes.Newobj;
|
|
|
|
|
break;
|
|
|
|
|
default:
|
|
|
|
|
throw new ApplicationException(string.Format("Invalid proxy creator type: {0}", ctx.proxyCreatorType));
|
|
|
|
|
}
|
|
|
|
|
|
2012-11-08 14:06:46 +08:00
|
|
|
|
var method = module.ResolveToken(ctx.methodToken) as IMethod;
|
|
|
|
|
if (method.MethodSig == null)
|
|
|
|
|
method = null;
|
|
|
|
|
calledMethod = method;
|
2012-01-08 03:27:07 +08:00
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
public void findDelegateCreator() {
|
|
|
|
|
var requiredTypes = new string[] {
|
|
|
|
|
"System.ModuleHandle",
|
|
|
|
|
};
|
|
|
|
|
foreach (var type in module.Types) {
|
|
|
|
|
if (!new FieldTypes(type).exactly(requiredTypes))
|
|
|
|
|
continue;
|
|
|
|
|
|
|
|
|
|
foreach (var method in type.Methods) {
|
|
|
|
|
if (!method.IsStatic || method.Body == null)
|
|
|
|
|
continue;
|
|
|
|
|
if (!DotNetUtils.isMethod(method, "System.Void", "(System.RuntimeTypeHandle,System.Int32,System.RuntimeFieldHandle)") &&
|
|
|
|
|
!DotNetUtils.isMethod(method, "System.Void", "(System.RuntimeTypeHandle,System.Int32,System.Int32,System.RuntimeFieldHandle)"))
|
|
|
|
|
continue;
|
|
|
|
|
var creatorType = getProxyCreatorType(method);
|
|
|
|
|
if (creatorType == ProxyCreatorType.None)
|
|
|
|
|
continue;
|
|
|
|
|
|
|
|
|
|
methodToType.add(method, creatorType);
|
|
|
|
|
setDelegateCreatorMethod(method);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if (methodToType.Count == 0)
|
|
|
|
|
continue;
|
|
|
|
|
|
|
|
|
|
return;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
2012-11-02 22:57:11 +08:00
|
|
|
|
ProxyCreatorType getProxyCreatorType(MethodDef methodToCheck) {
|
2012-03-18 03:36:41 +08:00
|
|
|
|
foreach (var calledMethod in DotNetUtils.getCalledMethods(module, methodToCheck)) {
|
2012-01-08 03:27:07 +08:00
|
|
|
|
if (!calledMethod.IsStatic || calledMethod.Body == null)
|
|
|
|
|
continue;
|
2012-11-08 14:06:46 +08:00
|
|
|
|
if (!new SigComparer().Equals(methodToCheck.DeclaringType, calledMethod.DeclaringType))
|
2012-01-08 03:27:07 +08:00
|
|
|
|
continue;
|
|
|
|
|
if (DotNetUtils.isMethod(calledMethod, "System.Void", "(System.Reflection.FieldInfo,System.Type,System.Reflection.MethodInfo)"))
|
|
|
|
|
return ProxyCreatorType.CallOrCallvirt;
|
|
|
|
|
if (DotNetUtils.isMethod(calledMethod, "System.Void", "(System.Reflection.FieldInfo,System.Type,System.Reflection.ConstructorInfo)"))
|
|
|
|
|
return ProxyCreatorType.Newobj;
|
|
|
|
|
}
|
|
|
|
|
return ProxyCreatorType.None;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|