diff --git a/de4dot.code/DeobfuscatorContext.cs b/de4dot.code/DeobfuscatorContext.cs
index 2b42c90c..3882eced 100644
--- a/de4dot.code/DeobfuscatorContext.cs
+++ b/de4dot.code/DeobfuscatorContext.cs
@@ -58,20 +58,20 @@ namespace de4dot.code {
return type.ElementType;
}
- public TypeDefinition resolve(TypeReference type) {
+ public TypeDef resolve(TypeReference type) {
if (type == null)
return null;
- var typeDef = getNonGenericTypeReference(type) as TypeDefinition;
+ var typeDef = getNonGenericTypeReference(type) as TypeDef;
if (typeDef != null)
return typeDef;
return externalAssemblies.resolve(type);
}
- public MethodDefinition resolve(MethodReference method) {
+ public MethodDef resolve(MethodReference method) {
if (method == null)
return null;
- var methodDef = method as MethodDefinition;
+ var methodDef = method as MethodDef;
if (methodDef != null)
return methodDef;
@@ -87,10 +87,10 @@ namespace de4dot.code {
return null;
}
- public FieldDefinition resolve(FieldReference field) {
+ public FieldDef resolve(FieldReference field) {
if (field == null)
return null;
- var fieldDef = field as FieldDefinition;
+ var fieldDef = field as FieldDef;
if (fieldDef != null)
return fieldDef;
diff --git a/de4dot.code/de4dot.code.csproj b/de4dot.code/de4dot.code.csproj
index a59afab3..6d624005 100644
--- a/de4dot.code/de4dot.code.csproj
+++ b/de4dot.code/de4dot.code.csproj
@@ -277,7 +277,7 @@
-
+
diff --git a/de4dot.code/deobfuscators/Babel_NET/AssemblyResolver.cs b/de4dot.code/deobfuscators/Babel_NET/AssemblyResolver.cs
index 1af66548..4ed3d84f 100644
--- a/de4dot.code/deobfuscators/Babel_NET/AssemblyResolver.cs
+++ b/de4dot.code/deobfuscators/Babel_NET/AssemblyResolver.cs
@@ -19,15 +19,15 @@
using System;
using System.IO;
-using Mono.Cecil;
+using dot10.DotNet;
using de4dot.blocks;
namespace de4dot.code.deobfuscators.Babel_NET {
class AssemblyResolver {
ModuleDefinition module;
ResourceDecrypter resourceDecrypter;
- TypeDefinition resolverType;
- MethodDefinition registerMethod;
+ TypeDef resolverType;
+ MethodDef registerMethod;
EmbeddedResource encryptedResource;
EmbeddedAssemblyInfo[] embeddedAssemblyInfos = new EmbeddedAssemblyInfo[0];
@@ -47,11 +47,11 @@ namespace de4dot.code.deobfuscators.Babel_NET {
get { return resolverType != null; }
}
- public TypeDefinition Type {
+ public TypeDef Type {
get { return resolverType; }
}
- public MethodDefinition InitMethod {
+ public MethodDef InitMethod {
get { return registerMethod; }
}
@@ -80,7 +80,7 @@ namespace de4dot.code.deobfuscators.Babel_NET {
if (!new FieldTypes(type).exactly(requiredTypes))
continue;
- MethodDefinition regMethod, handler;
+ MethodDef regMethod, handler;
if (!BabelUtils.findRegisterMethod(type, out regMethod, out handler))
continue;
@@ -95,7 +95,7 @@ namespace de4dot.code.deobfuscators.Babel_NET {
}
}
- static MethodDefinition findDecryptMethod(TypeDefinition type) {
+ static MethodDef findDecryptMethod(TypeDef type) {
foreach (var method in type.Methods) {
if (!DotNetUtils.isMethod(method, "System.Void", "(System.IO.Stream)"))
continue;
diff --git a/de4dot.code/deobfuscators/Babel_NET/BabelMethodCallInliner.cs b/de4dot.code/deobfuscators/Babel_NET/BabelMethodCallInliner.cs
index 0bc17b71..b90c7ea9 100644
--- a/de4dot.code/deobfuscators/Babel_NET/BabelMethodCallInliner.cs
+++ b/de4dot.code/deobfuscators/Babel_NET/BabelMethodCallInliner.cs
@@ -18,8 +18,8 @@
*/
using System.Collections.Generic;
-using Mono.Cecil;
-using Mono.Cecil.Cil;
+using dot10.DotNet;
+using dot10.DotNet.Emit;
using de4dot.blocks;
using de4dot.blocks.cflow;
@@ -35,12 +35,12 @@ namespace de4dot.code.deobfuscators.Babel_NET {
branchEmulator = new BranchEmulator(emulator, this);
}
- public static List find(ModuleDefinition module, IEnumerable notInlinedMethods) {
- var notInlinedMethodsDict = new Dictionary();
+ public static List find(ModuleDefinition module, IEnumerable notInlinedMethods) {
+ var notInlinedMethodsDict = new Dictionary();
foreach (var method in notInlinedMethods)
notInlinedMethodsDict[method] = true;
- var inlinedMethods = new List();
+ var inlinedMethods = new List();
foreach (var type in module.GetTypes()) {
foreach (var method in type.Methods) {
@@ -83,7 +83,7 @@ namespace de4dot.code.deobfuscators.Babel_NET {
return changed;
}
- static bool canInline(MethodDefinition method) {
+ static bool canInline(MethodDef method) {
if (!DotNetUtils.isMethod(method, "System.Int32", "(System.Int32)"))
return false;
if (!method.IsAssembly)
@@ -94,12 +94,12 @@ namespace de4dot.code.deobfuscators.Babel_NET {
return method.IsStatic;
}
- bool canInline2(MethodDefinition method) {
+ bool canInline2(MethodDef method) {
return canInline(method) && method != blocks.Method;
}
bool inlineMethod(Instruction callInstr, int instrIndex) {
- var methodToInline = callInstr.Operand as MethodDefinition;
+ var methodToInline = callInstr.Operand as MethodDef;
if (methodToInline == null)
return false;
@@ -124,7 +124,7 @@ namespace de4dot.code.deobfuscators.Babel_NET {
return true;
}
- bool getNewValue(MethodDefinition method, int arg, out int newValue) {
+ bool getNewValue(MethodDef method, int arg, out int newValue) {
newValue = 0;
emulator.init(method);
emulator.setArg(method.Parameters[0], new Int32Value(arg));
diff --git a/de4dot.code/deobfuscators/Babel_NET/BabelUtils.cs b/de4dot.code/deobfuscators/Babel_NET/BabelUtils.cs
index 4052e33c..6bd04a1c 100644
--- a/de4dot.code/deobfuscators/Babel_NET/BabelUtils.cs
+++ b/de4dot.code/deobfuscators/Babel_NET/BabelUtils.cs
@@ -19,24 +19,24 @@
using System.Collections.Generic;
using System.Text;
-using Mono.Cecil;
-using Mono.Cecil.Cil;
+using dot10.DotNet;
+using dot10.DotNet.Emit;
using de4dot.blocks;
namespace de4dot.code.deobfuscators.Babel_NET {
static class BabelUtils {
- public static EmbeddedResource findEmbeddedResource(ModuleDefinition module, TypeDefinition decrypterType) {
+ public static EmbeddedResource findEmbeddedResource(ModuleDefinition module, TypeDef decrypterType) {
return findEmbeddedResource(module, decrypterType, (method) => { });
}
- public static EmbeddedResource findEmbeddedResource(ModuleDefinition module, TypeDefinition decrypterType, ISimpleDeobfuscator simpleDeobfuscator, IDeobfuscator deob) {
+ public static EmbeddedResource findEmbeddedResource(ModuleDefinition module, TypeDef decrypterType, ISimpleDeobfuscator simpleDeobfuscator, IDeobfuscator deob) {
return findEmbeddedResource(module, decrypterType, (method) => {
simpleDeobfuscator.deobfuscate(method);
simpleDeobfuscator.decryptStrings(method, deob);
});
}
- public static EmbeddedResource findEmbeddedResource(ModuleDefinition module, TypeDefinition decrypterType, Action fixMethod) {
+ public static EmbeddedResource findEmbeddedResource(ModuleDefinition module, TypeDef decrypterType, Action fixMethod) {
foreach (var method in decrypterType.Methods) {
if (!DotNetUtils.isMethod(method, "System.String", "()"))
continue;
@@ -50,7 +50,7 @@ namespace de4dot.code.deobfuscators.Babel_NET {
return null;
}
- static EmbeddedResource findEmbeddedResource1(ModuleDefinition module, MethodDefinition method) {
+ static EmbeddedResource findEmbeddedResource1(ModuleDefinition module, MethodDef method) {
foreach (var s in DotNetUtils.getCodeStrings(method)) {
var resource = DotNetUtils.getResource(module, s) as EmbeddedResource;
if (resource != null)
@@ -59,7 +59,7 @@ namespace de4dot.code.deobfuscators.Babel_NET {
return null;
}
- static EmbeddedResource findEmbeddedResource2(ModuleDefinition module, MethodDefinition method) {
+ static EmbeddedResource findEmbeddedResource2(ModuleDefinition module, MethodDef method) {
var strings = new List(DotNetUtils.getCodeStrings(method));
if (strings.Count != 1)
return null;
@@ -75,7 +75,7 @@ namespace de4dot.code.deobfuscators.Babel_NET {
return DotNetUtils.getResource(module, sb.ToString()) as EmbeddedResource;
}
- static bool getXorKey2(MethodDefinition method, out int xorKey) {
+ static bool getXorKey2(MethodDef method, out int xorKey) {
var instrs = method.Body.Instructions;
for (int i = 0; i < instrs.Count - 2; i++) {
var ldelem = instrs[i];
@@ -97,7 +97,7 @@ namespace de4dot.code.deobfuscators.Babel_NET {
return false;
}
- public static bool findRegisterMethod(TypeDefinition type, out MethodDefinition regMethod, out MethodDefinition handler) {
+ public static bool findRegisterMethod(TypeDef type, out MethodDef regMethod, out MethodDef handler) {
foreach (var method in type.Methods) {
if (!method.IsStatic || method.Body == null)
continue;
diff --git a/de4dot.code/deobfuscators/Babel_NET/ConstantsDecrypter.cs b/de4dot.code/deobfuscators/Babel_NET/ConstantsDecrypter.cs
index 49c1a6ff..2c7bcca7 100644
--- a/de4dot.code/deobfuscators/Babel_NET/ConstantsDecrypter.cs
+++ b/de4dot.code/deobfuscators/Babel_NET/ConstantsDecrypter.cs
@@ -21,8 +21,8 @@ using System;
using System.Collections.Generic;
using System.IO;
using System.Runtime.Serialization.Formatters.Binary;
-using Mono.Cecil;
-using Mono.Cecil.Cil;
+using dot10.DotNet;
+using dot10.DotNet.Emit;
using de4dot.blocks;
namespace de4dot.code.deobfuscators.Babel_NET {
@@ -30,12 +30,12 @@ namespace de4dot.code.deobfuscators.Babel_NET {
ModuleDefinition module;
ResourceDecrypter resourceDecrypter;
InitializedDataCreator initializedDataCreator;
- TypeDefinition decrypterType;
- MethodDefinition int32Decrypter;
- MethodDefinition int64Decrypter;
- MethodDefinition singleDecrypter;
- MethodDefinition doubleDecrypter;
- MethodDefinition arrayDecrypter;
+ TypeDef decrypterType;
+ MethodDef int32Decrypter;
+ MethodDef int64Decrypter;
+ MethodDef singleDecrypter;
+ MethodDef doubleDecrypter;
+ MethodDef arrayDecrypter;
EmbeddedResource encryptedResource;
int[] decryptedInts;
long[] decryptedLongs;
@@ -54,27 +54,27 @@ namespace de4dot.code.deobfuscators.Babel_NET {
get { return encryptedResource; }
}
- public TypeDefinition Type {
+ public TypeDef Type {
get { return decrypterType; }
}
- public MethodDefinition Int32Decrypter {
+ public MethodDef Int32Decrypter {
get { return int32Decrypter; }
}
- public MethodDefinition Int64Decrypter {
+ public MethodDef Int64Decrypter {
get { return int64Decrypter; }
}
- public MethodDefinition SingleDecrypter {
+ public MethodDef SingleDecrypter {
get { return singleDecrypter; }
}
- public MethodDefinition DoubleDecrypter {
+ public MethodDef DoubleDecrypter {
get { return doubleDecrypter; }
}
- public MethodDefinition ArrayDecrypter {
+ public MethodDef ArrayDecrypter {
get { return arrayDecrypter; }
}
@@ -99,7 +99,7 @@ namespace de4dot.code.deobfuscators.Babel_NET {
}
}
- bool isConstantDecrypter(TypeDefinition type) {
+ bool isConstantDecrypter(TypeDef type) {
if (type.HasEvents)
return false;
if (type.NestedTypes.Count != 1)
@@ -131,7 +131,7 @@ namespace de4dot.code.deobfuscators.Babel_NET {
"System.Single[]",
"System.Double[]",
};
- bool checkNestedFields(TypeDefinition nested) {
+ bool checkNestedFields(TypeDef nested) {
if (!new FieldTypes(nested).all(requiredTypes))
return false;
foreach (var field in nested.Fields) {
@@ -193,11 +193,11 @@ namespace de4dot.code.deobfuscators.Babel_NET {
}
struct ArrayInfo {
- public FieldDefinition encryptedField;
+ public FieldDef encryptedField;
public ArrayType arrayType;
public int start, len;
- public ArrayInfo(int start, int len, FieldDefinition encryptedField, ArrayType arrayType) {
+ public ArrayInfo(int start, int len, FieldDef encryptedField, ArrayType arrayType) {
this.start = start;
this.len = len;
this.encryptedField = encryptedField;
@@ -232,7 +232,7 @@ namespace de4dot.code.deobfuscators.Babel_NET {
var ldtoken = instrs[index++];
if (ldtoken.OpCode.Code != Code.Ldtoken)
continue;
- var field = ldtoken.Operand as FieldDefinition;
+ var field = ldtoken.Operand as FieldDef;
if (field == null)
continue;
@@ -255,7 +255,7 @@ namespace de4dot.code.deobfuscators.Babel_NET {
if (arrayType == null)
continue;
if (arrayType.ElementType.GetPrimitiveSize() == -1) {
- Log.w("Can't decrypt non-primitive type array in method {0}", blocks.Method.MetadataToken.ToInt32());
+ Log.w("Can't decrypt non-primitive type array in method {0}", blocks.Method.MDToken.ToInt32());
continue;
}
diff --git a/de4dot.code/deobfuscators/Babel_NET/Deobfuscator.cs b/de4dot.code/deobfuscators/Babel_NET/Deobfuscator.cs
index da943936..806d8a90 100644
--- a/de4dot.code/deobfuscators/Babel_NET/Deobfuscator.cs
+++ b/de4dot.code/deobfuscators/Babel_NET/Deobfuscator.cs
@@ -19,7 +19,7 @@
using System.Collections.Generic;
using System.Text.RegularExpressions;
-using Mono.Cecil;
+using dot10.DotNet;
using de4dot.blocks;
using de4dot.blocks.cflow;
@@ -182,7 +182,7 @@ namespace de4dot.code.deobfuscators.Babel_NET {
}
}
- void checkVersion(TypeDefinition attr) {
+ void checkVersion(TypeDef attr) {
var versionField = DotNetUtils.getFieldByName(attr, "Version");
if (versionField != null && versionField.IsLiteral && versionField.Constant != null && versionField.Constant is string) {
var val = Regex.Match((string)versionField.Constant, @"^(\d+\.\d+\.\d+\.\d+)$");
@@ -296,7 +296,7 @@ namespace de4dot.code.deobfuscators.Babel_NET {
public override IEnumerable getStringDecrypterMethods() {
var list = new List();
if (stringDecrypter.DecryptMethod != null)
- list.Add(stringDecrypter.DecryptMethod.MetadataToken.ToInt32());
+ list.Add(stringDecrypter.DecryptMethod.MDToken.ToInt32());
return list;
}
}
diff --git a/de4dot.code/deobfuscators/Babel_NET/ImageReader.cs b/de4dot.code/deobfuscators/Babel_NET/ImageReader.cs
index 59bd5994..c2ef95c9 100644
--- a/de4dot.code/deobfuscators/Babel_NET/ImageReader.cs
+++ b/de4dot.code/deobfuscators/Babel_NET/ImageReader.cs
@@ -22,8 +22,8 @@ using System.Collections.Generic;
using System.Runtime.InteropServices;
using System.IO;
using System.Text;
-using Mono.Cecil;
-using Mono.Cecil.Cil;
+using dot10.DotNet;
+using dot10.DotNet.Emit;
using de4dot.blocks;
namespace de4dot.code.deobfuscators.Babel_NET {
@@ -104,7 +104,7 @@ namespace de4dot.code.deobfuscators.Babel_NET {
initializeTypeReferences(typeReferencesOffset);
}
- public void restore(string name, MethodDefinition method) {
+ public void restore(string name, MethodDef method) {
var babelMethod = getMethod(name);
var body = method.Body;
@@ -170,10 +170,10 @@ namespace de4dot.code.deobfuscators.Babel_NET {
return memberReferenceConverter.convert(fields[0]);
}
- static List getFields(TypeDefinition type, string name) {
+ static List getFields(TypeDef type, string name) {
if (type == null)
return null;
- var fields = new List();
+ var fields = new List();
foreach (var field in type.Fields) {
if (field.Name == name)
fields.Add(field);
@@ -215,7 +215,7 @@ namespace de4dot.code.deobfuscators.Babel_NET {
return methods[0];
}
- List getMethods(TypeDefinition declaringType, BabelMethodreference babelMethodRef) {
+ List getMethods(TypeDef declaringType, BabelMethodreference babelMethodRef) {
var methods = new List();
var git = babelMethodRef.DeclaringType as GenericInstanceType;
@@ -257,9 +257,9 @@ namespace de4dot.code.deobfuscators.Babel_NET {
return true;
}
- TypeDefinition resolve(TypeReference type) {
- if (type is TypeDefinition)
- return (TypeDefinition)type;
+ TypeDef resolve(TypeReference type) {
+ if (type is TypeDef)
+ return (TypeDef)type;
if (type.IsGenericInstance)
type = ((GenericInstanceType)type).ElementType;
@@ -400,7 +400,7 @@ namespace de4dot.code.deobfuscators.Babel_NET {
}
bool isValueType(TypeReference typeRef) {
- var typeDef = typeRef as TypeDefinition;
+ var typeDef = typeRef as TypeDef;
if (typeDef != null)
return typeDef.IsValueType;
diff --git a/de4dot.code/deobfuscators/Babel_NET/InflaterCreator.cs b/de4dot.code/deobfuscators/Babel_NET/InflaterCreator.cs
index 704f8b89..7420f226 100644
--- a/de4dot.code/deobfuscators/Babel_NET/InflaterCreator.cs
+++ b/de4dot.code/deobfuscators/Babel_NET/InflaterCreator.cs
@@ -18,17 +18,17 @@
*/
using ICSharpCode.SharpZipLib.Zip.Compression;
-using Mono.Cecil;
-using Mono.Cecil.Cil;
+using dot10.DotNet;
+using dot10.DotNet.Emit;
using de4dot.blocks;
namespace de4dot.code.deobfuscators.Babel_NET {
class InflaterCreator {
- public static Inflater create(MethodDefinition method, bool noHeader) {
+ public static Inflater create(MethodDef method, bool noHeader) {
return create(findInflaterType(method), noHeader);
}
- public static Inflater create(TypeDefinition inflaterType, bool noHeader) {
+ public static Inflater create(TypeDef inflaterType, bool noHeader) {
if (inflaterType == null)
return createNormal(noHeader);
var initHeaderMethod = findInitHeaderMethod(inflaterType);
@@ -50,13 +50,13 @@ namespace de4dot.code.deobfuscators.Babel_NET {
return new Inflater(noHeader);
}
- static TypeDefinition findInflaterType(MethodDefinition method) {
+ static TypeDef findInflaterType(MethodDef method) {
if (method == null || method.Body == null)
return null;
foreach (var instr in method.Body.Instructions) {
if (instr.OpCode.Code != Code.Call)
continue;
- var calledMethod = instr.Operand as MethodDefinition;
+ var calledMethod = instr.Operand as MethodDef;
if (calledMethod == null || !calledMethod.IsStatic)
continue;
@@ -70,7 +70,7 @@ namespace de4dot.code.deobfuscators.Babel_NET {
return null;
}
- static MethodDefinition findInitHeaderMethod(TypeDefinition inflaterType) {
+ static MethodDef findInitHeaderMethod(TypeDef inflaterType) {
foreach (var nested in inflaterType.NestedTypes) {
var method = findInitHeaderMethod2(nested);
if (method != null)
@@ -79,7 +79,7 @@ namespace de4dot.code.deobfuscators.Babel_NET {
return null;
}
- static MethodDefinition findInitHeaderMethod2(TypeDefinition nested) {
+ static MethodDef findInitHeaderMethod2(TypeDef nested) {
foreach (var method in nested.Methods) {
if (method.IsStatic || method.Body == null)
continue;
@@ -92,7 +92,7 @@ namespace de4dot.code.deobfuscators.Babel_NET {
return null;
}
- static int? getMagic(MethodDefinition method) {
+ static int? getMagic(MethodDef method) {
if (method == null || method.Body == null)
return null;
var instrs = method.Body.Instructions;
diff --git a/de4dot.code/deobfuscators/Babel_NET/MemberReferenceConverter.cs b/de4dot.code/deobfuscators/Babel_NET/MemberReferenceConverter.cs
index 17239cc7..3664184c 100644
--- a/de4dot.code/deobfuscators/Babel_NET/MemberReferenceConverter.cs
+++ b/de4dot.code/deobfuscators/Babel_NET/MemberReferenceConverter.cs
@@ -18,7 +18,7 @@
*/
using System;
-using Mono.Cecil;
+using dot10.DotNet;
using de4dot.blocks;
namespace de4dot.code.deobfuscators.Babel_NET {
@@ -35,7 +35,7 @@ namespace de4dot.code.deobfuscators.Babel_NET {
public TypeReference convert(TypeReference a) {
var newOne = update(a);
- if (!(a is GenericParameter) && !MemberReferenceHelper.compareTypes(newOne, a))
+ if (!(a is GenericParam) && !MemberReferenceHelper.compareTypes(newOne, a))
throw new ApplicationException("Could not convert type reference");
return newOne;
}
@@ -46,7 +46,7 @@ namespace de4dot.code.deobfuscators.Babel_NET {
var newTypeRef = new TypeReference(a.Namespace, a.Name, Module, memberReferenceConverter.convert(a.Scope), a.IsValueType);
foreach (var gp in a.GenericParameters)
- newTypeRef.GenericParameters.Add(new GenericParameter(gp.Name, newTypeRef));
+ newTypeRef.GenericParameters.Add(new GenericParam(gp.Name, newTypeRef));
newTypeRef.DeclaringType = update(a.DeclaringType);
newTypeRef.UpdateElementType();
return newTypeRef;
@@ -84,7 +84,7 @@ namespace de4dot.code.deobfuscators.Babel_NET {
}
public MethodReference convert(MethodReference methodRef) {
- if (methodRef.GetType() != typeof(MethodReference) && methodRef.GetType() != typeof(MethodDefinition))
+ if (methodRef.GetType() != typeof(MethodReference) && methodRef.GetType() != typeof(MethodDef))
throw new ApplicationException("Invalid method reference type");
if (isInOurModule(methodRef))
return tryGetMethodDefinition(methodRef);
@@ -93,7 +93,7 @@ namespace de4dot.code.deobfuscators.Babel_NET {
}
public MethodReference copy(MethodReference methodRef) {
- if (methodRef.GetType() != typeof(MethodReference) && methodRef.GetType() != typeof(MethodDefinition))
+ if (methodRef.GetType() != typeof(MethodReference) && methodRef.GetType() != typeof(MethodDef))
throw new ApplicationException("Invalid method reference type");
var newMethodRef = new MethodReference(methodRef.Name, convert(methodRef.MethodReturnType.ReturnType), convert(methodRef.DeclaringType));
@@ -103,7 +103,7 @@ namespace de4dot.code.deobfuscators.Babel_NET {
foreach (var param in methodRef.Parameters)
newMethodRef.Parameters.Add(new ParameterDefinition(param.Name, param.Attributes, convert(param.ParameterType)));
foreach (var gp in methodRef.GenericParameters)
- newMethodRef.GenericParameters.Add(new GenericParameter(gp.Name, newMethodRef));
+ newMethodRef.GenericParameters.Add(new GenericParam(gp.Name, newMethodRef));
return newMethodRef;
}
@@ -139,7 +139,7 @@ namespace de4dot.code.deobfuscators.Babel_NET {
}
public FieldReference tryGetFieldDefinition(FieldReference fieldRef) {
- var fieldDef = fieldRef as FieldDefinition;
+ var fieldDef = fieldRef as FieldDef;
if (fieldDef != null)
return fieldDef;
@@ -150,7 +150,7 @@ namespace de4dot.code.deobfuscators.Babel_NET {
}
public MethodReference tryGetMethodDefinition(MethodReference methodRef) {
- var methodDef = methodRef as MethodDefinition;
+ var methodDef = methodRef as MethodDef;
if (methodDef != null)
return methodDef;
diff --git a/de4dot.code/deobfuscators/Babel_NET/MethodBodyReader.cs b/de4dot.code/deobfuscators/Babel_NET/MethodBodyReader.cs
index b548b285..270fb758 100644
--- a/de4dot.code/deobfuscators/Babel_NET/MethodBodyReader.cs
+++ b/de4dot.code/deobfuscators/Babel_NET/MethodBodyReader.cs
@@ -19,8 +19,8 @@
using System;
using System.IO;
-using Mono.Cecil;
-using Mono.Cecil.Cil;
+using dot10.DotNet;
+using dot10.DotNet.Emit;
namespace de4dot.code.deobfuscators.Babel_NET {
class MethodBodyReader : MethodBodyReaderBase {
diff --git a/de4dot.code/deobfuscators/Babel_NET/MethodReferenceReader.cs b/de4dot.code/deobfuscators/Babel_NET/MethodReferenceReader.cs
index 5988c41d..443d598a 100644
--- a/de4dot.code/deobfuscators/Babel_NET/MethodReferenceReader.cs
+++ b/de4dot.code/deobfuscators/Babel_NET/MethodReferenceReader.cs
@@ -20,8 +20,8 @@
using System;
using System.Collections.Generic;
using System.IO;
-using Mono.Cecil;
-using Mono.Cecil.Cil;
+using dot10.DotNet;
+using dot10.DotNet.Emit;
using Mono.Collections.Generic;
namespace de4dot.code.deobfuscators.Babel_NET {
@@ -49,7 +49,7 @@ namespace de4dot.code.deobfuscators.Babel_NET {
get { return new Collection(GenericArguments); }
}
- MetadataToken IMetadataTokenProvider.MetadataToken {
+ MetadataToken IMetadataTokenProvider.MDToken {
get { throw new NotImplementedException(); }
set { throw new NotImplementedException(); }
}
diff --git a/de4dot.code/deobfuscators/Babel_NET/MethodsDecrypter.cs b/de4dot.code/deobfuscators/Babel_NET/MethodsDecrypter.cs
index 09075dbb..131d7cdd 100644
--- a/de4dot.code/deobfuscators/Babel_NET/MethodsDecrypter.cs
+++ b/de4dot.code/deobfuscators/Babel_NET/MethodsDecrypter.cs
@@ -20,8 +20,8 @@
using System;
using System.Collections.Generic;
using System.IO;
-using Mono.Cecil;
-using Mono.Cecil.Cil;
+using dot10.DotNet;
+using dot10.DotNet.Emit;
using de4dot.blocks;
namespace de4dot.code.deobfuscators.Babel_NET {
@@ -30,9 +30,9 @@ namespace de4dot.code.deobfuscators.Babel_NET {
ResourceDecrypter resourceDecrypter;
IDeobfuscatorContext deobfuscatorContext;
Dictionary imageReaders = new Dictionary(StringComparer.Ordinal);
- TypeDefinition methodsDecrypterCreator;
- TypeDefinition methodsDecrypter;
- MethodDefinition decryptExecuteMethod;
+ TypeDef methodsDecrypterCreator;
+ TypeDef methodsDecrypter;
+ MethodDef decryptExecuteMethod;
EmbeddedResource encryptedResource;
public bool Detected {
@@ -73,7 +73,7 @@ namespace de4dot.code.deobfuscators.Babel_NET {
}
}
- static MethodDefinition findDecryptMethod(TypeDefinition type) {
+ static MethodDef findDecryptMethod(TypeDef type) {
foreach (var method in type.Methods) {
var decryptMethod = ResourceDecrypter.findDecrypterMethod(method);
if (decryptMethod != null)
@@ -82,7 +82,7 @@ namespace de4dot.code.deobfuscators.Babel_NET {
return null;
}
- TypeDefinition findMethodsDecrypterType(TypeDefinition type) {
+ TypeDef findMethodsDecrypterType(TypeDef type) {
foreach (var field in type.Fields) {
var fieldType = DotNetUtils.getType(module, field.FieldType);
if (fieldType == null)
@@ -124,7 +124,7 @@ namespace de4dot.code.deobfuscators.Babel_NET {
class EncryptInfo {
public string encryptedMethodName;
public string feature;
- public MethodDefinition method;
+ public MethodDef method;
public string FullName {
get {
@@ -134,7 +134,7 @@ namespace de4dot.code.deobfuscators.Babel_NET {
}
}
- public EncryptInfo(string encryptedMethodName, string feature, MethodDefinition method) {
+ public EncryptInfo(string encryptedMethodName, string feature, MethodDef method) {
this.encryptedMethodName = encryptedMethodName;
this.feature = feature;
this.method = method;
@@ -142,9 +142,9 @@ namespace de4dot.code.deobfuscators.Babel_NET {
public override string ToString() {
if (feature != "")
- return string.Format("{0}:{1} {2:X8}", feature, encryptedMethodName, method.MetadataToken.ToInt32());
+ return string.Format("{0}:{1} {2:X8}", feature, encryptedMethodName, method.MDToken.ToInt32());
else
- return string.Format("{0} {1:X8}", encryptedMethodName, method.MetadataToken.ToInt32());
+ return string.Format("{0} {1:X8}", encryptedMethodName, method.MDToken.ToInt32());
}
}
@@ -158,7 +158,7 @@ namespace de4dot.code.deobfuscators.Babel_NET {
numNonDecryptedMethods++;
continue;
}
- Log.v("Decrypting method {0:X8}", info.method.MetadataToken.ToInt32());
+ Log.v("Decrypting method {0:X8}", info.method.MDToken.ToInt32());
imageReader.restore(info.FullName, info.method);
}
if (numNonDecryptedMethods > 0)
@@ -214,7 +214,7 @@ namespace de4dot.code.deobfuscators.Babel_NET {
return infos;
}
- bool checkEncryptedMethod(MethodDefinition method, out EncryptInfo info) {
+ bool checkEncryptedMethod(MethodDef method, out EncryptInfo info) {
info = null;
if (method.Body == null)
return false;
@@ -237,7 +237,7 @@ namespace de4dot.code.deobfuscators.Babel_NET {
return true;
}
- bool callsExecuteMethod(MethodDefinition method) {
+ bool callsExecuteMethod(MethodDef method) {
foreach (var instr in method.Body.Instructions) {
if (instr.OpCode.Code != Code.Call && instr.OpCode.Code != Code.Callvirt)
continue;
diff --git a/de4dot.code/deobfuscators/Babel_NET/ProxyCallFixer.cs b/de4dot.code/deobfuscators/Babel_NET/ProxyCallFixer.cs
index af729d1a..68dc3e11 100644
--- a/de4dot.code/deobfuscators/Babel_NET/ProxyCallFixer.cs
+++ b/de4dot.code/deobfuscators/Babel_NET/ProxyCallFixer.cs
@@ -19,8 +19,8 @@
using System;
using System.Collections.Generic;
-using Mono.Cecil;
-using Mono.Cecil.Cil;
+using dot10.DotNet;
+using dot10.DotNet.Emit;
using de4dot.blocks;
namespace de4dot.code.deobfuscators.Babel_NET {
@@ -54,7 +54,7 @@ namespace de4dot.code.deobfuscators.Babel_NET {
get { return true; }
}
- protected override object checkCctor(TypeDefinition type, MethodDefinition cctor) {
+ protected override object checkCctor(TypeDef type, MethodDef cctor) {
var instructions = cctor.Body.Instructions;
for (int i = 0; i < instructions.Count; i++) {
TypeReference delegateType;
@@ -95,7 +95,7 @@ namespace de4dot.code.deobfuscators.Babel_NET {
return null;
}
- protected override void getCallInfo(object context, FieldDefinition field, out MethodReference calledMethod, out OpCode callOpcode) {
+ protected override void getCallInfo(object context, FieldDef field, out MethodReference calledMethod, out OpCode callOpcode) {
var ctx = (Context)context;
switch (ctx.proxyCreatorType) {
@@ -141,7 +141,7 @@ namespace de4dot.code.deobfuscators.Babel_NET {
}
}
- ProxyCreatorType getProxyCreatorType(MethodDefinition methodToCheck) {
+ ProxyCreatorType getProxyCreatorType(MethodDef methodToCheck) {
foreach (var calledMethod in DotNetUtils.getCalledMethods(module, methodToCheck)) {
if (!calledMethod.IsStatic || calledMethod.Body == null)
continue;
diff --git a/de4dot.code/deobfuscators/Babel_NET/ResourceDecrypter.cs b/de4dot.code/deobfuscators/Babel_NET/ResourceDecrypter.cs
index 0abaad94..602ebdc5 100644
--- a/de4dot.code/deobfuscators/Babel_NET/ResourceDecrypter.cs
+++ b/de4dot.code/deobfuscators/Babel_NET/ResourceDecrypter.cs
@@ -20,8 +20,8 @@
using System;
using System.IO;
using ICSharpCode.SharpZipLib.Zip.Compression;
-using Mono.Cecil;
-using Mono.Cecil.Cil;
+using dot10.DotNet;
+using dot10.DotNet.Emit;
using de4dot.blocks;
namespace de4dot.code.deobfuscators.Babel_NET {
@@ -42,7 +42,7 @@ namespace de4dot.code.deobfuscators.Babel_NET {
class ResourceDecrypter {
ModuleDefinition module;
ISimpleDeobfuscator simpleDeobfuscator;
- MethodDefinition decryptMethod;
+ MethodDef decryptMethod;
IDecrypter decrypter;
public ResourceDecrypter(ModuleDefinition module, ISimpleDeobfuscator simpleDeobfuscator) {
@@ -155,7 +155,7 @@ namespace de4dot.code.deobfuscators.Babel_NET {
ModuleDefinition module;
Inflater inflater;
- public Decrypter3(ModuleDefinition module, MethodDefinition decryptMethod) {
+ public Decrypter3(ModuleDefinition module, MethodDef decryptMethod) {
this.module = module;
this.inflater = InflaterCreator.create(decryptMethod, true);
}
@@ -208,7 +208,7 @@ namespace de4dot.code.deobfuscators.Babel_NET {
}
}
- public MethodDefinition DecryptMethod {
+ public MethodDef DecryptMethod {
set {
if (value == null)
return;
@@ -221,14 +221,14 @@ namespace de4dot.code.deobfuscators.Babel_NET {
}
}
- public static MethodDefinition findDecrypterMethod(MethodDefinition method) {
+ public static MethodDef findDecrypterMethod(MethodDef method) {
if (method == null || method.Body == null)
return null;
foreach (var instr in method.Body.Instructions) {
if (instr.OpCode.Code != Code.Call)
continue;
- var calledMethod = instr.Operand as MethodDefinition;
+ var calledMethod = instr.Operand as MethodDef;
if (calledMethod == null || !calledMethod.IsStatic || calledMethod.Body == null)
continue;
if (!DotNetUtils.isMethod(calledMethod, "System.IO.MemoryStream", "(System.IO.Stream)"))
diff --git a/de4dot.code/deobfuscators/Babel_NET/ResourceResolver.cs b/de4dot.code/deobfuscators/Babel_NET/ResourceResolver.cs
index a1f30f3e..4289490d 100644
--- a/de4dot.code/deobfuscators/Babel_NET/ResourceResolver.cs
+++ b/de4dot.code/deobfuscators/Babel_NET/ResourceResolver.cs
@@ -20,8 +20,8 @@
using System;
using System.Collections.Generic;
using System.IO;
-using Mono.Cecil;
-using Mono.Cecil.Cil;
+using dot10.DotNet;
+using dot10.DotNet.Emit;
using de4dot.blocks;
namespace de4dot.code.deobfuscators.Babel_NET {
@@ -29,8 +29,8 @@ namespace de4dot.code.deobfuscators.Babel_NET {
ModuleDefinition module;
ResourceDecrypter resourceDecrypter;
ISimpleDeobfuscator simpleDeobfuscator;
- TypeDefinition resolverType;
- MethodDefinition registerMethod;
+ TypeDef resolverType;
+ MethodDef registerMethod;
EmbeddedResource encryptedResource;
bool hasXorKeys;
int xorKey1, xorKey2;
@@ -39,11 +39,11 @@ namespace de4dot.code.deobfuscators.Babel_NET {
get { return resolverType != null; }
}
- public TypeDefinition Type {
+ public TypeDef Type {
get { return resolverType; }
}
- public MethodDefinition InitMethod {
+ public MethodDef InitMethod {
get { return registerMethod; }
}
@@ -66,7 +66,7 @@ namespace de4dot.code.deobfuscators.Babel_NET {
if (!new FieldTypes(type).all(requiredTypes))
continue;
- MethodDefinition regMethod, handler;
+ MethodDef regMethod, handler;
if (!BabelUtils.findRegisterMethod(type, out regMethod, out handler))
continue;
@@ -87,7 +87,7 @@ namespace de4dot.code.deobfuscators.Babel_NET {
}
}
- static MethodDefinition findDecryptMethod(TypeDefinition type) {
+ static MethodDef findDecryptMethod(TypeDef type) {
foreach (var method in type.Methods) {
if (!DotNetUtils.isMethod(method, "System.Reflection.Assembly", "(System.IO.Stream)"))
continue;
@@ -96,7 +96,7 @@ namespace de4dot.code.deobfuscators.Babel_NET {
return null;
}
- void initXorKeys(MethodDefinition method) {
+ void initXorKeys(MethodDef method) {
simpleDeobfuscator.deobfuscate(method);
var ints = new List();
var instrs = method.Body.Instructions;
diff --git a/de4dot.code/deobfuscators/Babel_NET/StringDecrypter.cs b/de4dot.code/deobfuscators/Babel_NET/StringDecrypter.cs
index e6f0a552..ade3f060 100644
--- a/de4dot.code/deobfuscators/Babel_NET/StringDecrypter.cs
+++ b/de4dot.code/deobfuscators/Babel_NET/StringDecrypter.cs
@@ -21,8 +21,8 @@ using System;
using System.Collections.Generic;
using System.IO;
using System.Text;
-using Mono.Cecil;
-using Mono.Cecil.Cil;
+using dot10.DotNet;
+using dot10.DotNet.Emit;
using de4dot.blocks;
using de4dot.blocks.cflow;
@@ -31,12 +31,12 @@ namespace de4dot.code.deobfuscators.Babel_NET {
ModuleDefinition module;
ResourceDecrypter resourceDecrypter;
ISimpleDeobfuscator simpleDeobfuscator;
- TypeDefinition decrypterType;
+ TypeDef decrypterType;
EmbeddedResource encryptedResource;
IDecrypterInfo decrypterInfo;
interface IDecrypterInfo {
- MethodDefinition Decrypter { get; }
+ MethodDef Decrypter { get; }
bool NeedsResource { get; }
void initialize(ModuleDefinition module, EmbeddedResource resource);
string decrypt(object[] args);
@@ -44,7 +44,7 @@ namespace de4dot.code.deobfuscators.Babel_NET {
// Babel .NET 2.x
class DecrypterInfoV1 : IDecrypterInfo {
- public MethodDefinition Decrypter { get; set; }
+ public MethodDef Decrypter { get; set; }
public bool NeedsResource {
get { return false; }
}
@@ -67,7 +67,7 @@ namespace de4dot.code.deobfuscators.Babel_NET {
class DecrypterInfoV2 : IDecrypterInfo {
byte[] key;
- public MethodDefinition Decrypter { get; set; }
+ public MethodDef Decrypter { get; set; }
public bool NeedsResource {
get { return true; }
}
@@ -97,7 +97,7 @@ namespace de4dot.code.deobfuscators.Babel_NET {
InstructionEmulator emulator = new InstructionEmulator();
public IList OffsetCalcInstructions { get; set; }
- public MethodDefinition Decrypter { get; set; }
+ public MethodDef Decrypter { get; set; }
public bool NeedsResource {
get { return true; }
}
@@ -113,12 +113,12 @@ namespace de4dot.code.deobfuscators.Babel_NET {
offsetToString[getOffset((int)reader.BaseStream.Position)] = reader.ReadString();
}
- MethodDefinition dummyMethod;
+ MethodDef dummyMethod;
int getOffset(int offset) {
if (OffsetCalcInstructions == null || OffsetCalcInstructions.Count == 0)
return offset;
if (dummyMethod == null) {
- dummyMethod = new MethodDefinition("", 0, new TypeReference("", "", null, null));
+ dummyMethod = new MethodDef("", 0, new TypeReference("", "", null, null));
dummyMethod.Body = new MethodBody(dummyMethod);
}
emulator.init(dummyMethod);
@@ -141,11 +141,11 @@ namespace de4dot.code.deobfuscators.Babel_NET {
get { return decrypterType != null; }
}
- public TypeDefinition Type {
+ public TypeDef Type {
get { return decrypterType; }
}
- public MethodDefinition DecryptMethod {
+ public MethodDef DecryptMethod {
get { return decrypterInfo == null ? null : decrypterInfo.Decrypter; }
}
@@ -171,7 +171,7 @@ namespace de4dot.code.deobfuscators.Babel_NET {
}
}
- IDecrypterInfo checkDecrypterType(TypeDefinition type) {
+ IDecrypterInfo checkDecrypterType(TypeDef type) {
if (type.HasEvents)
return null;
if (type.NestedTypes.Count > 2)
@@ -188,7 +188,7 @@ namespace de4dot.code.deobfuscators.Babel_NET {
return checkDecrypterTypeBabel2x(type);
}
- IDecrypterInfo checkDecrypterTypeBabel2x(TypeDefinition type) {
+ IDecrypterInfo checkDecrypterTypeBabel2x(TypeDef type) {
if (type.HasEvents || type.HasProperties || type.HasNestedTypes)
return null;
if (type.HasFields || type.Methods.Count != 1)
@@ -200,7 +200,7 @@ namespace de4dot.code.deobfuscators.Babel_NET {
return new DecrypterInfoV1 { Decrypter = decrypter };
}
- bool checkDecryptMethodBabel2x(MethodDefinition method) {
+ bool checkDecryptMethodBabel2x(MethodDef method) {
if (!method.IsStatic || !method.IsPublic)
return false;
if (method.Body == null)
@@ -242,7 +242,7 @@ namespace de4dot.code.deobfuscators.Babel_NET {
return stringLength == 1 && stringToCharArray == 1 && stringCtor == 1;
}
- IDecrypterInfo checkNested(TypeDefinition type, TypeDefinition nested) {
+ IDecrypterInfo checkNested(TypeDef type, TypeDef nested) {
if (nested.HasProperties || nested.HasEvents)
return null;
@@ -309,7 +309,7 @@ namespace de4dot.code.deobfuscators.Babel_NET {
}
class ReflectionToCecilMethodCreator {
- MethodDefinition method;
+ MethodDef method;
List instructions = new List();
InstructionEmulator emulator;
int index;
@@ -330,7 +330,7 @@ namespace de4dot.code.deobfuscators.Babel_NET {
get { return instructions; }
}
- public ReflectionToCecilMethodCreator(MethodDefinition method) {
+ public ReflectionToCecilMethodCreator(MethodDef method) {
this.method = method;
this.emulator = new InstructionEmulator(method);
}
@@ -466,7 +466,7 @@ namespace de4dot.code.deobfuscators.Babel_NET {
}
}
- static List getOffsetCalcInstructions(MethodDefinition method) {
+ static List getOffsetCalcInstructions(MethodDef method) {
var creator = new ReflectionToCecilMethodCreator(method);
creator.create();
var instrs = creator.Instructions;
@@ -499,7 +499,7 @@ namespace de4dot.code.deobfuscators.Babel_NET {
return -1;
}
- static bool hasFieldType(IEnumerable fields, TypeReference fieldType) {
+ static bool hasFieldType(IEnumerable fields, TypeReference fieldType) {
foreach (var field in fields) {
if (MemberReferenceHelper.compareTypes(field.FieldType, fieldType))
return true;
@@ -507,7 +507,7 @@ namespace de4dot.code.deobfuscators.Babel_NET {
return false;
}
- static int getOffsetMagic(MethodDefinition method) {
+ static int getOffsetMagic(MethodDef method) {
var instrs = method.Body.Instructions;
for (int i = 0; i < instrs.Count - 4; i++) {
int index = i;
@@ -549,7 +549,7 @@ namespace de4dot.code.deobfuscators.Babel_NET {
return 0;
}
- bool checkFields(TypeDefinition type, string fieldType1, TypeDefinition fieldType2) {
+ bool checkFields(TypeDef type, string fieldType1, TypeDef fieldType2) {
if (type.Fields.Count != 2)
return false;
if (type.Fields[0].FieldType.FullName != fieldType1 &&
diff --git a/de4dot.code/deobfuscators/CliSecure/CliSecureRtType.cs b/de4dot.code/deobfuscators/CliSecure/CliSecureRtType.cs
index a8cae51a..f894fbc7 100644
--- a/de4dot.code/deobfuscators/CliSecure/CliSecureRtType.cs
+++ b/de4dot.code/deobfuscators/CliSecure/CliSecureRtType.cs
@@ -20,41 +20,41 @@
using System;
using System.Collections.Generic;
using System.IO;
-using Mono.Cecil;
+using dot10.DotNet;
using de4dot.blocks;
using de4dot.PE;
namespace de4dot.code.deobfuscators.CliSecure {
class CliSecureRtType {
ModuleDefinition module;
- TypeDefinition cliSecureRtType;
- MethodDefinition postInitializeMethod;
- MethodDefinition initializeMethod;
- MethodDefinition stringDecrypterMethod;
- MethodDefinition loadMethod;
+ TypeDef cliSecureRtType;
+ MethodDef postInitializeMethod;
+ MethodDef initializeMethod;
+ MethodDef stringDecrypterMethod;
+ MethodDef loadMethod;
bool foundSig;
public bool Detected {
get { return foundSig || cliSecureRtType != null; }
}
- public TypeDefinition Type {
+ public TypeDef Type {
get { return cliSecureRtType; }
}
- public MethodDefinition StringDecrypterMethod {
+ public MethodDef StringDecrypterMethod {
get { return stringDecrypterMethod; }
}
- public MethodDefinition PostInitializeMethod {
+ public MethodDef PostInitializeMethod {
get { return postInitializeMethod; }
}
- public MethodDefinition InitializeMethod {
+ public MethodDef InitializeMethod {
get { return initializeMethod; }
}
- public MethodDefinition LoadMethod {
+ public MethodDef LoadMethod {
get { return loadMethod; }
}
@@ -165,7 +165,7 @@ namespace de4dot.code.deobfuscators.CliSecure {
return false;
}
- static MethodDefinition findStringDecrypterMethod(TypeDefinition type) {
+ static MethodDef findStringDecrypterMethod(TypeDef type) {
foreach (var method in type.Methods) {
if (method.Body == null || !method.IsStatic)
continue;
@@ -178,7 +178,7 @@ namespace de4dot.code.deobfuscators.CliSecure {
return null;
}
- static MethodDefinition findMethod(TypeDefinition type, string returnType, string name, string parameters) {
+ static MethodDef findMethod(TypeDef type, string returnType, string name, string parameters) {
var methodName = returnType + " " + type.FullName + "::" + name + parameters;
foreach (var method in type.Methods) {
if (method.Body == null || !method.IsStatic)
@@ -192,7 +192,7 @@ namespace de4dot.code.deobfuscators.CliSecure {
return null;
}
- static bool hasInitializeMethod(TypeDefinition type, string name) {
+ static bool hasInitializeMethod(TypeDef type, string name) {
var method = DotNetUtils.getPInvokeMethod(type, name);
if (method == null)
return false;
@@ -239,7 +239,7 @@ namespace de4dot.code.deobfuscators.CliSecure {
}
}
- static bool isOldStringDecrypterMethod(MethodDefinition method) {
+ static bool isOldStringDecrypterMethod(MethodDef method) {
if (method == null || method.Body == null || !method.IsStatic)
return false;
if (!DotNetUtils.isMethod(method, "System.String", "(System.String)"))
diff --git a/de4dot.code/deobfuscators/CliSecure/Deobfuscator.cs b/de4dot.code/deobfuscators/CliSecure/Deobfuscator.cs
index a9820940..18ce06f8 100644
--- a/de4dot.code/deobfuscators/CliSecure/Deobfuscator.cs
+++ b/de4dot.code/deobfuscators/CliSecure/Deobfuscator.cs
@@ -19,7 +19,7 @@
using System;
using System.Collections.Generic;
-using Mono.Cecil;
+using dot10.DotNet;
using Mono.MyStuff;
using de4dot.blocks;
using de4dot.PE;
@@ -78,7 +78,7 @@ namespace de4dot.code.deobfuscators.CliSecure {
Options options;
string obfuscatorName = DeobfuscatorInfo.THE_NAME;
- List cliSecureAttributes = new List();
+ List cliSecureAttributes = new List();
ProxyCallFixer proxyCallFixer;
CliSecureRtType cliSecureRtType;
StringDecrypter stringDecrypter;
@@ -233,8 +233,8 @@ namespace de4dot.code.deobfuscators.CliSecure {
return newOne;
}
- static List lookup(ModuleDefinition module, List types, string errorMsg) {
- var list = new List(types.Count);
+ static List lookup(ModuleDefinition module, List types, string errorMsg) {
+ var list = new List(types.Count);
foreach (var type in types)
list.Add(DeobUtils.lookup(module, type, errorMsg));
return list;
@@ -320,7 +320,7 @@ namespace de4dot.code.deobfuscators.CliSecure {
public override IEnumerable getStringDecrypterMethods() {
var list = new List();
if (stringDecrypter.Method != null)
- list.Add(stringDecrypter.Method.MetadataToken.ToInt32());
+ list.Add(stringDecrypter.Method.MDToken.ToInt32());
return list;
}
diff --git a/de4dot.code/deobfuscators/CliSecure/MethodsDecrypter.cs b/de4dot.code/deobfuscators/CliSecure/MethodsDecrypter.cs
index 4f73e063..6134f638 100644
--- a/de4dot.code/deobfuscators/CliSecure/MethodsDecrypter.cs
+++ b/de4dot.code/deobfuscators/CliSecure/MethodsDecrypter.cs
@@ -458,7 +458,7 @@ namespace de4dot.code.deobfuscators.CliSecure {
var initMethod = csRtType.InitializeMethod;
if (initMethod == null)
return null;
- uint initToken = initMethod.MetadataToken.ToUInt32();
+ uint initToken = initMethod.MDToken.ToUInt32();
var moduleCctorBytes = new byte[6];
moduleCctorBytes[0] = 0x28; // call
moduleCctorBytes[1] = (byte)initToken;
@@ -542,7 +542,7 @@ namespace de4dot.code.deobfuscators.CliSecure {
var dm = new DumpedMethod();
dm.token = 0x06000001 + (uint)i;
- var method = (Mono.Cecil.MethodDefinition)module.LookupToken((int)dm.token);
+ var method = (Mono.Cecil.MethodDef)module.LookupToken((int)dm.token);
if (method == null || method.DeclaringType == DotNetUtils.getModuleType(module))
continue;
diff --git a/de4dot.code/deobfuscators/CliSecure/ProxyCallFixer.cs b/de4dot.code/deobfuscators/CliSecure/ProxyCallFixer.cs
index b7362f02..9ad5f4ec 100644
--- a/de4dot.code/deobfuscators/CliSecure/ProxyCallFixer.cs
+++ b/de4dot.code/deobfuscators/CliSecure/ProxyCallFixer.cs
@@ -19,8 +19,8 @@
using System;
using System.Collections.Generic;
-using Mono.Cecil;
-using Mono.Cecil.Cil;
+using dot10.DotNet;
+using dot10.DotNet.Emit;
using de4dot.blocks;
namespace de4dot.code.deobfuscators.CliSecure {
@@ -49,19 +49,19 @@ namespace de4dot.code.deobfuscators.CliSecure {
}
}
- protected override object checkCctor(ref TypeDefinition type, MethodDefinition cctor) {
+ protected override object checkCctor(ref TypeDef type, MethodDef cctor) {
var instrs = cctor.Body.Instructions;
if (instrs.Count != 3)
return null;
if (!DotNetUtils.isLdcI4(instrs[0].OpCode.Code))
return null;
- if (instrs[1].OpCode != OpCodes.Call || !isDelegateCreatorMethod(instrs[1].Operand as MethodDefinition))
+ if (instrs[1].OpCode != OpCodes.Call || !isDelegateCreatorMethod(instrs[1].Operand as MethodDef))
return null;
if (instrs[2].OpCode != OpCodes.Ret)
return null;
int delegateToken = 0x02000001 + DotNetUtils.getLdcI4Value(instrs[0]);
- if (type.MetadataToken.ToInt32() != delegateToken) {
+ if (type.MDToken.ToInt32() != delegateToken) {
Log.w("Delegate token is not current type");
return null;
}
@@ -69,7 +69,7 @@ namespace de4dot.code.deobfuscators.CliSecure {
return new object();
}
- protected override void getCallInfo(object context, FieldDefinition field, out MethodReference calledMethod, out OpCode callOpcode) {
+ protected override void getCallInfo(object context, FieldDef field, out MethodReference calledMethod, out OpCode callOpcode) {
if (memberReferences == null)
memberReferences = new List(module.GetMemberReferences());
diff --git a/de4dot.code/deobfuscators/CliSecure/ResourceDecrypter.cs b/de4dot.code/deobfuscators/CliSecure/ResourceDecrypter.cs
index 37118bf1..aeb2f34c 100644
--- a/de4dot.code/deobfuscators/CliSecure/ResourceDecrypter.cs
+++ b/de4dot.code/deobfuscators/CliSecure/ResourceDecrypter.cs
@@ -20,25 +20,25 @@
using System.IO;
using System.Security.Cryptography;
using System.Text;
-using Mono.Cecil;
+using dot10.DotNet;
using de4dot.blocks;
namespace de4dot.code.deobfuscators.CliSecure {
class ResourceDecrypter {
ModuleDefinition module;
- TypeDefinition rsrcType;
- MethodDefinition rsrcRrrMethod;
- MethodDefinition rsrcResolveMethod;
+ TypeDef rsrcType;
+ MethodDef rsrcRrrMethod;
+ MethodDef rsrcResolveMethod;
public bool Detected {
get { return rsrcType != null; }
}
- public TypeDefinition Type {
+ public TypeDef Type {
get { return rsrcType; }
}
- public MethodDefinition RsrcRrrMethod {
+ public MethodDef RsrcRrrMethod {
get { return rsrcRrrMethod; }
}
diff --git a/de4dot.code/deobfuscators/CliSecure/StackFrameHelper.cs b/de4dot.code/deobfuscators/CliSecure/StackFrameHelper.cs
index dc465d8e..76d760dd 100644
--- a/de4dot.code/deobfuscators/CliSecure/StackFrameHelper.cs
+++ b/de4dot.code/deobfuscators/CliSecure/StackFrameHelper.cs
@@ -18,16 +18,16 @@
*/
using System;
-using Mono.Cecil;
+using dot10.DotNet;
using de4dot.blocks;
namespace de4dot.code.deobfuscators.CliSecure {
class StackFrameHelper {
ModuleDefinition module;
- TypeDefinition stackFrameHelperType;
+ TypeDef stackFrameHelperType;
ExceptionLoggerRemover exceptionLoggerRemover = new ExceptionLoggerRemover();
- public TypeDefinition Type {
+ public TypeDef Type {
get { return stackFrameHelperType; }
}
@@ -46,7 +46,7 @@ namespace de4dot.code.deobfuscators.CliSecure {
if (type.Methods.Count > 3)
continue;
- MethodDefinition errorMethod = null;
+ MethodDef errorMethod = null;
foreach (var method in type.Methods) {
if (method.IsRuntimeSpecialName && method.Name == ".ctor" && !method.HasParameters)
continue; // .ctor is allowed
diff --git a/de4dot.code/deobfuscators/CliSecure/StringDecrypter.cs b/de4dot.code/deobfuscators/CliSecure/StringDecrypter.cs
index ef3e5e5c..b8bbd156 100644
--- a/de4dot.code/deobfuscators/CliSecure/StringDecrypter.cs
+++ b/de4dot.code/deobfuscators/CliSecure/StringDecrypter.cs
@@ -19,29 +19,29 @@
using System;
using System.Text;
-using Mono.Cecil;
+using dot10.DotNet;
namespace de4dot.code.deobfuscators.CliSecure {
class StringDecrypter {
ModuleDefinition module;
- TypeDefinition stringDecrypterType;
- MethodDefinition stringDecrypterMethod;
+ TypeDef stringDecrypterType;
+ MethodDef stringDecrypterMethod;
byte[] stringDecrypterKey;
public bool Detected {
get { return stringDecrypterMethod != null; }
}
- public TypeDefinition Type {
+ public TypeDef Type {
get { return stringDecrypterType; }
}
- public MethodDefinition Method {
+ public MethodDef Method {
get { return stringDecrypterMethod; }
set { stringDecrypterMethod = value; }
}
- public StringDecrypter(ModuleDefinition module, MethodDefinition stringDecrypterMethod) {
+ public StringDecrypter(ModuleDefinition module, MethodDef stringDecrypterMethod) {
this.module = module;
this.stringDecrypterMethod = stringDecrypterMethod;
}
diff --git a/de4dot.code/deobfuscators/CliSecure/vm/CilOperandInstructionRestorer.cs b/de4dot.code/deobfuscators/CliSecure/vm/CilOperandInstructionRestorer.cs
index 4a1b48e3..32d770a1 100644
--- a/de4dot.code/deobfuscators/CliSecure/vm/CilOperandInstructionRestorer.cs
+++ b/de4dot.code/deobfuscators/CliSecure/vm/CilOperandInstructionRestorer.cs
@@ -17,8 +17,8 @@
along with de4dot. If not, see .
*/
-using Mono.Cecil;
-using Mono.Cecil.Cil;
+using dot10.DotNet;
+using dot10.DotNet.Emit;
using Mono.Cecil.Metadata;
using de4dot.blocks;
@@ -28,9 +28,9 @@ namespace de4dot.code.deobfuscators.CliSecure.vm {
// ldobj
// stobj
class CilOperandInstructionRestorer {
- MethodDefinition method;
+ MethodDef method;
- public bool restore(MethodDefinition method) {
+ public bool restore(MethodDef method) {
this.method = method;
bool atLeastOneFailed = false;
@@ -99,13 +99,13 @@ namespace de4dot.code.deobfuscators.CliSecure.vm {
case CecilType.ArrayType:
case CecilType.GenericInstanceType:
case CecilType.PointerType:
- case CecilType.TypeDefinition:
+ case CecilType.TypeDef:
case CecilType.TypeReference:
case CecilType.FunctionPointerType:
break;
- case CecilType.GenericParameter:
- var gp = (GenericParameter)type;
+ case CecilType.GenericParam:
+ var gp = (GenericParam)type;
if (method.DeclaringType != gp.Owner && method != gp.Owner)
return false;
break;
diff --git a/de4dot.code/deobfuscators/CliSecure/vm/Csvm.cs b/de4dot.code/deobfuscators/CliSecure/vm/Csvm.cs
index 234ea7cb..7f4f7755 100644
--- a/de4dot.code/deobfuscators/CliSecure/vm/Csvm.cs
+++ b/de4dot.code/deobfuscators/CliSecure/vm/Csvm.cs
@@ -20,7 +20,7 @@
using System;
using System.Collections.Generic;
using System.IO;
-using Mono.Cecil;
+using dot10.DotNet;
using de4dot.blocks;
namespace de4dot.code.deobfuscators.CliSecure.vm {
@@ -98,17 +98,17 @@ namespace de4dot.code.deobfuscators.CliSecure.vm {
var converter = new CsvmToCilMethodConverter(deobfuscatorContext, module, opcodeDetector);
var methodPrinter = new MethodPrinter();
foreach (var csvmMethod in csvmMethods) {
- var cilMethod = module.LookupToken(csvmMethod.Token) as MethodDefinition;
+ var cilMethod = module.LookupToken(csvmMethod.Token) as MethodDef;
if (cilMethod == null)
throw new ApplicationException(string.Format("Could not find method {0:X8}", csvmMethod.Token));
converter.convert(cilMethod, csvmMethod);
- Log.v("Restored method {0:X8}", cilMethod.MetadataToken.ToInt32());
+ Log.v("Restored method {0:X8}", cilMethod.MDToken.ToInt32());
printMethod(methodPrinter, cilMethod);
}
Log.deIndent();
}
- static void printMethod(MethodPrinter methodPrinter, MethodDefinition method) {
+ static void printMethod(MethodPrinter methodPrinter, MethodDef method) {
const Log.LogLevel dumpLogLevel = Log.LogLevel.verbose;
if (!Log.isAtLeast(dumpLogLevel))
return;
diff --git a/de4dot.code/deobfuscators/CliSecure/vm/CsvmDataReader.cs b/de4dot.code/deobfuscators/CliSecure/vm/CsvmDataReader.cs
index b3dd1ccd..b6bd7915 100644
--- a/de4dot.code/deobfuscators/CliSecure/vm/CsvmDataReader.cs
+++ b/de4dot.code/deobfuscators/CliSecure/vm/CsvmDataReader.cs
@@ -20,7 +20,7 @@
using System;
using System.Collections.Generic;
using System.IO;
-using Mono.Cecil;
+using dot10.DotNet;
using de4dot.blocks;
namespace de4dot.code.deobfuscators.CliSecure.vm {
diff --git a/de4dot.code/deobfuscators/CliSecure/vm/CsvmToCilMethodConverter.cs b/de4dot.code/deobfuscators/CliSecure/vm/CsvmToCilMethodConverter.cs
index d0179294..2ea5a91f 100644
--- a/de4dot.code/deobfuscators/CliSecure/vm/CsvmToCilMethodConverter.cs
+++ b/de4dot.code/deobfuscators/CliSecure/vm/CsvmToCilMethodConverter.cs
@@ -20,8 +20,8 @@
using System;
using System.Collections.Generic;
using System.IO;
-using Mono.Cecil;
-using Mono.Cecil.Cil;
+using dot10.DotNet;
+using dot10.DotNet.Emit;
using Mono.Cecil.Metadata;
using de4dot.blocks;
@@ -38,7 +38,7 @@ namespace de4dot.code.deobfuscators.CliSecure.vm {
this.opCodeDetector = opCodeDetector;
}
- public void convert(MethodDefinition cilMethod, CsvmMethodData csvmMethod) {
+ public void convert(MethodDef cilMethod, CsvmMethodData csvmMethod) {
var newInstructions = readInstructions(cilMethod, csvmMethod);
var newLocals = readLocals(cilMethod, csvmMethod);
var newExceptions = readExceptions(cilMethod, csvmMethod, newInstructions);
@@ -50,7 +50,7 @@ namespace de4dot.code.deobfuscators.CliSecure.vm {
DotNetUtils.restoreBody(cilMethod, newInstructions, newExceptions);
if (!operandRestorer.restore(cilMethod))
- Log.w("Failed to restore one or more instruction operands in CSVM method {0:X8}", cilMethod.MetadataToken.ToInt32());
+ Log.w("Failed to restore one or more instruction operands in CSVM method {0:X8}", cilMethod.MDToken.ToInt32());
restoreConstrainedPrefix(cilMethod);
}
@@ -129,7 +129,7 @@ namespace de4dot.code.deobfuscators.CliSecure.vm {
instr.Operand = operand;
}
- void fixArgs(IList instrs, MethodDefinition method) {
+ void fixArgs(IList instrs, MethodDef method) {
foreach (var instr in instrs) {
var op = instr.Operand as ArgOperand;
if (op == null)
@@ -206,7 +206,7 @@ namespace de4dot.code.deobfuscators.CliSecure.vm {
}
}
- List readInstructions(MethodDefinition cilMethod, CsvmMethodData csvmMethod) {
+ List readInstructions(MethodDef cilMethod, CsvmMethodData csvmMethod) {
var reader = new BinaryReader(new MemoryStream(csvmMethod.Instructions));
var instrs = new List();
int offset = 0;
@@ -230,7 +230,7 @@ namespace de4dot.code.deobfuscators.CliSecure.vm {
return instr.OpCode.Size + (op.targetDisplacements.Length + 1) * 4;
}
- List readLocals(MethodDefinition cilMethod, CsvmMethodData csvmMethod) {
+ List readLocals(MethodDef cilMethod, CsvmMethodData csvmMethod) {
var locals = new List();
var reader = new BinaryReader(new MemoryStream(csvmMethod.Locals));
@@ -303,7 +303,7 @@ namespace de4dot.code.deobfuscators.CliSecure.vm {
}
}
- List readExceptions(MethodDefinition cilMethod, CsvmMethodData csvmMethod, List cilInstructions) {
+ List readExceptions(MethodDef cilMethod, CsvmMethodData csvmMethod, List cilInstructions) {
var reader = new BinaryReader(new MemoryStream(csvmMethod.Exceptions));
var ehs = new List();
@@ -408,7 +408,7 @@ namespace de4dot.code.deobfuscators.CliSecure.vm {
return memberRef;
}
- static void restoreConstrainedPrefix(MethodDefinition method) {
+ static void restoreConstrainedPrefix(MethodDef method) {
if (method == null || method.Body == null)
return;
diff --git a/de4dot.code/deobfuscators/CliSecure/vm/FieldsInfo.cs b/de4dot.code/deobfuscators/CliSecure/vm/FieldsInfo.cs
index f4ba58e3..7dbc409e 100644
--- a/de4dot.code/deobfuscators/CliSecure/vm/FieldsInfo.cs
+++ b/de4dot.code/deobfuscators/CliSecure/vm/FieldsInfo.cs
@@ -19,7 +19,7 @@
using System;
using System.Collections.Generic;
-using Mono.Cecil;
+using dot10.DotNet;
namespace de4dot.code.deobfuscators.CliSecure.vm {
class FieldsInfo {
@@ -27,13 +27,13 @@ namespace de4dot.code.deobfuscators.CliSecure.vm {
Dictionary fieldTypes = new Dictionary(StringComparer.Ordinal);
int numEnums = 0;
- public FieldsInfo(TypeDefinition type)
+ public FieldsInfo(TypeDef type)
: this(type.Fields) {
}
- public FieldsInfo(IEnumerable fields) {
+ public FieldsInfo(IEnumerable fields) {
foreach (var field in fields) {
- var fieldTypeDef = field.FieldType as TypeDefinition;
+ var fieldTypeDef = field.FieldType as TypeDef;
if (fieldTypeDef != null && fieldTypeDef.IsEnum)
addEnum();
else
diff --git a/de4dot.code/deobfuscators/CliSecure/vm/OpCodeHandler.cs b/de4dot.code/deobfuscators/CliSecure/vm/OpCodeHandler.cs
index f8a43ab5..e8d5e49e 100644
--- a/de4dot.code/deobfuscators/CliSecure/vm/OpCodeHandler.cs
+++ b/de4dot.code/deobfuscators/CliSecure/vm/OpCodeHandler.cs
@@ -21,8 +21,8 @@ using System;
using System.Collections.Generic;
using System.IO;
using de4dot.blocks;
-using Mono.Cecil;
-using Mono.Cecil.Cil;
+using dot10.DotNet;
+using dot10.DotNet.Emit;
using Mono.Cecil.Metadata;
namespace de4dot.code.deobfuscators.CliSecure.vm {
@@ -439,7 +439,7 @@ namespace de4dot.code.deobfuscators.CliSecure.vm {
return isEmptyMethod(info.ReadMethod) && isEmptyMethod(info.ExecuteMethod);
}
- static bool isEmptyMethod(MethodDefinition method) {
+ static bool isEmptyMethod(MethodDef method) {
foreach (var instr in method.Body.Instructions) {
if (instr.OpCode.Code == Code.Ret)
return true;
diff --git a/de4dot.code/deobfuscators/CliSecure/vm/UnknownHandlerInfo.cs b/de4dot.code/deobfuscators/CliSecure/vm/UnknownHandlerInfo.cs
index 9ce21539..40d9a24e 100644
--- a/de4dot.code/deobfuscators/CliSecure/vm/UnknownHandlerInfo.cs
+++ b/de4dot.code/deobfuscators/CliSecure/vm/UnknownHandlerInfo.cs
@@ -19,24 +19,24 @@
using System;
using System.Collections.Generic;
-using Mono.Cecil;
-using Mono.Cecil.Cil;
+using dot10.DotNet;
+using dot10.DotNet.Emit;
using de4dot.blocks;
namespace de4dot.code.deobfuscators.CliSecure.vm {
class UnknownHandlerInfo {
- TypeDefinition type;
+ TypeDef type;
CsvmInfo csvmInfo;
FieldsInfo fieldsInfo;
- MethodDefinition readMethod, executeMethod;
+ MethodDef readMethod, executeMethod;
int numStaticMethods, numInstanceMethods, numVirtualMethods, numCtors;
int executeMethodThrows, executeMethodPops;
- public MethodDefinition ReadMethod {
+ public MethodDef ReadMethod {
get { return readMethod; }
}
- public MethodDefinition ExecuteMethod {
+ public MethodDef ExecuteMethod {
get { return executeMethod; }
}
@@ -64,7 +64,7 @@ namespace de4dot.code.deobfuscators.CliSecure.vm {
get { return numCtors; }
}
- public UnknownHandlerInfo(TypeDefinition type, CsvmInfo csvmInfo) {
+ public UnknownHandlerInfo(TypeDef type, CsvmInfo csvmInfo) {
this.type = type;
this.csvmInfo = csvmInfo;
fieldsInfo = new FieldsInfo(getFields(type));
@@ -74,11 +74,11 @@ namespace de4dot.code.deobfuscators.CliSecure.vm {
executeMethodPops = countPops(executeMethod);
}
- static internal IEnumerable getFields(TypeDefinition type) {
- var typeFields = new FieldDefinitionAndDeclaringTypeDict();
+ static internal IEnumerable getFields(TypeDef type) {
+ var typeFields = new FieldDefinitionAndDeclaringTypeDict();
foreach (var field in type.Fields)
typeFields.add(field, field);
- var realFields = new Dictionary();
+ var realFields = new Dictionary();
foreach (var method in type.Methods) {
if (method.Body == null)
continue;
@@ -132,7 +132,7 @@ namespace de4dot.code.deobfuscators.CliSecure.vm {
throw new ApplicationException("Could not find execute method");
}
- static int countThrows(MethodDefinition method) {
+ static int countThrows(MethodDef method) {
int count = 0;
foreach (var instr in method.Body.Instructions) {
if (instr.OpCode.Code == Code.Throw)
@@ -141,7 +141,7 @@ namespace de4dot.code.deobfuscators.CliSecure.vm {
return count;
}
- int countPops(MethodDefinition method) {
+ int countPops(MethodDef method) {
int count = 0;
foreach (var instr in method.Body.Instructions) {
if (instr.OpCode.Code != Code.Call && instr.OpCode.Code != Code.Callvirt)
diff --git a/de4dot.code/deobfuscators/CliSecure/vm/VmOpCodeHandlerDetector.cs b/de4dot.code/deobfuscators/CliSecure/vm/VmOpCodeHandlerDetector.cs
index 639314e9..db9d3e5a 100644
--- a/de4dot.code/deobfuscators/CliSecure/vm/VmOpCodeHandlerDetector.cs
+++ b/de4dot.code/deobfuscators/CliSecure/vm/VmOpCodeHandlerDetector.cs
@@ -19,8 +19,8 @@
using System;
using System.Collections.Generic;
-using Mono.Cecil;
-using Mono.Cecil.Cil;
+using dot10.DotNet;
+using dot10.DotNet.Emit;
using de4dot.blocks;
using de4dot.blocks.cflow;
@@ -37,10 +37,10 @@ namespace de4dot.code.deobfuscators.CliSecure.vm {
}
class CsvmInfo {
- public TypeDefinition StackValue { get; set; }
- public TypeDefinition Stack { get; set; }
- public MethodDefinition PopMethod { get; set; }
- public MethodDefinition PeekMethod { get; set; }
+ public TypeDef StackValue { get; set; }
+ public TypeDef Stack { get; set; }
+ public MethodDef PopMethod { get; set; }
+ public MethodDef PeekMethod { get; set; }
}
class VmOpCodeHandlerDetector {
@@ -73,7 +73,7 @@ namespace de4dot.code.deobfuscators.CliSecure.vm {
return csvmInfo;
}
- TypeDefinition findStackValueType() {
+ TypeDef findStackValueType() {
foreach (var type in module.Types) {
if (isStackType(type))
return type;
@@ -81,14 +81,14 @@ namespace de4dot.code.deobfuscators.CliSecure.vm {
return null;
}
- static bool isStackType(TypeDefinition type) {
+ static bool isStackType(TypeDef type) {
if (type.Fields.Count != 2)
return false;
int enumTypes = 0;
int objectTypes = 0;
foreach (var field in type.Fields) {
- var fieldType = field.FieldType as TypeDefinition;
+ var fieldType = field.FieldType as TypeDef;
if (fieldType != null && fieldType.IsEnum)
enumTypes++;
if (field.FieldType.FullName == "System.Object")
@@ -100,7 +100,7 @@ namespace de4dot.code.deobfuscators.CliSecure.vm {
return true;
}
- TypeDefinition findStackType(TypeDefinition stackValueType) {
+ TypeDef findStackType(TypeDef stackValueType) {
foreach (var type in module.Types) {
if (isStackType(type, stackValueType))
return type;
@@ -108,7 +108,7 @@ namespace de4dot.code.deobfuscators.CliSecure.vm {
return null;
}
- bool isStackType(TypeDefinition type, TypeDefinition stackValueType) {
+ bool isStackType(TypeDef type, TypeDef stackValueType) {
if (type.Interfaces.Count != 2)
return false;
if (!implementsInterface(type, "System.Collections.ICollection"))
@@ -137,7 +137,7 @@ namespace de4dot.code.deobfuscators.CliSecure.vm {
return true;
}
- static bool implementsInterface(TypeDefinition type, string ifaceName) {
+ static bool implementsInterface(TypeDef type, string ifaceName) {
foreach (var iface in type.Interfaces) {
if (iface.FullName == ifaceName)
return true;
@@ -156,7 +156,7 @@ namespace de4dot.code.deobfuscators.CliSecure.vm {
}
}
- static bool hasAdd(MethodDefinition method) {
+ static bool hasAdd(MethodDef method) {
foreach (var instr in method.Body.Instructions) {
if (instr.OpCode.Code == Code.Add)
return true;
@@ -164,7 +164,7 @@ namespace de4dot.code.deobfuscators.CliSecure.vm {
return false;
}
- List findVmHandlerTypes() {
+ List findVmHandlerTypes() {
var requiredFields = new string[] {
null,
"System.Collections.Generic.Dictionary`2",
@@ -190,13 +190,13 @@ namespace de4dot.code.deobfuscators.CliSecure.vm {
return null;
}
- static List findVmHandlerTypes(MethodDefinition method) {
- var list = new List();
+ static List findVmHandlerTypes(MethodDef method) {
+ var list = new List();
foreach (var instr in method.Body.Instructions) {
if (instr.OpCode.Code != Code.Ldtoken)
continue;
- var type = instr.Operand as TypeDefinition;
+ var type = instr.Operand as TypeDef;
if (type == null)
continue;
@@ -206,7 +206,7 @@ namespace de4dot.code.deobfuscators.CliSecure.vm {
return list;
}
- void detectHandlers(List handlerTypes, CsvmInfo csvmInfo) {
+ void detectHandlers(List handlerTypes, CsvmInfo csvmInfo) {
opCodeHandlers = new List();
var detected = new List();
diff --git a/de4dot.code/deobfuscators/CodeFort/AssemblyDecrypter.cs b/de4dot.code/deobfuscators/CodeFort/AssemblyDecrypter.cs
index 4716a6c2..5425ea44 100644
--- a/de4dot.code/deobfuscators/CodeFort/AssemblyDecrypter.cs
+++ b/de4dot.code/deobfuscators/CodeFort/AssemblyDecrypter.cs
@@ -23,8 +23,8 @@ using System.IO;
using System.Security.Cryptography;
using System.Text;
using System.Text.RegularExpressions;
-using Mono.Cecil;
-using Mono.Cecil.Cil;
+using dot10.DotNet;
+using dot10.DotNet.Emit;
using de4dot.blocks;
namespace de4dot.code.deobfuscators.CodeFort {
@@ -32,8 +32,8 @@ namespace de4dot.code.deobfuscators.CodeFort {
ModuleDefinition module;
EmbeddedResource assemblyEncryptedResource;
PasswordInfo embedPassword;
- MethodDefinition embedInitMethod;
- MethodDefinition embedResolverMethod;
+ MethodDef embedInitMethod;
+ MethodDef embedResolverMethod;
public class AssemblyInfo {
public readonly byte[] data;
@@ -67,11 +67,11 @@ namespace de4dot.code.deobfuscators.CodeFort {
get { return EncryptedDetected || MainAssemblyHasAssemblyResolver; }
}
- public TypeDefinition Type {
+ public TypeDef Type {
get { return embedInitMethod != null ? embedInitMethod.DeclaringType : null; }
}
- public MethodDefinition InitMethod {
+ public MethodDef InitMethod {
get { return embedInitMethod; }
}
@@ -118,10 +118,10 @@ namespace de4dot.code.deobfuscators.CodeFort {
return true;
}
- MethodDefinition checkCalledMethods(MethodDefinition method) {
+ MethodDef checkCalledMethods(MethodDef method) {
int calls = 0;
- TypeDefinition type = null;
- MethodDefinition initMethod = null;
+ TypeDef type = null;
+ MethodDef initMethod = null;
foreach (var calledMethod in DotNetUtils.getCalledMethods(module, method)) {
calls++;
if (type != null && calledMethod.DeclaringType != type)
@@ -144,7 +144,7 @@ namespace de4dot.code.deobfuscators.CodeFort {
findEmbedded(module.EntryPoint);
}
- bool findEmbedded(MethodDefinition method) {
+ bool findEmbedded(MethodDef method) {
if (method == null || method.Body == null)
return false;
foreach (var calledMethod in DotNetUtils.getCalledMethods(module, method)) {
@@ -162,7 +162,7 @@ namespace de4dot.code.deobfuscators.CodeFort {
return false;
}
- MethodDefinition checkInitMethod(MethodDefinition method) {
+ MethodDef checkInitMethod(MethodDef method) {
if (method == null || !method.IsStatic || method.Body == null)
return null;
if (!DotNetUtils.isMethod(method, "System.Void", "()"))
@@ -175,7 +175,7 @@ namespace de4dot.code.deobfuscators.CodeFort {
return resolver;
}
- bool checkType(TypeDefinition type) {
+ bool checkType(TypeDef type) {
if (DotNetUtils.getMethod(type, "System.Byte[]", "(System.Byte[],System.String,System.String,System.Int32,System.String,System.Int32)") == null)
return false;
if (DotNetUtils.getMethod(type, "System.String", "(System.String)") == null)
@@ -246,7 +246,7 @@ namespace de4dot.code.deobfuscators.CodeFort {
return infos;
}
- static PasswordInfo getEmbedPassword(MethodDefinition method) {
+ static PasswordInfo getEmbedPassword(MethodDef method) {
var instrs = method.Body.Instructions;
for (int i = 0; i < instrs.Count - 3; i++) {
int index = i;
diff --git a/de4dot.code/deobfuscators/CodeFort/CfMethodCallInliner.cs b/de4dot.code/deobfuscators/CodeFort/CfMethodCallInliner.cs
index ba322243..d06ab197 100644
--- a/de4dot.code/deobfuscators/CodeFort/CfMethodCallInliner.cs
+++ b/de4dot.code/deobfuscators/CodeFort/CfMethodCallInliner.cs
@@ -17,7 +17,7 @@
along with de4dot. If not, see .
*/
-using Mono.Cecil;
+using dot10.DotNet;
using de4dot.blocks;
using de4dot.blocks.cflow;
@@ -30,7 +30,7 @@ namespace de4dot.code.deobfuscators.CodeFort {
this.proxyCallFixer = proxyCallFixer;
}
- protected override bool canInline(MethodDefinition method) {
+ protected override bool canInline(MethodDef method) {
return proxyCallFixer.isProxyTargetMethod(method);
}
diff --git a/de4dot.code/deobfuscators/CodeFort/Deobfuscator.cs b/de4dot.code/deobfuscators/CodeFort/Deobfuscator.cs
index 091ea869..29fd1850 100644
--- a/de4dot.code/deobfuscators/CodeFort/Deobfuscator.cs
+++ b/de4dot.code/deobfuscators/CodeFort/Deobfuscator.cs
@@ -19,7 +19,7 @@
using System;
using System.Collections.Generic;
-using Mono.Cecil;
+using dot10.DotNet;
using Mono.MyStuff;
using de4dot.blocks;
using de4dot.PE;
@@ -173,7 +173,7 @@ namespace de4dot.code.deobfuscators.CodeFort {
public override IEnumerable getStringDecrypterMethods() {
var list = new List();
if (stringDecrypter.Method != null)
- list.Add(stringDecrypter.Method.MetadataToken.ToInt32());
+ list.Add(stringDecrypter.Method.MDToken.ToInt32());
return list;
}
}
diff --git a/de4dot.code/deobfuscators/CodeFort/PasswordFinder.cs b/de4dot.code/deobfuscators/CodeFort/PasswordFinder.cs
index be4cc4d2..b3428ae8 100644
--- a/de4dot.code/deobfuscators/CodeFort/PasswordFinder.cs
+++ b/de4dot.code/deobfuscators/CodeFort/PasswordFinder.cs
@@ -22,7 +22,7 @@ using System.Collections.Generic;
using System.IO;
using System.Reflection;
using System.Reflection.Emit;
-using Mono.Cecil;
+using dot10.DotNet;
namespace de4dot.code.deobfuscators.CodeFort {
class PasswordInfo {
diff --git a/de4dot.code/deobfuscators/CodeFort/ProxyCallFixer.cs b/de4dot.code/deobfuscators/CodeFort/ProxyCallFixer.cs
index 8fa60d7d..aefbc0d8 100644
--- a/de4dot.code/deobfuscators/CodeFort/ProxyCallFixer.cs
+++ b/de4dot.code/deobfuscators/CodeFort/ProxyCallFixer.cs
@@ -19,17 +19,17 @@
using System;
using System.Collections.Generic;
-using Mono.Cecil;
-using Mono.Cecil.Cil;
+using dot10.DotNet;
+using dot10.DotNet.Emit;
using de4dot.blocks;
namespace de4dot.code.deobfuscators.CodeFort {
class ProxyCallFixer : ProxyCallFixer3 {
IList memberReferences;
MethodDefinitionAndDeclaringTypeDict proxyTargetMethods = new MethodDefinitionAndDeclaringTypeDict();
- TypeDefinition proxyMethodsType;
+ TypeDef proxyMethodsType;
- public TypeDefinition ProxyMethodsType {
+ public TypeDef ProxyMethodsType {
get { return proxyMethodsType; }
}
@@ -52,7 +52,7 @@ namespace de4dot.code.deobfuscators.CodeFort {
}
}
- static MethodDefinition checkType(TypeDefinition type) {
+ static MethodDef checkType(TypeDef type) {
if (type.Fields.Count != 1)
return null;
if (type.Fields[0].FieldType.FullName != "System.Reflection.Module")
@@ -60,11 +60,11 @@ namespace de4dot.code.deobfuscators.CodeFort {
return checkMethods(type);
}
- static MethodDefinition checkMethods(TypeDefinition type) {
+ static MethodDef checkMethods(TypeDef type) {
if (type.Methods.Count != 3)
return null;
- MethodDefinition creatorMethod = null;
+ MethodDef creatorMethod = null;
foreach (var method in type.Methods) {
if (method.Name == ".cctor")
continue;
@@ -80,7 +80,7 @@ namespace de4dot.code.deobfuscators.CodeFort {
return creatorMethod;
}
- protected override object checkCctor(ref TypeDefinition type, MethodDefinition cctor) {
+ protected override object checkCctor(ref TypeDef type, MethodDef cctor) {
var instrs = cctor.Body.Instructions;
if (instrs.Count != 3)
return null;
@@ -90,15 +90,15 @@ namespace de4dot.code.deobfuscators.CodeFort {
var call = instrs[1];
if (call.OpCode.Code != Code.Call)
return null;
- if (!isDelegateCreatorMethod(call.Operand as MethodDefinition))
+ if (!isDelegateCreatorMethod(call.Operand as MethodDef))
return null;
int rid = DotNetUtils.getLdcI4Value(ldci4);
- if (cctor.DeclaringType.MetadataToken.RID != rid)
+ if (cctor.DeclaringType.MDToken.RID != rid)
throw new ApplicationException("Invalid rid");
return rid;
}
- protected override void getCallInfo(object context, FieldDefinition field, out MethodReference calledMethod, out OpCode callOpcode) {
+ protected override void getCallInfo(object context, FieldDef field, out MethodReference calledMethod, out OpCode callOpcode) {
if (memberReferences == null)
memberReferences = new List(module.GetMemberReferences());
diff --git a/de4dot.code/deobfuscators/CodeFort/StringDecrypter.cs b/de4dot.code/deobfuscators/CodeFort/StringDecrypter.cs
index 6575bab6..cdad1a20 100644
--- a/de4dot.code/deobfuscators/CodeFort/StringDecrypter.cs
+++ b/de4dot.code/deobfuscators/CodeFort/StringDecrypter.cs
@@ -18,24 +18,24 @@
*/
using System.Text;
-using Mono.Cecil;
-using Mono.Cecil.Cil;
+using dot10.DotNet;
+using dot10.DotNet.Emit;
using de4dot.blocks;
namespace de4dot.code.deobfuscators.CodeFort {
class StringDecrypter {
ModuleDefinition module;
- MethodDefinition decryptMethod;
+ MethodDef decryptMethod;
public bool Detected {
get { return decryptMethod != null; }
}
- public MethodDefinition Method {
+ public MethodDef Method {
get { return decryptMethod; }
}
- public TypeDefinition Type {
+ public TypeDef Type {
get { return decryptMethod == null ? null : decryptMethod.DeclaringType; }
}
@@ -53,14 +53,14 @@ namespace de4dot.code.deobfuscators.CodeFort {
}
}
- static MethodDefinition checkType(TypeDefinition type) {
+ static MethodDef checkType(TypeDef type) {
if (type.HasFields)
return null;
return checkMethods(type);
}
- static MethodDefinition checkMethods(TypeDefinition type) {
- MethodDefinition decryptMethod = null;
+ static MethodDef checkMethods(TypeDef type) {
+ MethodDef decryptMethod = null;
foreach (var method in type.Methods) {
if (method.Name == ".cctor")
continue;
@@ -76,7 +76,7 @@ namespace de4dot.code.deobfuscators.CodeFort {
return decryptMethod;
}
- static bool hasDouble(MethodDefinition method, double value) {
+ static bool hasDouble(MethodDef method, double value) {
if (method == null || method.Body == null)
return false;
foreach (var instr in method.Body.Instructions) {
diff --git a/de4dot.code/deobfuscators/CodeVeil/AssemblyResolver.cs b/de4dot.code/deobfuscators/CodeVeil/AssemblyResolver.cs
index 04d8ccd2..5ad69231 100644
--- a/de4dot.code/deobfuscators/CodeVeil/AssemblyResolver.cs
+++ b/de4dot.code/deobfuscators/CodeVeil/AssemblyResolver.cs
@@ -20,8 +20,8 @@
using System.Collections.Generic;
using System.IO;
using System.Xml;
-using Mono.Cecil;
-using Mono.Cecil.Cil;
+using dot10.DotNet;
+using dot10.DotNet.Emit;
using de4dot.blocks;
namespace de4dot.code.deobfuscators.CodeVeil {
@@ -29,12 +29,12 @@ namespace de4dot.code.deobfuscators.CodeVeil {
ModuleDefinition module;
EmbeddedResource bundleData;
EmbeddedResource bundleXmlFile;
- TypeDefinition bundleType;
- TypeDefinition assemblyManagerType;
- TypeDefinition bundleStreamProviderIFace;
- TypeDefinition xmlParserType;
- TypeDefinition bundledAssemblyType;
- TypeDefinition streamProviderType;
+ TypeDef bundleType;
+ TypeDef assemblyManagerType;
+ TypeDef bundleStreamProviderIFace;
+ TypeDef xmlParserType;
+ TypeDef bundledAssemblyType;
+ TypeDef streamProviderType;
List infos = new List();
public class AssemblyInfo {
@@ -66,9 +66,9 @@ namespace de4dot.code.deobfuscators.CodeVeil {
}
}
- public IEnumerable BundleTypes {
+ public IEnumerable BundleTypes {
get {
- var list = new List();
+ var list = new List();
if (!CanRemoveTypes)
return list;
@@ -167,7 +167,7 @@ namespace de4dot.code.deobfuscators.CodeVeil {
return value;
}
- TypeDefinition findBundleType() {
+ TypeDef findBundleType() {
foreach (var type in module.Types) {
if (type.Namespace != "")
continue;
@@ -193,7 +193,7 @@ namespace de4dot.code.deobfuscators.CodeVeil {
return null;
}
- MethodDefinition findInitMethod(TypeDefinition type) {
+ MethodDef findInitMethod(TypeDef type) {
foreach (var method in type.Methods) {
if (!method.IsStatic || method.Body == null)
continue;
@@ -208,7 +208,7 @@ namespace de4dot.code.deobfuscators.CodeVeil {
return null;
}
- MethodDefinition findGetTempFilenameMethod(TypeDefinition type) {
+ MethodDef findGetTempFilenameMethod(TypeDef type) {
foreach (var method in type.Methods) {
if (method.IsStatic || method.Body == null)
continue;
@@ -234,7 +234,7 @@ namespace de4dot.code.deobfuscators.CodeVeil {
return;
foreach (var field in bundleType.Fields) {
- var type = field.FieldType as TypeDefinition;
+ var type = field.FieldType as TypeDef;
if (type == null)
continue;
if (type == bundleType)
@@ -245,7 +245,7 @@ namespace de4dot.code.deobfuscators.CodeVeil {
var ctor = DotNetUtils.getMethod(type, ".ctor");
if (ctor == null || ctor.Parameters.Count != 2)
continue;
- var iface = ctor.Parameters[1].ParameterType as TypeDefinition;
+ var iface = ctor.Parameters[1].ParameterType as TypeDef;
if (iface == null || !iface.IsInterface)
continue;
@@ -259,7 +259,7 @@ namespace de4dot.code.deobfuscators.CodeVeil {
if (assemblyManagerType == null)
return;
foreach (var field in assemblyManagerType.Fields) {
- var type = field.FieldType as TypeDefinition;
+ var type = field.FieldType as TypeDef;
if (type == null || type.IsInterface)
continue;
var ctor = DotNetUtils.getMethod(type, ".ctor");
@@ -274,7 +274,7 @@ namespace de4dot.code.deobfuscators.CodeVeil {
continue;
if (git.GenericArguments.Count != 1)
continue;
- var type2 = git.GenericArguments[0] as TypeDefinition;
+ var type2 = git.GenericArguments[0] as TypeDef;
if (type2 == null)
continue;
@@ -293,7 +293,7 @@ namespace de4dot.code.deobfuscators.CodeVeil {
foreach (var instr in ctor.Body.Instructions) {
if (instr.OpCode.Code != Code.Newobj)
continue;
- var newobjCtor = instr.Operand as MethodDefinition;
+ var newobjCtor = instr.Operand as MethodDef;
if (newobjCtor == null)
continue;
if (newobjCtor.DeclaringType == assemblyManagerType)
diff --git a/de4dot.code/deobfuscators/CodeVeil/Deobfuscator.cs b/de4dot.code/deobfuscators/CodeVeil/Deobfuscator.cs
index f50b9868..c9b9ea6d 100644
--- a/de4dot.code/deobfuscators/CodeVeil/Deobfuscator.cs
+++ b/de4dot.code/deobfuscators/CodeVeil/Deobfuscator.cs
@@ -19,7 +19,7 @@
using System;
using System.Collections.Generic;
-using Mono.Cecil;
+using dot10.DotNet;
using Mono.MyStuff;
using de4dot.blocks;
@@ -62,7 +62,7 @@ namespace de4dot.code.deobfuscators.CodeVeil {
ProxyCallFixer proxyCallFixer;
StringDecrypter stringDecrypter;
AssemblyResolver assemblyResolver;
- TypeDefinition killType;
+ TypeDef killType;
ResourceDecrypter resourceDecrypter;
internal class Options : OptionsBase {
@@ -279,7 +279,7 @@ namespace de4dot.code.deobfuscators.CodeVeil {
public override IEnumerable getStringDecrypterMethods() {
var list = new List();
if (stringDecrypter.DecryptMethod != null)
- list.Add(stringDecrypter.DecryptMethod.MetadataToken.ToInt32());
+ list.Add(stringDecrypter.DecryptMethod.MDToken.ToInt32());
return list;
}
}
diff --git a/de4dot.code/deobfuscators/CodeVeil/InvalidMethodsFinder.cs b/de4dot.code/deobfuscators/CodeVeil/InvalidMethodsFinder.cs
index 880f08d9..a9603fa7 100644
--- a/de4dot.code/deobfuscators/CodeVeil/InvalidMethodsFinder.cs
+++ b/de4dot.code/deobfuscators/CodeVeil/InvalidMethodsFinder.cs
@@ -18,12 +18,12 @@
*/
using System.Collections.Generic;
-using Mono.Cecil;
+using dot10.DotNet;
namespace de4dot.code.deobfuscators.CodeVeil {
class InvalidMethodsFinder {
- public static List findAll(ModuleDefinition module) {
- var list = new List();
+ public static List findAll(ModuleDefinition module) {
+ var list = new List();
foreach (var type in module.GetTypes()) {
foreach (var method in type.Methods) {
if (isInvalidMethod(method))
@@ -33,14 +33,14 @@ namespace de4dot.code.deobfuscators.CodeVeil {
return list;
}
- public static bool isInvalidMethod(MethodDefinition method) {
+ public static bool isInvalidMethod(MethodDef method) {
if (method == null)
return false;
if (method.IsStatic)
return false;
if (method.Parameters.Count != 0)
return false;
- var retType = method.MethodReturnType.ReturnType as GenericParameter;
+ var retType = method.MethodReturnType.ReturnType as GenericParam;
if (retType == null)
return false;
diff --git a/de4dot.code/deobfuscators/CodeVeil/MainType.cs b/de4dot.code/deobfuscators/CodeVeil/MainType.cs
index d5f3e32a..c3868f61 100644
--- a/de4dot.code/deobfuscators/CodeVeil/MainType.cs
+++ b/de4dot.code/deobfuscators/CodeVeil/MainType.cs
@@ -18,8 +18,8 @@
*/
using System.Collections.Generic;
-using Mono.Cecil;
-using Mono.Cecil.Cil;
+using dot10.DotNet;
+using dot10.DotNet.Emit;
using Mono.Cecil.Metadata;
using de4dot.blocks;
@@ -27,12 +27,12 @@ namespace de4dot.code.deobfuscators.CodeVeil {
// Detects the type CV adds to the assembly that gets called from ::.cctor.
class MainType {
ModuleDefinition module;
- TypeDefinition theType;
- MethodDefinition initMethod;
- MethodDefinition tamperCheckMethod;
+ TypeDef theType;
+ MethodDef initMethod;
+ MethodDef tamperCheckMethod;
ObfuscatorVersion obfuscatorVersion = ObfuscatorVersion.Unknown;
List rvas = new List(); // _stub and _executive
- List otherInitMethods = new List();
+ List otherInitMethods = new List();
public bool Detected {
get { return theType != null; }
@@ -42,19 +42,19 @@ namespace de4dot.code.deobfuscators.CodeVeil {
get { return obfuscatorVersion; }
}
- public TypeDefinition Type {
+ public TypeDef Type {
get { return theType; }
}
- public MethodDefinition InitMethod {
+ public MethodDef InitMethod {
get { return initMethod; }
}
- public List OtherInitMethods {
+ public List OtherInitMethods {
get { return otherInitMethods; }
}
- public MethodDefinition TamperCheckMethod {
+ public MethodDef TamperCheckMethod {
get { return tamperCheckMethod; }
}
@@ -99,7 +99,7 @@ namespace de4dot.code.deobfuscators.CodeVeil {
var call = instrs[i + 2];
if (call.OpCode.Code != Code.Call)
continue;
- var initMethodTmp = call.Operand as MethodDefinition;
+ var initMethodTmp = call.Operand as MethodDef;
ObfuscatorVersion obfuscatorVersionTmp;
if (!checkInitMethod(initMethodTmp, out obfuscatorVersionTmp))
continue;
@@ -118,7 +118,7 @@ namespace de4dot.code.deobfuscators.CodeVeil {
"System.Collections.Generic.List`1",
"System.Runtime.InteropServices.GCHandle",
};
- bool checkInitMethod(MethodDefinition initMethod, out ObfuscatorVersion obfuscatorVersionTmp) {
+ bool checkInitMethod(MethodDef initMethod, out ObfuscatorVersion obfuscatorVersionTmp) {
obfuscatorVersionTmp = ObfuscatorVersion.Unknown;
if (initMethod == null)
@@ -146,7 +146,7 @@ namespace de4dot.code.deobfuscators.CodeVeil {
return true;
}
- static bool hasCodeString(MethodDefinition method, string str) {
+ static bool hasCodeString(MethodDef method, string str) {
foreach (var s in DotNetUtils.getCodeStrings(method)) {
if (s == str)
return true;
@@ -154,7 +154,7 @@ namespace de4dot.code.deobfuscators.CodeVeil {
return false;
}
- bool checkMethodsType(TypeDefinition type) {
+ bool checkMethodsType(TypeDef type) {
rvas = new List();
var fields = getRvaFields(type);
@@ -166,8 +166,8 @@ namespace de4dot.code.deobfuscators.CodeVeil {
return true;
}
- static List getRvaFields(TypeDefinition type) {
- var fields = new List();
+ static List getRvaFields(TypeDef type) {
+ var fields = new List();
foreach (var field in type.Fields) {
if (field.FieldType.EType != ElementType.U1 && field.FieldType.EType != ElementType.U4)
continue;
@@ -187,7 +187,7 @@ namespace de4dot.code.deobfuscators.CodeVeil {
otherInitMethods = findOtherInitMethods();
}
- MethodDefinition findTamperCheckMethod() {
+ MethodDef findTamperCheckMethod() {
foreach (var method in theType.Methods) {
if (!method.IsStatic || method.Body == null)
continue;
@@ -200,8 +200,8 @@ namespace de4dot.code.deobfuscators.CodeVeil {
return null;
}
- List findOtherInitMethods() {
- var list = new List();
+ List findOtherInitMethods() {
+ var list = new List();
foreach (var method in theType.Methods) {
if (!method.IsStatic)
continue;
@@ -215,7 +215,7 @@ namespace de4dot.code.deobfuscators.CodeVeil {
return list;
}
- public MethodDefinition getInitStringDecrypterMethod(MethodDefinition stringDecrypterInitMethod) {
+ public MethodDef getInitStringDecrypterMethod(MethodDef stringDecrypterInitMethod) {
if (stringDecrypterInitMethod == null)
return null;
if (theType == null)
@@ -230,7 +230,7 @@ namespace de4dot.code.deobfuscators.CodeVeil {
return null;
}
- bool callsMethod(MethodDefinition methodToCheck, MethodDefinition calledMethod) {
+ bool callsMethod(MethodDef methodToCheck, MethodDef calledMethod) {
foreach (var method in DotNetUtils.getCalledMethods(module, methodToCheck)) {
if (method == calledMethod)
return true;
diff --git a/de4dot.code/deobfuscators/CodeVeil/MethodsDecrypter.cs b/de4dot.code/deobfuscators/CodeVeil/MethodsDecrypter.cs
index b4520ede..61bf1364 100644
--- a/de4dot.code/deobfuscators/CodeVeil/MethodsDecrypter.cs
+++ b/de4dot.code/deobfuscators/CodeVeil/MethodsDecrypter.cs
@@ -20,8 +20,8 @@
using System;
using System.Collections.Generic;
using System.IO;
-using Mono.Cecil;
-using Mono.Cecil.Cil;
+using dot10.DotNet;
+using dot10.DotNet.Emit;
using Mono.Cecil.Metadata;
using Mono.MyStuff;
using de4dot.blocks;
diff --git a/de4dot.code/deobfuscators/CodeVeil/ProxyCallFixer.cs b/de4dot.code/deobfuscators/CodeVeil/ProxyCallFixer.cs
index e5d3bc1f..df3b3429 100644
--- a/de4dot.code/deobfuscators/CodeVeil/ProxyCallFixer.cs
+++ b/de4dot.code/deobfuscators/CodeVeil/ProxyCallFixer.cs
@@ -20,8 +20,8 @@
using System;
using System.Collections.Generic;
using System.IO;
-using Mono.Cecil;
-using Mono.Cecil.Cil;
+using dot10.DotNet;
+using dot10.DotNet.Emit;
using Mono.Cecil.Metadata;
using de4dot.blocks;
@@ -32,12 +32,12 @@ namespace de4dot.code.deobfuscators.CodeVeil {
BinaryReader reader;
class Info {
- public TypeDefinition proxyType;
- public MethodDefinition initMethod;
- public FieldDefinition dataField;
- public TypeDefinition ilgeneratorType;
- public TypeDefinition fieldInfoType;
- public TypeDefinition methodInfoType;
+ public TypeDef proxyType;
+ public MethodDef initMethod;
+ public FieldDef dataField;
+ public TypeDef ilgeneratorType;
+ public TypeDef fieldInfoType;
+ public TypeDef methodInfoType;
}
class Context {
@@ -61,15 +61,15 @@ namespace de4dot.code.deobfuscators.CodeVeil {
}
}
- public TypeDefinition IlGeneratorType {
+ public TypeDef IlGeneratorType {
get { return info.ilgeneratorType; }
}
- public TypeDefinition FieldInfoType {
+ public TypeDef FieldInfoType {
get { return info.fieldInfoType; }
}
- public TypeDefinition MethodInfoType {
+ public TypeDef MethodInfoType {
get { return info.methodInfoType; }
}
@@ -89,7 +89,7 @@ namespace de4dot.code.deobfuscators.CodeVeil {
info.methodInfoType = lookup(oldOne.info.methodInfoType, "Could not find methodInfoType");
}
- protected override object checkCctor(ref TypeDefinition type, MethodDefinition cctor) {
+ protected override object checkCctor(ref TypeDef type, MethodDef cctor) {
var instrs = cctor.Body.Instructions;
for (int i = 0; i < instrs.Count - 1; i++) {
var ldci4 = instrs[i];
@@ -105,14 +105,14 @@ namespace de4dot.code.deobfuscators.CodeVeil {
int offset = DotNetUtils.getLdcI4Value(ldci4);
reader.BaseStream.Position = offset;
int rid = DeobUtils.readVariableLengthInt32(reader);
- if (rid != type.MetadataToken.RID)
+ if (rid != type.MDToken.RID)
throw new ApplicationException("Invalid RID");
return string.Empty; // It's non-null
}
return null;
}
- protected override void getCallInfo(object context, FieldDefinition field, out MethodReference calledMethod, out OpCode callOpcode) {
+ protected override void getCallInfo(object context, FieldDef field, out MethodReference calledMethod, out OpCode callOpcode) {
byte flags = reader.ReadByte();
int methodToken = 0x06000000 + ((flags & 0x3F) << 24) + DeobUtils.readVariableLengthInt32(reader);
@@ -122,7 +122,7 @@ namespace de4dot.code.deobfuscators.CodeVeil {
calledMethod = module.LookupToken(methodToken) as MethodReference;
if (calledMethod == null)
throw new ApplicationException("Could not find method");
- if (genericTypeToken != -1 && calledMethod.DeclaringType.MetadataToken.ToInt32() != genericTypeToken)
+ if (genericTypeToken != -1 && calledMethod.DeclaringType.MDToken.ToInt32() != genericTypeToken)
throw new ApplicationException("Invalid declaring type token");
}
@@ -138,7 +138,7 @@ namespace de4dot.code.deobfuscators.CodeVeil {
setDelegateCreatorMethod(info.initMethod);
}
- bool initializeInfo(Info infoTmp, TypeDefinition type) {
+ bool initializeInfo(Info infoTmp, TypeDef type) {
foreach (var dtype in type.NestedTypes) {
var cctor = DotNetUtils.getMethod(dtype, ".cctor");
if (cctor == null)
@@ -152,7 +152,7 @@ namespace de4dot.code.deobfuscators.CodeVeil {
return false;
}
- bool initProxyType(Info infoTmp, MethodDefinition method) {
+ bool initProxyType(Info infoTmp, MethodDef method) {
foreach (var calledMethod in DotNetUtils.getCalledMethods(module, method)) {
if (!calledMethod.IsStatic)
continue;
@@ -175,7 +175,7 @@ namespace de4dot.code.deobfuscators.CodeVeil {
"System.Reflection.Emit.OpCode",
"System.Reflection.Emit.OpCode[]",
};
- bool checkProxyType(Info infoTmp, TypeDefinition type) {
+ bool checkProxyType(Info infoTmp, TypeDef type) {
if (type.NestedTypes.Count != 1)
return false;
@@ -196,8 +196,8 @@ namespace de4dot.code.deobfuscators.CodeVeil {
return true;
}
- static List getRvaFields(TypeDefinition type) {
- var fields = new List();
+ static List getRvaFields(TypeDef type) {
+ var fields = new List();
foreach (var field in type.Fields) {
if (field.RVA != 0)
fields.Add(field);
@@ -205,9 +205,9 @@ namespace de4dot.code.deobfuscators.CodeVeil {
return fields;
}
- protected override IEnumerable getDelegateTypes() {
+ protected override IEnumerable getDelegateTypes() {
if (!mainType.Detected)
- return new List();
+ return new List();
return mainType.Type.NestedTypes;
}
@@ -233,9 +233,9 @@ namespace de4dot.code.deobfuscators.CodeVeil {
if (method.Parameters[2].ParameterType.FullName != "System.Type[]")
continue;
- var methodType = method.Parameters[0].ParameterType as TypeDefinition;
- var fieldType = method.Parameters[1].ParameterType as TypeDefinition;
- var ilgType = method.Parameters[3].ParameterType as TypeDefinition;
+ var methodType = method.Parameters[0].ParameterType as TypeDef;
+ var fieldType = method.Parameters[1].ParameterType as TypeDef;
+ var ilgType = method.Parameters[3].ParameterType as TypeDef;
if (!checkMethodType(methodType))
continue;
if (!checkFieldType(fieldType))
@@ -249,7 +249,7 @@ namespace de4dot.code.deobfuscators.CodeVeil {
}
}
- bool checkMethodType(TypeDefinition type) {
+ bool checkMethodType(TypeDef type) {
if (type == null || type.BaseType == null || type.BaseType.EType != ElementType.Object)
return false;
if (type.Fields.Count != 1)
@@ -260,7 +260,7 @@ namespace de4dot.code.deobfuscators.CodeVeil {
return true;
}
- bool checkFieldType(TypeDefinition type) {
+ bool checkFieldType(TypeDef type) {
if (type == null || type.BaseType == null || type.BaseType.EType != ElementType.Object)
return false;
if (DotNetUtils.getField(type, "System.Reflection.FieldInfo") == null)
@@ -269,7 +269,7 @@ namespace de4dot.code.deobfuscators.CodeVeil {
return true;
}
- bool checkIlGeneratorType(TypeDefinition type) {
+ bool checkIlGeneratorType(TypeDef type) {
if (type == null || type.BaseType == null || type.BaseType.EType != ElementType.Object)
return false;
if (type.Fields.Count != 1)
diff --git a/de4dot.code/deobfuscators/CodeVeil/ResourceConverter.cs b/de4dot.code/deobfuscators/CodeVeil/ResourceConverter.cs
index 2c79c9f9..9a05275f 100644
--- a/de4dot.code/deobfuscators/CodeVeil/ResourceConverter.cs
+++ b/de4dot.code/deobfuscators/CodeVeil/ResourceConverter.cs
@@ -19,7 +19,7 @@
using System;
using System.IO;
-using Mono.Cecil;
+using dot10.DotNet;
using de4dot.code.resources;
namespace de4dot.code.deobfuscators.CodeVeil {
diff --git a/de4dot.code/deobfuscators/CodeVeil/ResourceDecrypter.cs b/de4dot.code/deobfuscators/CodeVeil/ResourceDecrypter.cs
index c08dcfa2..650cc868 100644
--- a/de4dot.code/deobfuscators/CodeVeil/ResourceDecrypter.cs
+++ b/de4dot.code/deobfuscators/CodeVeil/ResourceDecrypter.cs
@@ -19,23 +19,23 @@
using System;
using System.IO;
-using Mono.Cecil;
-using Mono.Cecil.Cil;
+using dot10.DotNet;
+using dot10.DotNet.Emit;
using Mono.Cecil.Metadata;
using de4dot.blocks;
namespace de4dot.code.deobfuscators.CodeVeil {
class ResourceDecrypter {
ModuleDefinition module;
- TypeDefinition encryptedResourceStreamType;
- TypeDefinition encryptedResourceSetType;
- MethodDefinition encryptedResourceSet_GetDefaultReader;
- TypeDefinition encryptedResourceReaderType;
+ TypeDef encryptedResourceStreamType;
+ TypeDef encryptedResourceSetType;
+ MethodDef encryptedResourceSet_GetDefaultReader;
+ TypeDef encryptedResourceReaderType;
GenericInstanceType encryptedResourceReaderTypeDict;
- TypeDefinition resType;
- MethodDefinition resTypeCtor;
- TypeDefinition resourceFlagsType;
- TypeDefinition resourceEnumeratorType;
+ TypeDef resType;
+ MethodDef resTypeCtor;
+ TypeDef resourceFlagsType;
+ TypeDef resourceEnumeratorType;
MethodCallRestorerBase methodsRestorer;
public bool CanRemoveTypes {
@@ -49,27 +49,27 @@ namespace de4dot.code.deobfuscators.CodeVeil {
}
}
- public TypeDefinition EncryptedResourceStreamType {
+ public TypeDef EncryptedResourceStreamType {
get { return encryptedResourceStreamType; }
}
- public TypeDefinition EncryptedResourceSetType {
+ public TypeDef EncryptedResourceSetType {
get { return encryptedResourceSetType; }
}
- public TypeDefinition EncryptedResourceReaderType {
+ public TypeDef EncryptedResourceReaderType {
get { return encryptedResourceReaderType; }
}
- public TypeDefinition ResType {
+ public TypeDef ResType {
get { return resType; }
}
- public TypeDefinition ResourceFlagsType {
+ public TypeDef ResourceFlagsType {
get { return resourceFlagsType; }
}
- public TypeDefinition ResourceEnumeratorType {
+ public TypeDef ResourceEnumeratorType {
get { return resourceEnumeratorType; }
}
@@ -122,7 +122,7 @@ namespace de4dot.code.deobfuscators.CodeVeil {
void findResourceFlags() {
if (resTypeCtor == null || resTypeCtor.Parameters.Count != 4)
return;
- var type = resTypeCtor.Parameters[2].ParameterType as TypeDefinition;
+ var type = resTypeCtor.Parameters[2].ParameterType as TypeDef;
if (type == null || !type.IsEnum)
return;
@@ -137,7 +137,7 @@ namespace de4dot.code.deobfuscators.CodeVeil {
void findResType() {
if (encryptedResourceReaderTypeDict == null)
return;
- var type = encryptedResourceReaderTypeDict.GenericArguments[1] as TypeDefinition;
+ var type = encryptedResourceReaderTypeDict.GenericArguments[1] as TypeDef;
if (type == null)
return;
if (type.BaseType == null || type.BaseType.EType != ElementType.Object)
@@ -175,7 +175,7 @@ namespace de4dot.code.deobfuscators.CodeVeil {
encryptedResourceReaderTypeDict = dictType;
}
- static bool hasInterface(TypeDefinition type, string interfaceFullName) {
+ static bool hasInterface(TypeDef type, string interfaceFullName) {
foreach (var iface in type.Interfaces) {
if (iface.FullName == interfaceFullName)
return true;
@@ -183,7 +183,7 @@ namespace de4dot.code.deobfuscators.CodeVeil {
return false;
}
- static GenericInstanceType getDlxResDict(TypeDefinition type) {
+ static GenericInstanceType getDlxResDict(TypeDef type) {
foreach (var field in type.Fields) {
var fieldType = field.FieldType as GenericInstanceType;
if (fieldType == null)
@@ -194,20 +194,20 @@ namespace de4dot.code.deobfuscators.CodeVeil {
continue;
if (fieldType.GenericArguments[0].FullName != "System.String")
continue;
- if (!(fieldType.GenericArguments[1] is TypeDefinition))
+ if (!(fieldType.GenericArguments[1] is TypeDef))
continue;
return fieldType;
}
return null;
}
- static TypeDefinition getTypeFromCode(MethodDefinition method) {
+ static TypeDef getTypeFromCode(MethodDef method) {
if (method == null || method.Body == null)
return null;
foreach (var instr in method.Body.Instructions) {
if (instr.OpCode.Code != Code.Ldtoken)
continue;
- var type = instr.Operand as TypeDefinition;
+ var type = instr.Operand as TypeDef;
if (type != null)
return type;
}
@@ -260,7 +260,7 @@ namespace de4dot.code.deobfuscators.CodeVeil {
if (findXxteaMethod(type) == null)
continue;
- MethodDefinition getManifestResourceStreamMethodTmp1, getManifestResourceStreamMethodTmp2;
+ MethodDef getManifestResourceStreamMethodTmp1, getManifestResourceStreamMethodTmp2;
if (!findManifestResourceStreamMethods(type, out getManifestResourceStreamMethodTmp1, out getManifestResourceStreamMethodTmp2))
continue;
@@ -271,7 +271,7 @@ namespace de4dot.code.deobfuscators.CodeVeil {
}
}
- static MethodDefinition findXxteaMethod(TypeDefinition type) {
+ static MethodDef findXxteaMethod(TypeDef type) {
foreach (var method in type.Methods) {
if (!method.IsPrivate || method.IsStatic || method.Body == null)
continue;
@@ -292,7 +292,7 @@ namespace de4dot.code.deobfuscators.CodeVeil {
return null;
}
- static bool findManifestResourceStreamMethods(TypeDefinition type, out MethodDefinition getManifestResourceStreamMethodTmp1, out MethodDefinition getManifestResourceStreamMethodTmp2) {
+ static bool findManifestResourceStreamMethods(TypeDef type, out MethodDef getManifestResourceStreamMethodTmp1, out MethodDef getManifestResourceStreamMethodTmp2) {
getManifestResourceStreamMethodTmp1 = null;
getManifestResourceStreamMethodTmp2 = null;
foreach (var method in type.Methods) {
diff --git a/de4dot.code/deobfuscators/CodeVeil/StringDecrypter.cs b/de4dot.code/deobfuscators/CodeVeil/StringDecrypter.cs
index c959bce4..e01b7a08 100644
--- a/de4dot.code/deobfuscators/CodeVeil/StringDecrypter.cs
+++ b/de4dot.code/deobfuscators/CodeVeil/StringDecrypter.cs
@@ -19,33 +19,33 @@
using System;
using System.IO;
-using Mono.Cecil;
-using Mono.Cecil.Cil;
+using dot10.DotNet;
+using dot10.DotNet.Emit;
using de4dot.blocks;
namespace de4dot.code.deobfuscators.CodeVeil {
class StringDecrypter {
ModuleDefinition module;
MainType mainType;
- TypeDefinition decrypterType;
- FieldDefinition stringDataField;
- MethodDefinition initMethod;
- MethodDefinition decrypterMethod;
+ TypeDef decrypterType;
+ FieldDef stringDataField;
+ MethodDef initMethod;
+ MethodDef decrypterMethod;
string[] decryptedStrings;
public bool Detected {
get { return decrypterType != null; }
}
- public TypeDefinition Type {
+ public TypeDef Type {
get { return decrypterType; }
}
- public MethodDefinition InitMethod {
+ public MethodDef InitMethod {
get { return initMethod; }
}
- public MethodDefinition DecryptMethod {
+ public MethodDef DecryptMethod {
get { return decrypterMethod; }
}
@@ -79,7 +79,7 @@ namespace de4dot.code.deobfuscators.CodeVeil {
findV5(cctor);
}
- bool find(MethodDefinition method) {
+ bool find(MethodDef method) {
if (method == null || method.Body == null || !method.IsStatic)
return false;
@@ -88,7 +88,7 @@ namespace de4dot.code.deobfuscators.CodeVeil {
var call = instrs[i];
if (call.OpCode.Code != Code.Call)
continue;
- var initMethodTmp = call.Operand as MethodDefinition;
+ var initMethodTmp = call.Operand as MethodDef;
if (initMethodTmp == null || initMethodTmp.Body == null || !initMethodTmp.IsStatic)
continue;
if (!DotNetUtils.isMethod(initMethodTmp, "System.Void", "()"))
@@ -105,7 +105,7 @@ namespace de4dot.code.deobfuscators.CodeVeil {
}
// The main decrypter type calls the string decrypter init method inside its init method
- void findV5(MethodDefinition method) {
+ void findV5(MethodDef method) {
if (!mainType.Detected)
return;
foreach (var calledMethod in DotNetUtils.getCalledMethods(module, mainType.InitMethod)) {
@@ -114,7 +114,7 @@ namespace de4dot.code.deobfuscators.CodeVeil {
}
}
- bool checkType(TypeDefinition type) {
+ bool checkType(TypeDef type) {
if (!type.HasNestedTypes)
return false;
@@ -134,8 +134,8 @@ namespace de4dot.code.deobfuscators.CodeVeil {
return true;
}
- static MethodDefinition getDecrypterMethod(TypeDefinition type) {
- MethodDefinition foundMethod = null;
+ static MethodDef getDecrypterMethod(TypeDef type) {
+ MethodDef foundMethod = null;
foreach (var method in type.Methods) {
if (method.Body == null || !method.IsStatic)
continue;
@@ -155,11 +155,11 @@ namespace de4dot.code.deobfuscators.CodeVeil {
"System.String[]",
"System.UInt32[]",
};
- FieldDefinition checkFields(TypeDefinition type) {
+ FieldDef checkFields(TypeDef type) {
if (!new FieldTypes(type).all(requiredFields))
return null;
- FieldDefinition stringData = null;
+ FieldDef stringData = null;
foreach (var field in type.Fields) {
if (field.RVA != 0) {
if (stringData != null)
@@ -193,7 +193,7 @@ namespace de4dot.code.deobfuscators.CodeVeil {
stringDataField.InitialValue = new byte[1];
}
- static uint[] getKey(MethodDefinition method) {
+ static uint[] getKey(MethodDef method) {
var instrs = method.Body.Instructions;
for (int i = 0; i < instrs.Count - 1; i++) {
var ldci4 = instrs[i];
diff --git a/de4dot.code/deobfuscators/CodeVeil/TamperDetection.cs b/de4dot.code/deobfuscators/CodeVeil/TamperDetection.cs
index b55245c9..92b2df88 100644
--- a/de4dot.code/deobfuscators/CodeVeil/TamperDetection.cs
+++ b/de4dot.code/deobfuscators/CodeVeil/TamperDetection.cs
@@ -18,8 +18,8 @@
*/
using System.Collections.Generic;
-using Mono.Cecil;
-using Mono.Cecil.Cil;
+using dot10.DotNet;
+using dot10.DotNet.Emit;
using Mono.Cecil.Metadata;
using de4dot.blocks;
@@ -27,14 +27,14 @@ namespace de4dot.code.deobfuscators.CodeVeil {
class TamperDetection {
ModuleDefinition module;
MainType mainType;
- TypeDefinition tamperDetectionType;
- List tamperDetectionMethods = new List();
+ TypeDef tamperDetectionType;
+ List tamperDetectionMethods = new List();
- public TypeDefinition Type {
+ public TypeDef Type {
get { return tamperDetectionType; }
}
- public List Methods {
+ public List Methods {
get { return tamperDetectionMethods; }
}
@@ -82,7 +82,7 @@ namespace de4dot.code.deobfuscators.CodeVeil {
}
}
- bool checkTamperDetectionClasses(IEnumerable types) {
+ bool checkTamperDetectionClasses(IEnumerable types) {
foreach (var type in types) {
if (!isTamperDetectionClass(type))
return false;
@@ -90,13 +90,13 @@ namespace de4dot.code.deobfuscators.CodeVeil {
return true;
}
- bool isTamperDetectionClass(TypeDefinition type) {
+ bool isTamperDetectionClass(TypeDef type) {
if (type.BaseType == null || type.BaseType.EType != ElementType.Object)
return false;
if ((type.Attributes & ~TypeAttributes.Sealed) != TypeAttributes.NestedAssembly)
return false;
- MethodDefinition cctor = null, initMethod = null;
+ MethodDef cctor = null, initMethod = null;
foreach (var method in type.Methods) {
if (InvalidMethodsFinder.isInvalidMethod(method))
continue;
@@ -116,7 +116,7 @@ namespace de4dot.code.deobfuscators.CodeVeil {
return true;
}
- bool callsMainTypeTamperCheckMethod(MethodDefinition method) {
+ bool callsMainTypeTamperCheckMethod(MethodDef method) {
foreach (var calledMethod in DotNetUtils.getCalledMethods(module, method)) {
if (calledMethod == mainType.TamperCheckMethod)
return true;
@@ -142,7 +142,7 @@ namespace de4dot.code.deobfuscators.CodeVeil {
}
static bool checkInvokeCall(Instruction instr, string returnType, string parameters) {
- var method = instr.Operand as MethodDefinition;
+ var method = instr.Operand as MethodDef;
if (method == null)
return false;
if (method.Name != "Invoke")
diff --git a/de4dot.code/deobfuscators/CodeWall/AssemblyDecrypter.cs b/de4dot.code/deobfuscators/CodeWall/AssemblyDecrypter.cs
index 6d59bfa7..1e3ed8b0 100644
--- a/de4dot.code/deobfuscators/CodeWall/AssemblyDecrypter.cs
+++ b/de4dot.code/deobfuscators/CodeWall/AssemblyDecrypter.cs
@@ -22,8 +22,8 @@ using System.Collections.Generic;
using System.IO;
using System.Security.Cryptography;
using System.Text;
-using Mono.Cecil;
-using Mono.Cecil.Cil;
+using dot10.DotNet;
+using dot10.DotNet.Emit;
using de4dot.blocks;
using de4dot.code.resources;
@@ -74,7 +74,7 @@ namespace de4dot.code.deobfuscators.CodeWall {
if (!checkEntryPoint(method))
return;
- MethodDefinition decryptAssemblyMethod;
+ MethodDef decryptAssemblyMethod;
var mainKey = getMainResourceKey(method, out decryptAssemblyMethod);
if (mainKey == null)
return;
@@ -100,7 +100,7 @@ namespace de4dot.code.deobfuscators.CodeWall {
"System.AppDomain",
"System.DateTime",
};
- bool checkEntryPoint(MethodDefinition method) {
+ bool checkEntryPoint(MethodDef method) {
if (method == null)
return false;
if (!new LocalTypes(method).all(requiredLocals))
@@ -112,12 +112,12 @@ namespace de4dot.code.deobfuscators.CodeWall {
return true;
}
- void deobfuscateAll(MethodDefinition method) {
+ void deobfuscateAll(MethodDef method) {
simpleDeobfuscator.deobfuscate(method);
simpleDeobfuscator.decryptStrings(method, deob);
}
- string getMainResourceKey(MethodDefinition method, out MethodDefinition decryptAssemblyMethod) {
+ string getMainResourceKey(MethodDef method, out MethodDef decryptAssemblyMethod) {
foreach (var calledMethod in DotNetUtils.getCalledMethods(module, method)) {
if (!calledMethod.IsStatic || calledMethod.Body == null)
continue;
@@ -135,7 +135,7 @@ namespace de4dot.code.deobfuscators.CodeWall {
return null;
}
- string getMainResourceKeyInfo(MethodDefinition method, out MethodDefinition decryptAssemblyMethod) {
+ string getMainResourceKeyInfo(MethodDef method, out MethodDef decryptAssemblyMethod) {
var instrs = method.Body.Instructions;
for (int i = 0; i < instrs.Count - 1; i++) {
var ldstr = instrs[i];
@@ -144,7 +144,7 @@ namespace de4dot.code.deobfuscators.CodeWall {
var call = instrs[i + 1];
if (call.OpCode.Code != Code.Call)
continue;
- var calledMethod = call.Operand as MethodDefinition;
+ var calledMethod = call.Operand as MethodDef;
if (calledMethod == null)
continue;
@@ -155,7 +155,7 @@ namespace de4dot.code.deobfuscators.CodeWall {
return null;
}
- EmbeddedResource getResource(MethodDefinition method, out ModuleDefinition theResourceModule) {
+ EmbeddedResource getResource(MethodDef method, out ModuleDefinition theResourceModule) {
string resourceDllFileName = null;
theResourceModule = module;
foreach (var s in DotNetUtils.getCodeStrings(method)) {
@@ -192,7 +192,7 @@ namespace de4dot.code.deobfuscators.CodeWall {
}
}
- bool getPassword(MethodDefinition method, out string password, out string salt) {
+ bool getPassword(MethodDef method, out string password, out string salt) {
var instrs = method.Body.Instructions;
for (int i = 0; i < instrs.Count - 1; i++) {
var ldstr1 = instrs[i];
diff --git a/de4dot.code/deobfuscators/CodeWall/Deobfuscator.cs b/de4dot.code/deobfuscators/CodeWall/Deobfuscator.cs
index b98f1e71..0ee7b916 100644
--- a/de4dot.code/deobfuscators/CodeWall/Deobfuscator.cs
+++ b/de4dot.code/deobfuscators/CodeWall/Deobfuscator.cs
@@ -19,7 +19,7 @@
using System;
using System.Collections.Generic;
-using Mono.Cecil;
+using dot10.DotNet;
using Mono.MyStuff;
using de4dot.blocks;
using de4dot.PE;
@@ -263,7 +263,7 @@ namespace de4dot.code.deobfuscators.CodeWall {
public override IEnumerable getStringDecrypterMethods() {
var list = new List();
foreach (var info in stringDecrypter.Infos)
- list.Add(info.Method.MetadataToken.ToInt32());
+ list.Add(info.Method.MDToken.ToInt32());
return list;
}
}
diff --git a/de4dot.code/deobfuscators/CodeWall/MethodsDecrypter.cs b/de4dot.code/deobfuscators/CodeWall/MethodsDecrypter.cs
index 672d3dd6..fd0c3fb6 100644
--- a/de4dot.code/deobfuscators/CodeWall/MethodsDecrypter.cs
+++ b/de4dot.code/deobfuscators/CodeWall/MethodsDecrypter.cs
@@ -18,8 +18,8 @@
*/
using System;
-using Mono.Cecil;
-using Mono.Cecil.Cil;
+using dot10.DotNet;
+using dot10.DotNet.Emit;
using Mono.MyStuff;
using de4dot.PE;
using de4dot.blocks;
@@ -51,7 +51,7 @@ namespace de4dot.code.deobfuscators.CodeWall {
}
}
- bool checkCctor(MethodDefinition method) {
+ bool checkCctor(MethodDef method) {
if (method == null || method.Body == null)
return false;
diff --git a/de4dot.code/deobfuscators/CodeWall/StringDecrypter.cs b/de4dot.code/deobfuscators/CodeWall/StringDecrypter.cs
index 1d555420..ee0474b9 100644
--- a/de4dot.code/deobfuscators/CodeWall/StringDecrypter.cs
+++ b/de4dot.code/deobfuscators/CodeWall/StringDecrypter.cs
@@ -21,8 +21,8 @@ using System;
using System.Collections.Generic;
using System.IO;
using System.Text;
-using Mono.Cecil;
-using Mono.Cecil.Cil;
+using dot10.DotNet;
+using dot10.DotNet.Emit;
using de4dot.blocks;
namespace de4dot.code.deobfuscators.CodeWall {
@@ -38,13 +38,13 @@ namespace de4dot.code.deobfuscators.CodeWall {
}
public class StringEncrypterInfo {
- MethodDefinition method;
+ MethodDef method;
- public TypeDefinition Type {
+ public TypeDef Type {
get { return method.DeclaringType; }
}
- public MethodDefinition Method {
+ public MethodDef Method {
get { return method; }
}
@@ -54,7 +54,7 @@ namespace de4dot.code.deobfuscators.CodeWall {
public int Magic3 { get; set; }
public BinaryReader Reader { get; set; }
- public StringEncrypterInfo(MethodDefinition method) {
+ public StringEncrypterInfo(MethodDef method) {
this.method = method;
}
@@ -94,7 +94,7 @@ namespace de4dot.code.deobfuscators.CodeWall {
public override string ToString() {
return string.Format("{0:X8} M1:{1:X8} M2:{2:X8} M3:{3:X8}",
- Method.MetadataToken.ToInt32(),
+ Method.MDToken.ToInt32(),
Magic1, Magic2, Magic3);
}
}
@@ -124,7 +124,7 @@ namespace de4dot.code.deobfuscators.CodeWall {
public void find() {
foreach (var type in module.Types) {
- MethodDefinition decrypterMethod;
+ MethodDef decrypterMethod;
var decrypterVersion = checkType(type, out decrypterMethod);
if (decrypterVersion == Version.Unknown)
continue;
@@ -133,8 +133,8 @@ namespace de4dot.code.deobfuscators.CodeWall {
}
}
- Version checkType(TypeDefinition type, out MethodDefinition decrypterMethod) {
- MethodDefinition method;
+ Version checkType(TypeDef type, out MethodDef decrypterMethod) {
+ MethodDef method;
if ((method = checkType_v30(type)) != null) {
decrypterMethod = method;
@@ -161,8 +161,8 @@ namespace de4dot.code.deobfuscators.CodeWall {
"System.Random",
"System.String",
};
- MethodDefinition checkType_v30(TypeDefinition type) {
- MethodDefinition decrypterMethod = checkMethods_v30(type);
+ MethodDef checkType_v30(TypeDef type) {
+ MethodDef decrypterMethod = checkMethods_v30(type);
if (decrypterMethod == null)
return null;
if (!new FieldTypes(type).exactly(requiredTypes_v30))
@@ -173,12 +173,12 @@ namespace de4dot.code.deobfuscators.CodeWall {
return decrypterMethod;
}
- static MethodDefinition checkMethods_v30(TypeDefinition type) {
+ static MethodDef checkMethods_v30(TypeDef type) {
if (type.Methods.Count < 1 || type.Methods.Count > 2)
return null;
- MethodDefinition decrypterMethod = null;
- MethodDefinition cctor = null;
+ MethodDef decrypterMethod = null;
+ MethodDef cctor = null;
foreach (var method in type.Methods) {
if (method.Name == ".cctor") {
cctor = method;
@@ -208,8 +208,8 @@ namespace de4dot.code.deobfuscators.CodeWall {
"System.String",
"System.Object",
};
- MethodDefinition checkType_v36(TypeDefinition type) {
- MethodDefinition decrypterMethod = checkMethods_v36(type);
+ MethodDef checkType_v36(TypeDef type) {
+ MethodDef decrypterMethod = checkMethods_v36(type);
if (decrypterMethod == null)
return null;
if (!new FieldTypes(type).exactly(requiredTypes_v36))
@@ -220,12 +220,12 @@ namespace de4dot.code.deobfuscators.CodeWall {
return decrypterMethod;
}
- static MethodDefinition checkMethods_v36(TypeDefinition type) {
+ static MethodDef checkMethods_v36(TypeDef type) {
if (type.Methods.Count != 2)
return null;
- MethodDefinition decrypterMethod = null;
- MethodDefinition cctor = null;
+ MethodDef decrypterMethod = null;
+ MethodDef cctor = null;
foreach (var method in type.Methods) {
if (method.Name == ".cctor") {
cctor = method;
@@ -249,7 +249,7 @@ namespace de4dot.code.deobfuscators.CodeWall {
simpleDeobfuscator.deobfuscate(info.Method);
info.Resource = findResource(info.Method);
if (info.Resource == null) {
- Log.w("Could not find encrypted strings resource (Method {0:X8})", info.Method.MetadataToken.ToInt32());
+ Log.w("Could not find encrypted strings resource (Method {0:X8})", info.Method.MDToken.ToInt32());
continue;
}
info.Magic1 = findMagic1(info.Method);
@@ -259,11 +259,11 @@ namespace de4dot.code.deobfuscators.CodeWall {
}
}
- EmbeddedResource findResource(MethodDefinition method) {
+ EmbeddedResource findResource(MethodDef method) {
return DotNetUtils.getResource(module, DotNetUtils.getCodeStrings(method)) as EmbeddedResource;
}
- static int findMagic1(MethodDefinition method) {
+ static int findMagic1(MethodDef method) {
var instrs = method.Body.Instructions;
for (int i = 0; i < instrs.Count - 2; i++) {
var ldarg = instrs[i];
@@ -279,7 +279,7 @@ namespace de4dot.code.deobfuscators.CodeWall {
throw new ApplicationException("Could not find magic1");
}
- static int findMagic2(MethodDefinition method) {
+ static int findMagic2(MethodDef method) {
var instrs = method.Body.Instructions;
for (int i = 0; i < instrs.Count - 2; i++) {
var ldloc = instrs[i];
@@ -295,7 +295,7 @@ namespace de4dot.code.deobfuscators.CodeWall {
throw new ApplicationException("Could not find magic2");
}
- static int findMagic3(MethodDefinition method) {
+ static int findMagic3(MethodDef method) {
var instrs = method.Body.Instructions;
for (int i = 0; i < instrs.Count - 2; i++) {
var ldarg = instrs[i];
@@ -311,7 +311,7 @@ namespace de4dot.code.deobfuscators.CodeWall {
throw new ApplicationException("Could not find magic3");
}
- public string decrypt(MethodDefinition method, int magic1, int magic2, int magic3) {
+ public string decrypt(MethodDef method, int magic1, int magic2, int magic3) {
var info = stringEncrypterInfos.find(method);
return info.decrypt(magic1, magic2, magic3);
}
diff --git a/de4dot.code/deobfuscators/CryptoObfuscator/AntiDebugger.cs b/de4dot.code/deobfuscators/CryptoObfuscator/AntiDebugger.cs
index 7b43c0ee..79838171 100644
--- a/de4dot.code/deobfuscators/CryptoObfuscator/AntiDebugger.cs
+++ b/de4dot.code/deobfuscators/CryptoObfuscator/AntiDebugger.cs
@@ -17,7 +17,7 @@
along with de4dot. If not, see .
*/
-using Mono.Cecil;
+using dot10.DotNet;
using de4dot.blocks;
namespace de4dot.code.deobfuscators.CryptoObfuscator {
@@ -25,14 +25,14 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
ModuleDefinition module;
ISimpleDeobfuscator simpleDeobfuscator;
IDeobfuscator deob;
- TypeDefinition antiDebuggerType;
- MethodDefinition antiDebuggerMethod;
+ TypeDef antiDebuggerType;
+ MethodDef antiDebuggerMethod;
- public TypeDefinition Type {
+ public TypeDef Type {
get { return antiDebuggerType; }
}
- public MethodDefinition Method {
+ public MethodDef Method {
get { return antiDebuggerMethod; }
}
@@ -49,7 +49,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
return;
}
- bool find(MethodDefinition methodToCheck) {
+ bool find(MethodDef methodToCheck) {
if (methodToCheck == null)
return false;
foreach (var method in DotNetUtils.getCalledMethods(module, methodToCheck)) {
@@ -79,12 +79,12 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
return false;
}
- void deobfuscate(MethodDefinition method) {
+ void deobfuscate(MethodDef method) {
simpleDeobfuscator.deobfuscate(method);
simpleDeobfuscator.decryptStrings(method, deob);
}
- bool containsString(MethodDefinition method, string part) {
+ bool containsString(MethodDef method, string part) {
foreach (var s in DotNetUtils.getCodeStrings(method)) {
if (s.Contains(part))
return true;
diff --git a/de4dot.code/deobfuscators/CryptoObfuscator/AssemblyResolver.cs b/de4dot.code/deobfuscators/CryptoObfuscator/AssemblyResolver.cs
index 1dcfc324..0d7e5ab8 100644
--- a/de4dot.code/deobfuscators/CryptoObfuscator/AssemblyResolver.cs
+++ b/de4dot.code/deobfuscators/CryptoObfuscator/AssemblyResolver.cs
@@ -20,15 +20,15 @@
using System;
using System.Collections.Generic;
using System.Text;
-using Mono.Cecil;
-using Mono.Cecil.Cil;
+using dot10.DotNet;
+using dot10.DotNet.Emit;
using de4dot.blocks;
namespace de4dot.code.deobfuscators.CryptoObfuscator {
class AssemblyResolver {
ModuleDefinition module;
- TypeDefinition resolverType;
- MethodDefinition resolverMethod;
+ TypeDef resolverType;
+ MethodDef resolverMethod;
List assemblyInfos = new List();
public class AssemblyInfo {
@@ -54,11 +54,11 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
get { return assemblyInfos; }
}
- public TypeDefinition Type {
+ public TypeDef Type {
get { return resolverType; }
}
- public MethodDefinition Method {
+ public MethodDef Method {
get { return resolverMethod; }
}
@@ -81,7 +81,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
}
}
- bool checkType(TypeDefinition type, MethodDefinition initMethod) {
+ bool checkType(TypeDef type, MethodDef initMethod) {
if (DotNetUtils.findFieldType(type, "System.Collections.Hashtable", true) == null)
return false;
if (!checkInitMethod(initMethod))
@@ -102,7 +102,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
return true;
}
- bool checkInitMethod(MethodDefinition initMethod) {
+ bool checkInitMethod(MethodDef initMethod) {
if (!initMethod.HasBody)
return false;
diff --git a/de4dot.code/deobfuscators/CryptoObfuscator/CoUtils.cs b/de4dot.code/deobfuscators/CryptoObfuscator/CoUtils.cs
index d3f37981..8e566561 100644
--- a/de4dot.code/deobfuscators/CryptoObfuscator/CoUtils.cs
+++ b/de4dot.code/deobfuscators/CryptoObfuscator/CoUtils.cs
@@ -20,12 +20,12 @@
using System;
using System.Collections.Generic;
using System.Text;
-using Mono.Cecil;
+using dot10.DotNet;
using de4dot.blocks;
namespace de4dot.code.deobfuscators.CryptoObfuscator {
static class CoUtils {
- public static EmbeddedResource getResource(ModuleDefinition module, MethodDefinition method) {
+ public static EmbeddedResource getResource(ModuleDefinition module, MethodDef method) {
if (method == null || method.Body == null)
return null;
return getResource(module, DotNetUtils.getCodeStrings(method));
diff --git a/de4dot.code/deobfuscators/CryptoObfuscator/ConstantsDecrypter.cs b/de4dot.code/deobfuscators/CryptoObfuscator/ConstantsDecrypter.cs
index 2240e431..91ac2f6d 100644
--- a/de4dot.code/deobfuscators/CryptoObfuscator/ConstantsDecrypter.cs
+++ b/de4dot.code/deobfuscators/CryptoObfuscator/ConstantsDecrypter.cs
@@ -20,21 +20,21 @@
using System;
using System.Collections.Generic;
using System.Text;
-using Mono.Cecil;
+using dot10.DotNet;
using de4dot.blocks;
namespace de4dot.code.deobfuscators.CryptoObfuscator {
class ConstantsDecrypter {
ModuleDefinition module;
- TypeDefinition decrypterType;
- MethodDefinition methodI4;
- MethodDefinition methodI8;
- MethodDefinition methodR4;
- MethodDefinition methodR8;
+ TypeDef decrypterType;
+ MethodDef methodI4;
+ MethodDef methodI8;
+ MethodDef methodR4;
+ MethodDef methodR8;
EmbeddedResource encryptedResource;
byte[] constantsData;
- public TypeDefinition Type {
+ public TypeDef Type {
get { return decrypterType; }
}
@@ -42,19 +42,19 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
get { return encryptedResource; }
}
- public MethodDefinition Int32Decrypter {
+ public MethodDef Int32Decrypter {
get { return methodI4; }
}
- public MethodDefinition Int64Decrypter {
+ public MethodDef Int64Decrypter {
get { return methodI8; }
}
- public MethodDefinition SingleDecrypter {
+ public MethodDef SingleDecrypter {
get { return methodR4; }
}
- public MethodDefinition DoubleDecrypter {
+ public MethodDef DoubleDecrypter {
get { return methodR8; }
}
@@ -79,7 +79,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
static readonly string[] requiredTypes = new string[] {
"System.Byte[]",
};
- bool checkType(TypeDefinition type) {
+ bool checkType(TypeDef type) {
if (type.Methods.Count != 7)
return false;
if (type.Fields.Count < 1 || type.Fields.Count > 2)
@@ -92,7 +92,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
return true;
}
- bool checkMethods(TypeDefinition type) {
+ bool checkMethods(TypeDef type) {
methodI4 = DotNetUtils.getMethod(type, "System.Int32", "(System.Int32)");
methodI8 = DotNetUtils.getMethod(type, "System.Int64", "(System.Int32)");
methodR4 = DotNetUtils.getMethod(type, "System.Single", "(System.Int32)");
diff --git a/de4dot.code/deobfuscators/CryptoObfuscator/Deobfuscator.cs b/de4dot.code/deobfuscators/CryptoObfuscator/Deobfuscator.cs
index 6d440bad..07a2e682 100644
--- a/de4dot.code/deobfuscators/CryptoObfuscator/Deobfuscator.cs
+++ b/de4dot.code/deobfuscators/CryptoObfuscator/Deobfuscator.cs
@@ -20,7 +20,7 @@
using System;
using System.Collections.Generic;
using System.Text.RegularExpressions;
-using Mono.Cecil;
+using dot10.DotNet;
using de4dot.blocks;
namespace de4dot.code.deobfuscators.CryptoObfuscator {
@@ -149,7 +149,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
foundObfuscatorUserString = Utils.StartsWith(module.GetUserString(0x70000001), "\u0011\"3D9B94A98B-76A8-4810-B1A0-4BE7C4F9C98D", StringComparison.Ordinal);
}
- void initializeVersion(TypeDefinition attr) {
+ void initializeVersion(TypeDef attr) {
var s = DotNetUtils.getCustomArgAsString(getAssemblyAttribute(attr), 0);
if (s == null)
return;
@@ -282,7 +282,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
public override IEnumerable getStringDecrypterMethods() {
var list = new List();
if (stringDecrypter.Method != null)
- list.Add(stringDecrypter.Method.MetadataToken.ToInt32());
+ list.Add(stringDecrypter.Method.MDToken.ToInt32());
return list;
}
}
diff --git a/de4dot.code/deobfuscators/CryptoObfuscator/MethodBodyReader.cs b/de4dot.code/deobfuscators/CryptoObfuscator/MethodBodyReader.cs
index 22860f01..2230e5a8 100644
--- a/de4dot.code/deobfuscators/CryptoObfuscator/MethodBodyReader.cs
+++ b/de4dot.code/deobfuscators/CryptoObfuscator/MethodBodyReader.cs
@@ -20,8 +20,8 @@
using System;
using System.Collections.Generic;
using System.IO;
-using Mono.Cecil;
-using Mono.Cecil.Cil;
+using dot10.DotNet;
+using dot10.DotNet.Emit;
using de4dot.blocks;
namespace de4dot.code.deobfuscators.CryptoObfuscator {
@@ -34,7 +34,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
this.module = module;
}
- public void read(MethodDefinition method) {
+ public void read(MethodDef method) {
this.parameters = getParameters(method);
this.Locals = getLocals(method);
@@ -55,7 +55,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
return DotNetUtils.getParameters(method);
}
- static IList getLocals(MethodDefinition method) {
+ static IList getLocals(MethodDef method) {
if (method.Body == null)
return new List();
return new List(method.Body.Variables);
@@ -115,7 +115,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
return eh;
}
- public override void restoreMethod(MethodDefinition method) {
+ public override void restoreMethod(MethodDef method) {
base.restoreMethod(method);
method.Body.MaxStackSize = maxStackSize;
}
diff --git a/de4dot.code/deobfuscators/CryptoObfuscator/MethodsDecrypter.cs b/de4dot.code/deobfuscators/CryptoObfuscator/MethodsDecrypter.cs
index d55cd744..2de8c43b 100644
--- a/de4dot.code/deobfuscators/CryptoObfuscator/MethodsDecrypter.cs
+++ b/de4dot.code/deobfuscators/CryptoObfuscator/MethodsDecrypter.cs
@@ -20,24 +20,24 @@
using System;
using System.Collections.Generic;
using System.IO;
-using Mono.Cecil;
-using Mono.Cecil.Cil;
+using dot10.DotNet;
+using dot10.DotNet.Emit;
using de4dot.blocks;
namespace de4dot.code.deobfuscators.CryptoObfuscator {
class MethodsDecrypter {
ModuleDefinition module;
- TypeDefinition decrypterType;
- MethodDefinition decryptMethod;
- MethodDefinition decrypterCctor;
+ TypeDef decrypterType;
+ MethodDef decryptMethod;
+ MethodDef decrypterCctor;
EmbeddedResource resource;
- List delegateTypes = new List();
+ List delegateTypes = new List();
- public TypeDefinition Type {
+ public TypeDef Type {
get { return decrypterType; }
}
- public IEnumerable DelegateTypes {
+ public IEnumerable DelegateTypes {
get { return delegateTypes; }
}
@@ -65,7 +65,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
"System.Collections.Generic.Dictionary`2",
"System.ModuleHandle",
};
- bool check(TypeDefinition type) {
+ bool check(TypeDef type) {
if (type.NestedTypes.Count != 1)
return false;
if (type.Fields.Count != 3)
@@ -98,7 +98,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
"System.Type",
"System.Type[]",
};
- static MethodDefinition findDecryptMethod(TypeDefinition type) {
+ static MethodDef findDecryptMethod(TypeDef type) {
foreach (var method in type.Methods) {
if (!method.IsStatic || method.Body == null)
continue;
@@ -136,7 +136,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
}
void decrypt(BinaryReader reader, int delegateTypeToken) {
- var delegateType = module.LookupToken(delegateTypeToken) as TypeDefinition;
+ var delegateType = module.LookupToken(delegateTypeToken) as TypeDef;
if (delegateType == null)
throw new ApplicationException("Couldn't find delegate type");
@@ -148,7 +148,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
var encType = module.LookupToken(encDeclToken) as TypeReference;
if (encType == null)
throw new ApplicationException("Invalid declaring type token");
- var encMethod = module.LookupToken(encMethToken) as MethodDefinition;
+ var encMethod = module.LookupToken(encMethToken) as MethodDef;
if (encMethod == null)
throw new ApplicationException("Invalid encrypted method token");
@@ -157,14 +157,14 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
bodyReader.restoreMethod(encMethod);
Log.v("Restored method {0} ({1:X8}). Instrs:{2}, Locals:{3}, Exceptions:{4}",
Utils.removeNewlines(encMethod.FullName),
- encMethod.MetadataToken.ToInt32(),
+ encMethod.MDToken.ToInt32(),
encMethod.Body.Instructions.Count,
encMethod.Body.Variables.Count,
encMethod.Body.ExceptionHandlers.Count);
delegateTypes.Add(delegateType);
}
- bool getTokens(TypeDefinition delegateType, out int delegateToken, out int encMethodToken, out int encDeclaringTypeToken) {
+ bool getTokens(TypeDef delegateType, out int delegateToken, out int encMethodToken, out int encDeclaringTypeToken) {
delegateToken = 0;
encMethodToken = 0;
encDeclaringTypeToken = 0;
@@ -187,7 +187,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
var call = instrs[i + 3];
if (call.OpCode.Code != Code.Call)
continue;
- var calledMethod = call.Operand as MethodDefinition;
+ var calledMethod = call.Operand as MethodDef;
if (calledMethod == null)
continue;
if (calledMethod != decryptMethod)
diff --git a/de4dot.code/deobfuscators/CryptoObfuscator/ProxyCallFixer.cs b/de4dot.code/deobfuscators/CryptoObfuscator/ProxyCallFixer.cs
index 36110571..66eefde6 100644
--- a/de4dot.code/deobfuscators/CryptoObfuscator/ProxyCallFixer.cs
+++ b/de4dot.code/deobfuscators/CryptoObfuscator/ProxyCallFixer.cs
@@ -19,13 +19,13 @@
using System;
using System.Collections.Generic;
-using Mono.Cecil;
-using Mono.Cecil.Cil;
+using dot10.DotNet;
+using dot10.DotNet.Emit;
using de4dot.blocks;
namespace de4dot.code.deobfuscators.CryptoObfuscator {
class ProxyCallFixer : ProxyCallFixer2 {
- Dictionary methodToType = new Dictionary();
+ Dictionary methodToType = new Dictionary();
public ProxyCallFixer(ModuleDefinition module)
: base(module) {
@@ -51,7 +51,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
}
}
- protected override object checkCctor(TypeDefinition type, MethodDefinition cctor) {
+ protected override object checkCctor(TypeDef type, MethodDef cctor) {
var instructions = cctor.Body.Instructions;
for (int i = 0; i < instructions.Count; i++) {
var instrs = DotNetUtils.getInstructions(instructions, i, OpCodes.Ldc_I4, OpCodes.Ldc_I4, OpCodes.Ldc_I4, OpCodes.Call);
@@ -61,7 +61,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
int typeToken = (int)instrs[0].Operand;
int methodToken = (int)instrs[1].Operand;
int declaringTypeToken = (int)instrs[2].Operand;
- var createMethod = instrs[3].Operand as MethodDefinition;
+ var createMethod = instrs[3].Operand as MethodDef;
ProxyCreatorType proxyCreatorType;
if (!methodToType.TryGetValue(createMethod, out proxyCreatorType))
@@ -73,7 +73,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
return null;
}
- protected override void getCallInfo(object context, FieldDefinition field, out MethodReference calledMethod, out OpCode callOpcode) {
+ protected override void getCallInfo(object context, FieldDef field, out MethodReference calledMethod, out OpCode callOpcode) {
var ctx = (Context)context;
switch (ctx.proxyCreatorType) {
@@ -107,13 +107,13 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
}
}
- MethodDefinition getProxyCreateMethod(TypeDefinition type) {
+ MethodDef getProxyCreateMethod(TypeDef type) {
if (DotNetUtils.findFieldType(type, "System.ModuleHandle", true) == null)
return null;
if (type.Fields.Count < 1 || type.Fields.Count > 12)
return null;
- MethodDefinition createMethod = null;
+ MethodDef createMethod = null;
foreach (var m in type.Methods) {
if (m.Name == ".ctor" || m.Name == ".cctor")
continue;
@@ -131,7 +131,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
return createMethod;
}
- ProxyCreatorType getProxyCreatorType(TypeDefinition type, MethodDefinition createMethod) {
+ ProxyCreatorType getProxyCreatorType(TypeDef type, MethodDef createMethod) {
int numCalls = 0, numCallvirts = 0, numNewobjs = 0;
foreach (var instr in createMethod.Body.Instructions) {
if (instr.OpCode.Code != Code.Ldsfld)
diff --git a/de4dot.code/deobfuscators/CryptoObfuscator/ResourceDecrypter.cs b/de4dot.code/deobfuscators/CryptoObfuscator/ResourceDecrypter.cs
index 406c9804..d2a08c4a 100644
--- a/de4dot.code/deobfuscators/CryptoObfuscator/ResourceDecrypter.cs
+++ b/de4dot.code/deobfuscators/CryptoObfuscator/ResourceDecrypter.cs
@@ -22,15 +22,15 @@ using System.Collections.Generic;
using System.IO;
using System.IO.Compression;
using System.Security.Cryptography;
-using Mono.Cecil;
-using Mono.Cecil.Cil;
+using dot10.DotNet;
+using dot10.DotNet.Emit;
using de4dot.blocks;
namespace de4dot.code.deobfuscators.CryptoObfuscator {
class ResourceDecrypter {
const int BUFLEN = 0x8000;
ModuleDefinition module;
- TypeDefinition resourceDecrypterType;
+ TypeDef resourceDecrypterType;
byte[] buffer1 = new byte[BUFLEN];
byte[] buffer2 = new byte[BUFLEN];
byte desEncryptedFlag;
@@ -97,7 +97,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
return false;
}
- bool checkCctor(MethodDefinition cctor) {
+ bool checkCctor(MethodDef cctor) {
if (cctor.Body == null)
return false;
int stsfldCount = 0;
@@ -182,7 +182,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
bitwiseNotEncryptedFlag = 4;
}
- static bool checkFlipBits(MethodDefinition method) {
+ static bool checkFlipBits(MethodDef method) {
var instrs = method.Body.Instructions;
for (int i = 0; i < instrs.Count - 1; i++) {
var ldloc = instrs[i];
@@ -202,7 +202,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
return false;
}
- bool updateFlags(MethodDefinition method, ISimpleDeobfuscator simpleDeobfuscator) {
+ bool updateFlags(MethodDef method, ISimpleDeobfuscator simpleDeobfuscator) {
if (method == null || method.Body == null)
return false;
@@ -266,7 +266,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
return false;
}
- static int getHeaderSkipBytes(MethodDefinition method) {
+ static int getHeaderSkipBytes(MethodDef method) {
var instrs = method.Body.Instructions;
for (int i = 0; i < instrs.Count - 1; i++) {
var ldci4 = instrs[i];
@@ -291,11 +291,11 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
return false;
}
- MethodDefinition getDecrypterMethod() {
+ MethodDef getDecrypterMethod() {
return getDecrypterMethod(resourceDecrypterType);
}
- static MethodDefinition getDecrypterMethod(TypeDefinition type) {
+ static MethodDef getDecrypterMethod(TypeDef type) {
foreach (var method in type.Methods) {
if (DotNetUtils.isMethod(method, "System.Byte[]", "(System.IO.Stream)"))
return method;
diff --git a/de4dot.code/deobfuscators/CryptoObfuscator/ResourceResolver.cs b/de4dot.code/deobfuscators/CryptoObfuscator/ResourceResolver.cs
index e73f4194..70b3442a 100644
--- a/de4dot.code/deobfuscators/CryptoObfuscator/ResourceResolver.cs
+++ b/de4dot.code/deobfuscators/CryptoObfuscator/ResourceResolver.cs
@@ -19,16 +19,16 @@
using System;
using System.Collections.Generic;
-using Mono.Cecil;
-using Mono.Cecil.Cil;
+using dot10.DotNet;
+using dot10.DotNet.Emit;
using de4dot.blocks;
namespace de4dot.code.deobfuscators.CryptoObfuscator {
class ResourceResolver {
ModuleDefinition module;
ResourceDecrypter resourceDecrypter;
- TypeDefinition resolverType;
- MethodDefinition resolverMethod;
+ TypeDef resolverType;
+ MethodDef resolverMethod;
ResolverVersion resolverVersion = ResolverVersion.V1;
bool mergedIt = false;
@@ -38,11 +38,11 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
V2,
}
- public TypeDefinition Type {
+ public TypeDef Type {
get { return resolverType; }
}
- public MethodDefinition Method {
+ public MethodDef Method {
get { return resolverMethod; }
}
@@ -99,7 +99,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
return names;
}
- bool checkType(MethodDefinition initMethod) {
+ bool checkType(MethodDef initMethod) {
if (!initMethod.HasBody)
return false;
if (DotNetUtils.findFieldType(initMethod.DeclaringType, "System.Reflection.Assembly", true) == null)
@@ -116,7 +116,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
return true;
}
- ResolverVersion checkSetupMethod(MethodDefinition setupMethod) {
+ ResolverVersion checkSetupMethod(MethodDef setupMethod) {
var instructions = setupMethod.Body.Instructions;
int foundCount = 0;
for (int i = 0; i < instructions.Count; i++) {
diff --git a/de4dot.code/deobfuscators/CryptoObfuscator/StringDecrypter.cs b/de4dot.code/deobfuscators/CryptoObfuscator/StringDecrypter.cs
index a2fbfa0f..96dd017a 100644
--- a/de4dot.code/deobfuscators/CryptoObfuscator/StringDecrypter.cs
+++ b/de4dot.code/deobfuscators/CryptoObfuscator/StringDecrypter.cs
@@ -19,26 +19,26 @@
using System;
using System.Text;
-using Mono.Cecil;
+using dot10.DotNet;
using de4dot.blocks;
namespace de4dot.code.deobfuscators.CryptoObfuscator {
class StringDecrypter {
ModuleDefinition module;
EmbeddedResource stringResource;
- TypeDefinition stringDecrypterType;
- MethodDefinition stringDecrypterMethod;
+ TypeDef stringDecrypterType;
+ MethodDef stringDecrypterMethod;
byte[] decryptedData;
public bool Detected {
get { return stringDecrypterType != null; }
}
- public TypeDefinition Type {
+ public TypeDef Type {
get { return stringDecrypterType; }
}
- public MethodDefinition Method {
+ public MethodDef Method {
get { return stringDecrypterMethod; }
}
@@ -51,8 +51,8 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
}
public void find() {
- TypeDefinition type;
- MethodDefinition method;
+ TypeDef type;
+ MethodDef method;
if (!findStringDecrypterType(out type, out method))
return;
@@ -98,7 +98,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
return Encoding.Unicode.GetString(decryptedData, index, len);
}
- bool findStringDecrypterType(out TypeDefinition theType, out MethodDefinition theMethod) {
+ bool findStringDecrypterType(out TypeDef theType, out MethodDef theMethod) {
theType = null;
theMethod = null;
@@ -114,7 +114,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
if (type.NestedTypes.Count > 0)
continue;
- MethodDefinition method = null;
+ MethodDef method = null;
foreach (var m in type.Methods) {
if (m.Name == ".ctor" || m.Name == ".cctor")
continue;
diff --git a/de4dot.code/deobfuscators/CryptoObfuscator/TamperDetection.cs b/de4dot.code/deobfuscators/CryptoObfuscator/TamperDetection.cs
index be7f0e6e..c975df70 100644
--- a/de4dot.code/deobfuscators/CryptoObfuscator/TamperDetection.cs
+++ b/de4dot.code/deobfuscators/CryptoObfuscator/TamperDetection.cs
@@ -17,25 +17,25 @@
along with de4dot. If not, see .
*/
-using Mono.Cecil;
+using dot10.DotNet;
using de4dot.blocks;
namespace de4dot.code.deobfuscators.CryptoObfuscator {
class TamperDetection {
ModuleDefinition module;
- TypeDefinition tamperType;
- MethodDefinition tamperMethod;
+ TypeDef tamperType;
+ MethodDef tamperMethod;
FrameworkType frameworkType;
public bool Detected {
get { return tamperMethod != null; }
}
- public TypeDefinition Type {
+ public TypeDef Type {
get { return tamperType; }
}
- public MethodDefinition Method {
+ public MethodDef Method {
get { return tamperMethod; }
}
@@ -51,7 +51,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
return;
}
- bool find(MethodDefinition methodToCheck) {
+ bool find(MethodDef methodToCheck) {
if (methodToCheck == null)
return false;
@@ -79,7 +79,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
return false;
}
- bool findDesktop(MethodDefinition method) {
+ bool findDesktop(MethodDef method) {
var type = method.DeclaringType;
if (!method.IsStatic || !DotNetUtils.isMethod(method, "System.Void", "()"))
@@ -107,7 +107,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
"System.Reflection.AssemblyName",
"System.String",
};
- bool findSilverlight(MethodDefinition method) {
+ bool findSilverlight(MethodDef method) {
if (!new LocalTypes(method).exactly(requiredLocals_sl))
return false;
if (!DotNetUtils.callsMethod(method, "System.Int32 System.String::get_Length()"))
@@ -136,7 +136,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
"System.Int32",
"System.String",
};
- bool findCompactFramework(MethodDefinition method) {
+ bool findCompactFramework(MethodDef method) {
if (!new LocalTypes(method).exactly(requiredLocals_cf))
return false;
if (!DotNetUtils.callsMethod(method, "System.Int32 System.String::get_Length()"))
diff --git a/de4dot.code/deobfuscators/DeepSea/ArrayBlockDeobfuscator.cs b/de4dot.code/deobfuscators/DeepSea/ArrayBlockDeobfuscator.cs
index 3cf42f89..a51ea0a8 100644
--- a/de4dot.code/deobfuscators/DeepSea/ArrayBlockDeobfuscator.cs
+++ b/de4dot.code/deobfuscators/DeepSea/ArrayBlockDeobfuscator.cs
@@ -18,8 +18,8 @@
*/
using System.Collections.Generic;
-using Mono.Cecil;
-using Mono.Cecil.Cil;
+using dot10.DotNet;
+using dot10.DotNet.Emit;
using de4dot.blocks;
using de4dot.blocks.cflow;
diff --git a/de4dot.code/deobfuscators/DeepSea/ArrayBlockState.cs b/de4dot.code/deobfuscators/DeepSea/ArrayBlockState.cs
index 383129ee..666e25b3 100644
--- a/de4dot.code/deobfuscators/DeepSea/ArrayBlockState.cs
+++ b/de4dot.code/deobfuscators/DeepSea/ArrayBlockState.cs
@@ -18,8 +18,8 @@
*/
using System.Collections.Generic;
-using Mono.Cecil;
-using Mono.Cecil.Cil;
+using dot10.DotNet;
+using dot10.DotNet.Emit;
using Mono.Cecil.Metadata;
using de4dot.blocks;
@@ -29,11 +29,11 @@ namespace de4dot.code.deobfuscators.DeepSea {
FieldDefinitionAndDeclaringTypeDict fieldToInfo = new FieldDefinitionAndDeclaringTypeDict();
public class FieldInfo {
- public readonly FieldDefinition field;
- public readonly FieldDefinition arrayInitField;
+ public readonly FieldDef field;
+ public readonly FieldDef arrayInitField;
public readonly byte[] array;
- public FieldInfo(FieldDefinition field, FieldDefinition arrayInitField) {
+ public FieldInfo(FieldDef field, FieldDef arrayInitField) {
this.field = field;
this.arrayInitField = arrayInitField;
this.array = (byte[])arrayInitField.InitialValue.Clone();
@@ -52,14 +52,14 @@ namespace de4dot.code.deobfuscators.DeepSea {
initializeArrays(simpleDeobfuscator, DotNetUtils.getModuleTypeCctor(module));
}
- void initializeArrays(ISimpleDeobfuscator simpleDeobfuscator, MethodDefinition method) {
+ void initializeArrays(ISimpleDeobfuscator simpleDeobfuscator, MethodDef method) {
if (method == null || method.Body == null)
return;
while (initializeArrays2(simpleDeobfuscator, method)) {
}
}
- bool initializeArrays2(ISimpleDeobfuscator simpleDeobfuscator, MethodDefinition method) {
+ bool initializeArrays2(ISimpleDeobfuscator simpleDeobfuscator, MethodDef method) {
bool foundField = false;
simpleDeobfuscator.deobfuscate(method, true);
var instructions = method.Body.Instructions;
@@ -76,7 +76,7 @@ namespace de4dot.code.deobfuscators.DeepSea {
if (arrayType == null || arrayType.EType != ElementType.U1)
continue;
- var arrayInitField = instrs[2].Operand as FieldDefinition;
+ var arrayInitField = instrs[2].Operand as FieldDef;
if (arrayInitField == null || arrayInitField.InitialValue == null || arrayInitField.InitialValue.Length == 0)
continue;
@@ -84,7 +84,7 @@ namespace de4dot.code.deobfuscators.DeepSea {
if (calledMethod == null || calledMethod.FullName != "System.Void System.Runtime.CompilerServices.RuntimeHelpers::InitializeArray(System.Array,System.RuntimeFieldHandle)")
continue;
- var targetField = instrs[4].Operand as FieldDefinition;
+ var targetField = instrs[4].Operand as FieldDef;
if (targetField == null)
continue;
@@ -102,8 +102,8 @@ namespace de4dot.code.deobfuscators.DeepSea {
return fieldToInfo.find(fieldRef);
}
- public IEnumerable cleanUp() {
- var removedFields = new List();
+ public IEnumerable cleanUp() {
+ var removedFields = new List();
var moduleCctor = DotNetUtils.getModuleTypeCctor(module);
if (moduleCctor == null)
return removedFields;
diff --git a/de4dot.code/deobfuscators/DeepSea/AssemblyResolver.cs b/de4dot.code/deobfuscators/DeepSea/AssemblyResolver.cs
index 49e0a041..6a777f93 100644
--- a/de4dot.code/deobfuscators/DeepSea/AssemblyResolver.cs
+++ b/de4dot.code/deobfuscators/DeepSea/AssemblyResolver.cs
@@ -21,15 +21,15 @@ using System;
using System.Collections.Generic;
using System.IO;
using System.Text.RegularExpressions;
-using Mono.Cecil;
-using Mono.Cecil.Cil;
+using dot10.DotNet;
+using dot10.DotNet.Emit;
using de4dot.blocks;
namespace de4dot.code.deobfuscators.DeepSea {
class AssemblyResolver : ResolverBase {
Version version;
List fieldInfos;
- MethodDefinition decryptMethod;
+ MethodDef decryptMethod;
enum Version {
Unknown,
@@ -62,16 +62,16 @@ namespace de4dot.code.deobfuscators.DeepSea {
}
class FieldInfo {
- public FieldDefinition field;
+ public FieldDef field;
public int magic;
- public FieldInfo(FieldDefinition field, int magic) {
+ public FieldInfo(FieldDef field, int magic) {
this.field = field;
this.magic = magic;
}
}
- public MethodDefinition DecryptMethod {
+ public MethodDef DecryptMethod {
get { return decryptMethod; }
}
@@ -86,7 +86,7 @@ namespace de4dot.code.deobfuscators.DeepSea {
"System.Security.Cryptography.SHA1Managed",
"System.Windows.AssemblyPart",
};
- protected override bool checkResolverInitMethodSilverlight(MethodDefinition resolverInitMethod) {
+ protected override bool checkResolverInitMethodSilverlight(MethodDef resolverInitMethod) {
if (resolverInitMethod.Body.ExceptionHandlers.Count != 1)
return false;
@@ -110,7 +110,7 @@ namespace de4dot.code.deobfuscators.DeepSea {
return false;
}
- void updateVersion(MethodDefinition handler) {
+ void updateVersion(MethodDef handler) {
if (isV3Old(handler)) {
version = Version.V3Old;
return;
@@ -125,7 +125,7 @@ namespace de4dot.code.deobfuscators.DeepSea {
}
}
- static bool isV3SL(MethodDefinition handler) {
+ static bool isV3SL(MethodDef handler) {
var instrs = handler.Body.Instructions;
for (int i = 0; i < instrs.Count - 3; i++) {
if (!DotNetUtils.isLdloc(instrs[i]))
@@ -141,7 +141,7 @@ namespace de4dot.code.deobfuscators.DeepSea {
return false;
}
- static bool isV41SL(MethodDefinition handler) {
+ static bool isV41SL(MethodDef handler) {
var instrs = handler.Body.Instructions;
for (int i = 0; i < instrs.Count; i++) {
if (!DotNetUtils.isLdcI4(instrs[i]) || DotNetUtils.getLdcI4Value(instrs[i]) != 5)
@@ -157,18 +157,18 @@ namespace de4dot.code.deobfuscators.DeepSea {
return false;
}
- static bool isV3Old(MethodDefinition method) {
+ static bool isV3Old(MethodDef method) {
return DotNetUtils.callsMethod(method, "System.Int32 System.IO.Stream::Read(System.Byte[],System.Int32,System.Int32)") &&
!DotNetUtils.callsMethod(method, "System.Int32 System.IO.Stream::ReadByte()") &&
// Obfuscated System.Int32 System.IO.Stream::ReadByte()
!DotNetUtils.callsMethod(method, "System.Int32", "(System.IO.Stream,System.Int32,System.Int32)");
}
- protected override bool checkResolverInitMethodInternal(MethodDefinition resolverInitMethod) {
+ protected override bool checkResolverInitMethodInternal(MethodDef resolverInitMethod) {
return DotNetUtils.callsMethod(resolverInitMethod, "System.Void System.AppDomain::add_AssemblyResolve(System.ResolveEventHandler)");
}
- protected override bool checkHandlerMethodDesktopInternal(MethodDefinition handler) {
+ protected override bool checkHandlerMethodDesktopInternal(MethodDef handler) {
if (checkHandlerV3(handler) || checkHandlerSL(handler)) {
updateVersion(handler);
return true;
@@ -176,7 +176,7 @@ namespace de4dot.code.deobfuscators.DeepSea {
simpleDeobfuscator.deobfuscate(handler);
List fieldInfosTmp;
- MethodDefinition decryptMethodTmp;
+ MethodDef decryptMethodTmp;
if (checkHandlerV4(handler, out fieldInfosTmp, out decryptMethodTmp)) {
version = Version.V4;
fieldInfos = fieldInfosTmp;
@@ -204,7 +204,7 @@ namespace de4dot.code.deobfuscators.DeepSea {
"System.Security.Cryptography.SHA1CryptoServiceProvider",
"System.String",
};
- static bool checkHandlerV3(MethodDefinition handler) {
+ static bool checkHandlerV3(MethodDef handler) {
return new LocalTypes(handler).all(handlerLocalTypes_NET);
}
@@ -216,12 +216,12 @@ namespace de4dot.code.deobfuscators.DeepSea {
"System.String",
"System.Windows.AssemblyPart",
};
- static bool checkHandlerSL(MethodDefinition handler) {
+ static bool checkHandlerSL(MethodDef handler) {
return new LocalTypes(handler).all(handlerLocalTypes_SL);
}
// 4.0.1.18 .. 4.0.3
- bool checkHandlerV4(MethodDefinition handler, out List fieldInfos, out MethodDefinition decryptMethod) {
+ bool checkHandlerV4(MethodDef handler, out List fieldInfos, out MethodDef decryptMethod) {
fieldInfos = new List();
decryptMethod = null;
@@ -232,7 +232,7 @@ namespace de4dot.code.deobfuscators.DeepSea {
var ldtoken = instrs[index++];
if (ldtoken.OpCode.Code != Code.Ldtoken)
continue;
- var field = ldtoken.Operand as FieldDefinition;
+ var field = ldtoken.Operand as FieldDef;
if (field == null || field.InitialValue == null || field.InitialValue.Length == 0)
return false;
@@ -252,7 +252,7 @@ namespace de4dot.code.deobfuscators.DeepSea {
call = instrs[index++];
if (call.OpCode.Code != Code.Call)
return false;
- var decryptMethodTmp = call.Operand as MethodDefinition;
+ var decryptMethodTmp = call.Operand as MethodDef;
if (!DotNetUtils.isMethod(decryptMethodTmp, "System.Reflection.Assembly", "(System.RuntimeFieldHandle,System.Int32,System.Int32)"))
return false;
@@ -264,7 +264,7 @@ namespace de4dot.code.deobfuscators.DeepSea {
}
// 4.0.4, 4.1+
- Version checkHandlerV404_41(MethodDefinition handler, out List fieldInfos, out MethodDefinition decryptMethod) {
+ Version checkHandlerV404_41(MethodDef handler, out List fieldInfos, out MethodDef decryptMethod) {
Version version = Version.Unknown;
fieldInfos = new List();
decryptMethod = null;
@@ -286,7 +286,7 @@ namespace de4dot.code.deobfuscators.DeepSea {
var ldtoken = instrs[index++];
if (ldtoken.OpCode.Code != Code.Ldtoken)
continue;
- var field = ldtoken.Operand as FieldDefinition;
+ var field = ldtoken.Operand as FieldDef;
if (field == null || field.InitialValue == null || field.InitialValue.Length == 0)
continue;
@@ -302,7 +302,7 @@ namespace de4dot.code.deobfuscators.DeepSea {
var args = DsUtils.getArgValues(instrs, callIndex);
if (args == null)
continue;
- var decryptMethodTmp = instrs[callIndex].Operand as MethodDefinition;
+ var decryptMethodTmp = instrs[callIndex].Operand as MethodDef;
if (decryptMethodTmp == null)
continue;
int magic;
@@ -317,7 +317,7 @@ namespace de4dot.code.deobfuscators.DeepSea {
return version;
}
- static bool getMagic(MethodDefinition method, IList