DotNetFile prop was removed from dnlib, update code
This commit is contained in:
parent
2c2cab7f16
commit
01179242a7
|
@ -504,7 +504,7 @@ namespace de4dot.code.deobfuscators.Agile_NET {
|
||||||
if (sigType == SigType.Unknown)
|
if (sigType == SigType.Unknown)
|
||||||
return DecryptResult.NotEncrypted;
|
return DecryptResult.NotEncrypted;
|
||||||
|
|
||||||
var methodDefTable = peImage.DotNetFile.MetaData.TablesStream.MethodTable;
|
var methodDefTable = peImage.MetaData.TablesStream.MethodTable;
|
||||||
|
|
||||||
foreach (var version in GetCsHeaderVersions(codeHeaderOffset, methodDefTable)) {
|
foreach (var version in GetCsHeaderVersions(codeHeaderOffset, methodDefTable)) {
|
||||||
try {
|
try {
|
||||||
|
|
|
@ -148,7 +148,7 @@ namespace de4dot.code.deobfuscators.CodeVeil {
|
||||||
var methodsDataReader = MemoryImageStream.Create(methodsData);
|
var methodsDataReader = MemoryImageStream.Create(methodsData);
|
||||||
var fileDataReader = MemoryImageStream.Create(fileData);
|
var fileDataReader = MemoryImageStream.Create(fileData);
|
||||||
|
|
||||||
var methodDef = peImage.DotNetFile.MetaData.TablesStream.MethodTable;
|
var methodDef = peImage.MetaData.TablesStream.MethodTable;
|
||||||
for (uint rid = 1; rid <= methodDef.Rows; rid++) {
|
for (uint rid = 1; rid <= methodDef.Rows; rid++) {
|
||||||
var dm = new DumpedMethod();
|
var dm = new DumpedMethod();
|
||||||
|
|
||||||
|
|
|
@ -71,7 +71,7 @@ namespace de4dot.code.deobfuscators.CodeWall {
|
||||||
|
|
||||||
bool decrypted = false;
|
bool decrypted = false;
|
||||||
|
|
||||||
var methodDef = peImage.DotNetFile.MetaData.TablesStream.MethodTable;
|
var methodDef = peImage.MetaData.TablesStream.MethodTable;
|
||||||
for (uint rid = 1; rid <= methodDef.Rows; rid++) {
|
for (uint rid = 1; rid <= methodDef.Rows; rid++) {
|
||||||
var dm = new DumpedMethod();
|
var dm = new DumpedMethod();
|
||||||
peImage.ReadMethodTableRowTo(dm, rid);
|
peImage.ReadMethodTableRowTo(dm, rid);
|
||||||
|
|
|
@ -857,7 +857,7 @@ namespace de4dot.code.deobfuscators.MaxtoCode {
|
||||||
var methodInfos = new MethodInfos(module, decrypterInfo.mainType, peImage, decrypterInfo.peHeader, decrypterInfo.mcKey);
|
var methodInfos = new MethodInfos(module, decrypterInfo.mainType, peImage, decrypterInfo.peHeader, decrypterInfo.mcKey);
|
||||||
methodInfos.InitializeInfos();
|
methodInfos.InitializeInfos();
|
||||||
|
|
||||||
var methodDef = peImage.DotNetFile.MetaData.TablesStream.MethodTable;
|
var methodDef = peImage.MetaData.TablesStream.MethodTable;
|
||||||
for (uint rid = 1; rid <= methodDef.Rows; rid++) {
|
for (uint rid = 1; rid <= methodDef.Rows; rid++) {
|
||||||
var dm = new DumpedMethod();
|
var dm = new DumpedMethod();
|
||||||
peImage.ReadMethodTableRowTo(dm, rid);
|
peImage.ReadMethodTableRowTo(dm, rid);
|
||||||
|
@ -916,7 +916,7 @@ namespace de4dot.code.deobfuscators.MaxtoCode {
|
||||||
uint usHeapSize = peHeader.ReadUInt32(0x0E04) ^ mcKey.ReadUInt32(0x0082);
|
uint usHeapSize = peHeader.ReadUInt32(0x0E04) ^ mcKey.ReadUInt32(0x0082);
|
||||||
if (usHeapRva == 0 || usHeapSize == 0)
|
if (usHeapRva == 0 || usHeapSize == 0)
|
||||||
return;
|
return;
|
||||||
var usHeap = peImage.DotNetFile.MetaData.USStream;
|
var usHeap = peImage.MetaData.USStream;
|
||||||
if (usHeap.StartOffset == 0 || // Start offset is 0 if it's not present in the file
|
if (usHeap.StartOffset == 0 || // Start offset is 0 if it's not present in the file
|
||||||
peImage.RvaToOffset(usHeapRva) != (uint)usHeap.StartOffset ||
|
peImage.RvaToOffset(usHeapRva) != (uint)usHeap.StartOffset ||
|
||||||
usHeapSize != (uint)(usHeap.EndOffset - usHeap.StartOffset)) {
|
usHeapSize != (uint)(usHeap.EndOffset - usHeap.StartOffset)) {
|
||||||
|
|
|
@ -10,28 +10,28 @@ namespace de4dot.code.deobfuscators {
|
||||||
IPEImage peImage;
|
IPEImage peImage;
|
||||||
byte[] peImageData;
|
byte[] peImageData;
|
||||||
IImageStream peStream;
|
IImageStream peStream;
|
||||||
DotNetFile dnFile;
|
IMetaData metaData;
|
||||||
bool dnFileInitialized;
|
bool dnFileInitialized;
|
||||||
ImageSectionHeader dotNetSection;
|
ImageSectionHeader dotNetSection;
|
||||||
bool ownPeImage;
|
bool ownPeImage;
|
||||||
|
|
||||||
public DotNetFile DotNetFile {
|
public IMetaData MetaData {
|
||||||
get {
|
get {
|
||||||
if (dnFileInitialized)
|
if (dnFileInitialized)
|
||||||
return dnFile;
|
return metaData;
|
||||||
dnFileInitialized = true;
|
dnFileInitialized = true;
|
||||||
|
|
||||||
var dotNetDir = peImage.ImageNTHeaders.OptionalHeader.DataDirectories[14];
|
var dotNetDir = peImage.ImageNTHeaders.OptionalHeader.DataDirectories[14];
|
||||||
if (dotNetDir.VirtualAddress != 0 && dotNetDir.Size >= 0x48) {
|
if (dotNetDir.VirtualAddress != 0 && dotNetDir.Size >= 0x48) {
|
||||||
dnFile = DotNetFile.Load(peImage, false);
|
metaData = MetaDataCreator.CreateMetaData(peImage, false);
|
||||||
dotNetSection = FindSection(dotNetDir.VirtualAddress);
|
dotNetSection = FindSection(dotNetDir.VirtualAddress);
|
||||||
}
|
}
|
||||||
return dnFile;
|
return metaData;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
public ImageCor20Header Cor20Header {
|
public ImageCor20Header Cor20Header {
|
||||||
get { return DotNetFile.MetaData.ImageCor20Header; }
|
get { return MetaData.ImageCor20Header; }
|
||||||
}
|
}
|
||||||
|
|
||||||
public IBinaryReader Reader {
|
public IBinaryReader Reader {
|
||||||
|
@ -91,7 +91,7 @@ namespace de4dot.code.deobfuscators {
|
||||||
|
|
||||||
public void ReadMethodTableRowTo(DumpedMethod dm, uint rid) {
|
public void ReadMethodTableRowTo(DumpedMethod dm, uint rid) {
|
||||||
dm.token = 0x06000000 + rid;
|
dm.token = 0x06000000 + rid;
|
||||||
var row = DotNetFile.MetaData.TablesStream.ReadMethodRow(rid);
|
var row = MetaData.TablesStream.ReadMethodRow(rid);
|
||||||
if (row == null)
|
if (row == null)
|
||||||
throw new ArgumentException("Invalid Method rid");
|
throw new ArgumentException("Invalid Method rid");
|
||||||
dm.mdRVA = row.RVA;
|
dm.mdRVA = row.RVA;
|
||||||
|
@ -186,14 +186,14 @@ namespace de4dot.code.deobfuscators {
|
||||||
}
|
}
|
||||||
|
|
||||||
public bool DotNetSafeWriteOffset(uint offset, byte[] data) {
|
public bool DotNetSafeWriteOffset(uint offset, byte[] data) {
|
||||||
if (DotNetFile != null) {
|
if (MetaData != null) {
|
||||||
uint length = (uint)data.Length;
|
uint length = (uint)data.Length;
|
||||||
|
|
||||||
if (!IsInside(dotNetSection, offset, length))
|
if (!IsInside(dotNetSection, offset, length))
|
||||||
return false;
|
return false;
|
||||||
if (Intersect(offset, length, DotNetFile.MetaData.ImageCor20Header))
|
if (Intersect(offset, length, MetaData.ImageCor20Header))
|
||||||
return false;
|
return false;
|
||||||
if (Intersect(offset, length, DotNetFile.MetaData.MetaDataHeader))
|
if (Intersect(offset, length, MetaData.MetaDataHeader))
|
||||||
return false;
|
return false;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -207,15 +207,15 @@ namespace de4dot.code.deobfuscators {
|
||||||
|
|
||||||
public void Dispose() {
|
public void Dispose() {
|
||||||
if (ownPeImage) {
|
if (ownPeImage) {
|
||||||
if (dnFile != null)
|
if (metaData != null)
|
||||||
dnFile.Dispose();
|
metaData.Dispose();
|
||||||
if (peImage != null)
|
if (peImage != null)
|
||||||
peImage.Dispose();
|
peImage.Dispose();
|
||||||
}
|
}
|
||||||
if (peStream != null)
|
if (peStream != null)
|
||||||
peStream.Dispose();
|
peStream.Dispose();
|
||||||
|
|
||||||
dnFile = null;
|
metaData = null;
|
||||||
peImage = null;
|
peImage = null;
|
||||||
peStream = null;
|
peStream = null;
|
||||||
}
|
}
|
||||||
|
|
|
@ -185,7 +185,7 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 {
|
||||||
else {
|
else {
|
||||||
// DNR 4.0+ (jitter is hooked)
|
// DNR 4.0+ (jitter is hooked)
|
||||||
|
|
||||||
var methodDef = peImage.DotNetFile.MetaData.TablesStream.MethodTable;
|
var methodDef = peImage.MetaData.TablesStream.MethodTable;
|
||||||
var rvaToIndex = new Dictionary<uint, int>((int)methodDef.Rows);
|
var rvaToIndex = new Dictionary<uint, int>((int)methodDef.Rows);
|
||||||
uint offset = (uint)methodDef.StartOffset;
|
uint offset = (uint)methodDef.StartOffset;
|
||||||
for (int i = 0; i < methodDef.Rows; i++) {
|
for (int i = 0; i < methodDef.Rows; i++) {
|
||||||
|
|
Loading…
Reference in New Issue
Block a user