diff --git a/AssemblyData/methodsrewriter/MModule.cs b/AssemblyData/methodsrewriter/MModule.cs index d93907fc..4b29c976 100644 --- a/AssemblyData/methodsrewriter/MModule.cs +++ b/AssemblyData/methodsrewriter/MModule.cs @@ -44,11 +44,9 @@ namespace AssemblyData.methodsrewriter { var tmpTokenToTypeDefinition = new Dictionary(); foreach (var t in module.GetTypes()) tmpTokenToType[t.MetadataToken] = t; - foreach (var t in moduleDefinition.GetTypes()) { + foreach (var t in moduleDefinition.GetTypes()) tmpTokenToTypeDefinition[t.MetadataToken.ToInt32()] = t; - if (moduleType == null && t.FullName == "") - moduleType = t; - } + moduleType = DotNetUtils.getModuleType(moduleDefinition); foreach (var token in tmpTokenToType.Keys) { var mtype = new MType(tmpTokenToType[token], tmpTokenToTypeDefinition[token]); tokenToType[token] = mtype; diff --git a/blocks/DotNetUtils.cs b/blocks/DotNetUtils.cs index da93e01e..7417c0e8 100644 --- a/blocks/DotNetUtils.cs +++ b/blocks/DotNetUtils.cs @@ -281,11 +281,17 @@ namespace de4dot.blocks { } public static TypeDefinition getModuleType(ModuleDefinition module) { - foreach (var type in module.Types) { - if (type.FullName == "") - return type; + if (module.Types.Count == 0) + return null; + + if (module.Runtime == TargetRuntime.Net_1_0 || module.Runtime == TargetRuntime.Net_1_1) { + if (module.Types[0].FullName == "") + return module.Types[0]; + return null; } - return null; + + // It's always the first one, no matter what it is named. + return module.Types[0]; } public static bool isEmpty(MethodDefinition method) { diff --git a/de4dot.code/deobfuscators/DeobfuscatorBase.cs b/de4dot.code/deobfuscators/DeobfuscatorBase.cs index 9e0c3972..17bcd9ba 100644 --- a/de4dot.code/deobfuscators/DeobfuscatorBase.cs +++ b/de4dot.code/deobfuscators/DeobfuscatorBase.cs @@ -169,8 +169,9 @@ namespace de4dot.code.deobfuscators { } void restoreBaseType() { + var moduleType = DotNetUtils.getModuleType(module); foreach (var type in module.GetTypes()) { - if (type.BaseType != null || type.IsInterface || type.FullName == "") + if (type.BaseType != null || type.IsInterface || type == moduleType) continue; Log.v("Adding System.Object as base type: {0} ({1:X8})", Utils.removeNewlines(type), diff --git a/de4dot.code/deobfuscators/SmartAssembly/Deobfuscator.cs b/de4dot.code/deobfuscators/SmartAssembly/Deobfuscator.cs index 902cba2b..cbeeabb2 100644 --- a/de4dot.code/deobfuscators/SmartAssembly/Deobfuscator.cs +++ b/de4dot.code/deobfuscators/SmartAssembly/Deobfuscator.cs @@ -271,8 +271,9 @@ namespace de4dot.code.deobfuscators.SmartAssembly { bool hasEmptyClassesInEveryNamespace() { var namespaces = new Dictionary(StringComparer.Ordinal); + var moduleType = DotNetUtils.getModuleType(module); foreach (var type in module.Types) { - if (type.FullName == "") + if (type == moduleType) continue; var ns = type.Namespace; if (!namespaces.ContainsKey(ns)) diff --git a/de4dot.code/renamer/TypeInfo.cs b/de4dot.code/renamer/TypeInfo.cs index 6569d562..7ca379c7 100644 --- a/de4dot.code/renamer/TypeInfo.cs +++ b/de4dot.code/renamer/TypeInfo.cs @@ -81,6 +81,10 @@ namespace de4dot.code.renamer { return baseInfo; } + bool isModuleType() { + return type.TypeDefinition == DotNetUtils.getModuleType(type.TypeDefinition.Module); + } + public void prepareRenameTypes(TypeRenamerState state) { var checker = NameChecker; @@ -94,7 +98,12 @@ namespace de4dot.code.renamer { string origClassName = null; if (isWinFormsClass()) origClassName = findWindowsFormsClassName(type); - if (oldFullName != "" && !checker.isValidTypeName(oldName)) { + if (isModuleType()) { + if (oldNamespace != "") + newNamespace = ""; + rename(""); + } + else if (!checker.isValidTypeName(oldName)) { if (origClassName != null && checker.isValidTypeName(origClassName)) rename(state.getTypeName(oldName, origClassName)); else {