2011-11-08 17:27:18 +08:00
|
|
|
|
/*
|
2013-01-02 00:03:16 +08:00
|
|
|
|
Copyright (C) 2011-2013 de4dot@gmail.com
|
2011-11-08 17:27:18 +08:00
|
|
|
|
|
|
|
|
|
This file is part of de4dot.
|
|
|
|
|
|
|
|
|
|
de4dot is free software: you can redistribute it and/or modify
|
|
|
|
|
it under the terms of the GNU General Public License as published by
|
|
|
|
|
the Free Software Foundation, either version 3 of the License, or
|
|
|
|
|
(at your option) any later version.
|
|
|
|
|
|
|
|
|
|
de4dot is distributed in the hope that it will be useful,
|
|
|
|
|
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
|
GNU General Public License for more details.
|
|
|
|
|
|
|
|
|
|
You should have received a copy of the GNU General Public License
|
|
|
|
|
along with de4dot. If not, see <http://www.gnu.org/licenses/>.
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
using System;
|
|
|
|
|
using System.Collections.Generic;
|
2012-12-20 09:06:09 +08:00
|
|
|
|
using dnlib.DotNet;
|
|
|
|
|
using dnlib.IO;
|
2011-11-08 17:27:18 +08:00
|
|
|
|
using de4dot.blocks;
|
|
|
|
|
|
2011-12-22 01:55:36 +08:00
|
|
|
|
namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 {
|
2011-11-08 17:27:18 +08:00
|
|
|
|
class ResourceInfo {
|
|
|
|
|
public EmbeddedResource resource;
|
|
|
|
|
public string name;
|
|
|
|
|
|
|
|
|
|
public ResourceInfo(EmbeddedResource resource, string name) {
|
|
|
|
|
this.resource = resource;
|
|
|
|
|
this.name = name;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
public override string ToString() {
|
2013-01-19 20:03:57 +08:00
|
|
|
|
return string.Format("{0} (rsrc: {1})", name, Utils.ToCsharpString(resource.Name));
|
2011-11-08 17:27:18 +08:00
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
class AssemblyResolver {
|
2012-11-18 01:57:36 +08:00
|
|
|
|
ModuleDefMD module;
|
2012-11-02 22:57:11 +08:00
|
|
|
|
TypeDef assemblyResolverType;
|
|
|
|
|
MethodDef assemblyResolverInitMethod;
|
|
|
|
|
MethodDef assemblyResolverMethod;
|
2011-11-08 17:27:18 +08:00
|
|
|
|
|
|
|
|
|
public bool Detected {
|
|
|
|
|
get { return assemblyResolverType != null; }
|
|
|
|
|
}
|
|
|
|
|
|
2012-11-02 22:57:11 +08:00
|
|
|
|
public TypeDef Type {
|
2011-11-08 17:27:18 +08:00
|
|
|
|
get { return assemblyResolverType; }
|
|
|
|
|
}
|
|
|
|
|
|
2012-11-02 22:57:11 +08:00
|
|
|
|
public MethodDef InitMethod {
|
2011-11-08 17:27:18 +08:00
|
|
|
|
get { return assemblyResolverInitMethod; }
|
|
|
|
|
}
|
|
|
|
|
|
2012-11-18 01:57:36 +08:00
|
|
|
|
public AssemblyResolver(ModuleDefMD module) {
|
2011-11-08 17:27:18 +08:00
|
|
|
|
this.module = module;
|
|
|
|
|
}
|
|
|
|
|
|
2012-11-18 01:57:36 +08:00
|
|
|
|
public AssemblyResolver(ModuleDefMD module, AssemblyResolver oldOne) {
|
2011-11-08 17:27:18 +08:00
|
|
|
|
this.module = module;
|
2013-01-19 20:03:57 +08:00
|
|
|
|
this.assemblyResolverType = Lookup(oldOne.assemblyResolverType, "Could not find assembly resolver type");
|
|
|
|
|
this.assemblyResolverMethod = Lookup(oldOne.assemblyResolverMethod, "Could not find assembly resolver method");
|
|
|
|
|
this.assemblyResolverInitMethod = Lookup(oldOne.assemblyResolverInitMethod, "Could not find assembly resolver init method");
|
2011-11-08 17:27:18 +08:00
|
|
|
|
}
|
|
|
|
|
|
2013-01-19 20:03:57 +08:00
|
|
|
|
T Lookup<T>(T def, string errorMessage) where T : class, ICodedToken {
|
|
|
|
|
return DeobUtils.Lookup(module, def, errorMessage);
|
2011-11-08 17:27:18 +08:00
|
|
|
|
}
|
|
|
|
|
|
2013-01-19 20:03:57 +08:00
|
|
|
|
public void Find(ISimpleDeobfuscator simpleDeobfuscator) {
|
|
|
|
|
if (CheckMethod(simpleDeobfuscator, module.EntryPoint))
|
2011-11-08 17:27:18 +08:00
|
|
|
|
return;
|
|
|
|
|
if (module.EntryPoint != null) {
|
2013-01-19 20:03:57 +08:00
|
|
|
|
if (CheckMethod(simpleDeobfuscator, module.EntryPoint.DeclaringType.FindStaticConstructor()))
|
2011-11-08 17:27:18 +08:00
|
|
|
|
return;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
2013-01-19 20:03:57 +08:00
|
|
|
|
bool CheckMethod(ISimpleDeobfuscator simpleDeobfuscator, MethodDef methodToCheck) {
|
2011-11-08 17:27:18 +08:00
|
|
|
|
if (methodToCheck == null)
|
|
|
|
|
return false;
|
|
|
|
|
|
|
|
|
|
var resolverLocals = new string[] {
|
|
|
|
|
"System.Byte[]",
|
|
|
|
|
"System.Reflection.Assembly",
|
|
|
|
|
"System.String",
|
|
|
|
|
"System.IO.BinaryReader",
|
|
|
|
|
"System.IO.Stream",
|
|
|
|
|
};
|
|
|
|
|
|
2013-01-19 20:03:57 +08:00
|
|
|
|
simpleDeobfuscator.Deobfuscate(methodToCheck);
|
|
|
|
|
foreach (var method in DotNetUtils.GetCalledMethods(module, methodToCheck)) {
|
2012-03-18 03:36:41 +08:00
|
|
|
|
var type = method.DeclaringType;
|
2013-01-19 20:03:57 +08:00
|
|
|
|
if (!DotNetUtils.IsMethod(method, "System.Void", "()"))
|
2011-11-08 17:27:18 +08:00
|
|
|
|
continue;
|
2011-11-08 18:36:09 +08:00
|
|
|
|
if (!method.IsStatic)
|
|
|
|
|
continue;
|
2011-11-08 17:27:18 +08:00
|
|
|
|
|
|
|
|
|
if (type.Fields.Count != 2)
|
|
|
|
|
continue;
|
|
|
|
|
if (type.HasNestedTypes)
|
|
|
|
|
continue;
|
|
|
|
|
if (type.HasEvents || type.HasProperties)
|
|
|
|
|
continue;
|
2013-01-19 20:03:57 +08:00
|
|
|
|
if (!CheckFields(type.Fields))
|
2011-11-08 17:27:18 +08:00
|
|
|
|
continue;
|
|
|
|
|
|
2013-01-19 20:03:57 +08:00
|
|
|
|
var resolverMethod = FindAssemblyResolveMethod(type);
|
2011-11-08 17:27:18 +08:00
|
|
|
|
if (resolverMethod == null)
|
|
|
|
|
continue;
|
|
|
|
|
|
|
|
|
|
var localTypes = new LocalTypes(resolverMethod);
|
2013-01-19 20:03:57 +08:00
|
|
|
|
if (!localTypes.All(resolverLocals))
|
2011-11-08 17:27:18 +08:00
|
|
|
|
continue;
|
|
|
|
|
|
|
|
|
|
assemblyResolverType = type;
|
|
|
|
|
assemblyResolverMethod = resolverMethod;
|
|
|
|
|
assemblyResolverInitMethod = method;
|
|
|
|
|
return true;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
return false;
|
|
|
|
|
}
|
|
|
|
|
|
2013-01-19 20:03:57 +08:00
|
|
|
|
static bool CheckFields(IList<FieldDef> fields) {
|
2011-11-08 17:27:18 +08:00
|
|
|
|
if (fields.Count != 2)
|
|
|
|
|
return false;
|
|
|
|
|
|
2011-11-09 02:27:27 +08:00
|
|
|
|
var fieldTypes = new FieldTypes(fields);
|
2013-01-19 20:03:57 +08:00
|
|
|
|
return fieldTypes.Count("System.Boolean") == 1 &&
|
|
|
|
|
(fieldTypes.Count("System.Collections.Hashtable") == 1 ||
|
|
|
|
|
fieldTypes.Count("System.Object") == 1);
|
2011-11-08 17:27:18 +08:00
|
|
|
|
}
|
|
|
|
|
|
2013-01-19 20:03:57 +08:00
|
|
|
|
static MethodDef FindAssemblyResolveMethod(TypeDef type) {
|
2011-11-08 17:27:18 +08:00
|
|
|
|
foreach (var method in type.Methods) {
|
2013-01-19 20:03:57 +08:00
|
|
|
|
if (DotNetUtils.IsMethod(method, "System.Reflection.Assembly", "(System.Object,System.ResolveEventArgs)"))
|
2011-11-08 17:27:18 +08:00
|
|
|
|
return method;
|
|
|
|
|
}
|
2011-11-09 04:27:03 +08:00
|
|
|
|
foreach (var method in type.Methods) {
|
2013-01-19 20:03:57 +08:00
|
|
|
|
if (DotNetUtils.IsMethod(method, "System.Reflection.Assembly", "(System.Object,System.Object)"))
|
2011-11-09 04:27:03 +08:00
|
|
|
|
return method;
|
|
|
|
|
}
|
2011-11-08 17:27:18 +08:00
|
|
|
|
return null;
|
|
|
|
|
}
|
|
|
|
|
|
2013-01-19 20:03:57 +08:00
|
|
|
|
public List<ResourceInfo> GetEmbeddedAssemblies(ISimpleDeobfuscator simpleDeobfuscator, IDeobfuscator deob) {
|
2011-11-08 17:27:18 +08:00
|
|
|
|
var infos = new List<ResourceInfo>();
|
|
|
|
|
if (assemblyResolverMethod == null)
|
|
|
|
|
return infos;
|
2013-01-19 20:03:57 +08:00
|
|
|
|
simpleDeobfuscator.Deobfuscate(assemblyResolverMethod);
|
|
|
|
|
simpleDeobfuscator.DecryptStrings(assemblyResolverMethod, deob);
|
2011-11-08 17:27:18 +08:00
|
|
|
|
|
2013-01-19 20:03:57 +08:00
|
|
|
|
foreach (var resourcePrefix in DotNetUtils.GetCodeStrings(assemblyResolverMethod))
|
|
|
|
|
infos.AddRange(GetResourceInfos(resourcePrefix));
|
2011-11-08 17:27:18 +08:00
|
|
|
|
|
|
|
|
|
return infos;
|
|
|
|
|
}
|
|
|
|
|
|
2013-01-19 20:03:57 +08:00
|
|
|
|
List<ResourceInfo> GetResourceInfos(string prefix) {
|
2011-11-08 17:27:18 +08:00
|
|
|
|
var infos = new List<ResourceInfo>();
|
|
|
|
|
|
2013-01-19 20:03:57 +08:00
|
|
|
|
foreach (var resource in FindResources(prefix))
|
|
|
|
|
infos.Add(new ResourceInfo(resource, GetAssemblyName(resource)));
|
2011-11-08 17:27:18 +08:00
|
|
|
|
|
|
|
|
|
return infos;
|
|
|
|
|
}
|
|
|
|
|
|
2013-01-19 20:03:57 +08:00
|
|
|
|
List<EmbeddedResource> FindResources(string prefix) {
|
2011-11-08 17:27:18 +08:00
|
|
|
|
var result = new List<EmbeddedResource>();
|
|
|
|
|
|
|
|
|
|
if (string.IsNullOrEmpty(prefix))
|
|
|
|
|
return result;
|
|
|
|
|
|
|
|
|
|
foreach (var rsrc in module.Resources) {
|
|
|
|
|
var resource = rsrc as EmbeddedResource;
|
|
|
|
|
if (resource == null)
|
|
|
|
|
continue;
|
2012-11-18 01:57:36 +08:00
|
|
|
|
if (!Utils.StartsWith(resource.Name.String, prefix, StringComparison.Ordinal))
|
2011-11-08 17:27:18 +08:00
|
|
|
|
continue;
|
|
|
|
|
|
|
|
|
|
result.Add(resource);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
return result;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static int unknownNameCounter = 0;
|
2013-01-19 20:03:57 +08:00
|
|
|
|
static string GetAssemblyName(EmbeddedResource resource) {
|
2011-11-08 17:27:18 +08:00
|
|
|
|
try {
|
2012-11-18 01:57:36 +08:00
|
|
|
|
var resourceModule = ModuleDefMD.Load(resource.Data.ReadAllBytes());
|
|
|
|
|
return resourceModule.Assembly.FullName;
|
2011-11-08 17:27:18 +08:00
|
|
|
|
}
|
|
|
|
|
catch {
|
2012-07-06 05:19:37 +08:00
|
|
|
|
return string.Format("unknown_name_{0}", unknownNameCounter++);
|
2011-11-08 17:27:18 +08:00
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|