From 0c36e74834930c36dae3f180efd1357507d446c2 Mon Sep 17 00:00:00 2001 From: de4dot Date: Wed, 23 Nov 2011 05:45:30 +0100 Subject: [PATCH] Add option to disable restoring props/events from method names --- de4dot.code/CommandLineParser.cs | 4 +++- de4dot.code/FilesDeobfuscator.cs | 27 ++++++++++++------------- de4dot.code/IObfuscatedFile.cs | 1 - de4dot.code/ObfuscatedFile.cs | 6 ------ de4dot.code/deobfuscators/Operations.cs | 2 -- 5 files changed, 16 insertions(+), 24 deletions(-) diff --git a/de4dot.code/CommandLineParser.cs b/de4dot.code/CommandLineParser.cs index c6d6f943..38687bef 100644 --- a/de4dot.code/CommandLineParser.cs +++ b/de4dot.code/CommandLineParser.cs @@ -118,6 +118,9 @@ namespace de4dot { miscOptions.Add(new NoArgOption(null, "dont-rename", "Don't rename classes, methods, etc.", () => { filesOptions.RenameSymbols = false; })); + miscOptions.Add(new NoArgOption(null, "dont-restore-props", "Don't restore properties/events", () => { + filesOptions.RestorePropsEvents = false; + })); miscOptions.Add(new OneArgOption(null, "default-strtyp", "Default string decrypter type", "type", (val) => { object decrypterType; if (!stringDecrypterTypes.getValue(val, out decrypterType)) @@ -156,7 +159,6 @@ namespace de4dot { exitError(string.Format("File \"{0}\" does not exist.", val)); newFileOptions = new ObfuscatedFile.Options { Filename = val, - RenameSymbols = filesOptions.RenameSymbols, ControlFlowDeobfuscation = filesOptions.ControlFlowDeobfuscation, KeepObfuscatorTypes = filesOptions.KeepObfuscatorTypes, }; diff --git a/de4dot.code/FilesDeobfuscator.cs b/de4dot.code/FilesDeobfuscator.cs index 7577ef90..ce0513fd 100644 --- a/de4dot.code/FilesDeobfuscator.cs +++ b/de4dot.code/FilesDeobfuscator.cs @@ -36,6 +36,7 @@ namespace de4dot { public IList SearchDirs { get; set; } public bool DetectObfuscators { get; set; } public bool RenameSymbols { get; set; } + public bool RestorePropsEvents { get; set; } public bool ControlFlowDeobfuscation { get; set; } public bool KeepObfuscatorTypes { get; set; } public bool OneFileAtATime { get; set; } @@ -49,6 +50,7 @@ namespace de4dot { SearchDirs = new List(); DefaultStringDecrypterMethods = new List(); RenameSymbols = true; + RestorePropsEvents = true; ControlFlowDeobfuscation = true; } } @@ -89,10 +91,7 @@ namespace de4dot { file.deobfuscateBegin(); file.deobfuscate(); file.deobfuscateEnd(); - - if (options.RenameSymbols) - new Renamer(new List { file }).rename(); - + rename(new List { file }); file.save(); removeModule(file.ModuleDefinition); @@ -112,7 +111,7 @@ namespace de4dot { void deobfuscateAll() { var allFiles = new List(loadAllFiles()); deobfuscateAllFiles(allFiles); - renameAllFiles(allFiles); + rename(allFiles); saveAllFiles(allFiles); } @@ -124,7 +123,6 @@ namespace de4dot { DefaultStringDecrypterType = options.DefaultStringDecrypterType, DefaultStringDecrypterMethods = options.DefaultStringDecrypterMethods, AssemblyClientFactory = options.AssemblyClientFactory, - RenameSymbols = options.RenameSymbols, ControlFlowDeobfuscation = options.ControlFlowDeobfuscation, KeepObfuscatorTypes = options.KeepObfuscatorTypes, CreateDestinationDir = !onlyScan, @@ -144,7 +142,6 @@ namespace de4dot { public DecrypterType? DefaultStringDecrypterType { get; set; } public List DefaultStringDecrypterMethods { get; set; } public IAssemblyClientFactory AssemblyClientFactory { get; set; } - public bool RenameSymbols { get; set; } public bool ControlFlowDeobfuscation { get; set; } public bool KeepObfuscatorTypes { get; set; } public bool CreateDestinationDir { get; set; } @@ -279,7 +276,6 @@ namespace de4dot { IObfuscatedFile createObfuscatedFile(SearchDir searchDir, string filename) { var fileOptions = new ObfuscatedFile.Options { Filename = Utils.getFullPath(filename), - RenameSymbols = options.RenameSymbols, ControlFlowDeobfuscation = options.ControlFlowDeobfuscation, KeepObfuscatorTypes = options.KeepObfuscatorTypes, }; @@ -339,12 +335,6 @@ namespace de4dot { } } - void renameAllFiles(IEnumerable allFiles) { - if (!options.RenameSymbols) - return; - new Renamer(allFiles).rename(); - } - void saveAllFiles(IEnumerable allFiles) { foreach (var file in allFiles) file.save(); @@ -356,5 +346,14 @@ namespace de4dot { list.Add(info.createDeobfuscator()); return list; } + + void rename(IEnumerable theFiles) { + if (!options.RenameSymbols) + return; + var renamer = new Renamer(theFiles) { + RestorePropertiesFromNames = options.RestorePropsEvents, + }; + renamer.rename(); + } } } diff --git a/de4dot.code/IObfuscatedFile.cs b/de4dot.code/IObfuscatedFile.cs index 2f27bcc2..ace8befe 100644 --- a/de4dot.code/IObfuscatedFile.cs +++ b/de4dot.code/IObfuscatedFile.cs @@ -30,7 +30,6 @@ namespace de4dot { string NewFilename { get; } INameChecker NameChecker { get; } bool RenameResourcesInCode { get; } - bool RenameSymbols { get; } bool RemoveNamespaceWithOneType { get; } void deobfuscateBegin(); diff --git a/de4dot.code/ObfuscatedFile.cs b/de4dot.code/ObfuscatedFile.cs index 3035641c..94a26593 100644 --- a/de4dot.code/ObfuscatedFile.cs +++ b/de4dot.code/ObfuscatedFile.cs @@ -85,7 +85,6 @@ namespace de4dot { public string ForcedObfuscatorType { get; set; } public DecrypterType StringDecrypterType { get; set; } public List StringDecrypterMethods { get; private set; } - public bool RenameSymbols { get; set; } public bool ControlFlowDeobfuscation { get; set; } public bool KeepObfuscatorTypes { get; set; } @@ -115,10 +114,6 @@ namespace de4dot { get { return deob.TheOptions.RenameResourcesInCode; } } - public bool RenameSymbols { - get { return options.RenameSymbols; } - } - public bool RemoveNamespaceWithOneType { get { return (deob.RenamingOptions & RenamingOptions.RemoveNamespaceIfOneType) != 0; } } @@ -192,7 +187,6 @@ namespace de4dot { break; } - op.RenameSymbols = options.RenameSymbols; op.KeepObfuscatorTypes = options.KeepObfuscatorTypes; return op; diff --git a/de4dot.code/deobfuscators/Operations.cs b/de4dot.code/deobfuscators/Operations.cs index 317f97b4..ac788dd7 100644 --- a/de4dot.code/deobfuscators/Operations.cs +++ b/de4dot.code/deobfuscators/Operations.cs @@ -25,13 +25,11 @@ namespace de4dot.deobfuscators { } interface IOperations { - bool RenameSymbols { get; } bool KeepObfuscatorTypes { get; } OpDecryptString DecryptStrings { get; } } class Operations : IOperations { - public bool RenameSymbols { get; set; } public bool KeepObfuscatorTypes { get; set; } public OpDecryptString DecryptStrings { get; set; } }