Restore resource names

de4dot.code/de4dot.code.csproj

@@ -148,6 +148,7 @@
     <Compile Include="deobfuscators\Skater_NET\StringDecrypter.cs" />
     <Compile Include="deobfuscators\Spices_Net\Deobfuscator.cs" />
     <Compile Include="deobfuscators\Spices_Net\QclzDecompressor.cs" />
+    <Compile Include="deobfuscators\Spices_Net\ResourceNamesRestorer.cs" />
     <Compile Include="deobfuscators\Spices_Net\SpicesMethodCallInliner.cs" />
     <Compile Include="deobfuscators\Spices_Net\StringDecrypter.cs" />
     <Compile Include="deobfuscators\StringCounts.cs" />

de4dot.code/deobfuscators/Spices_Net/Deobfuscator.cs

@@ -30,12 +30,14 @@ namespace de4dot.code.deobfuscators.Spices_Net {
 		BoolOption inlineMethods;
 		BoolOption removeInlinedMethods;
 		BoolOption removeNamespaces;
+		BoolOption restoreResourceNames;
 
 		public DeobfuscatorInfo()
 			: base(DEFAULT_REGEX) {
 			inlineMethods = new BoolOption(null, makeArgName("inline"), "Inline short methods", true);
 			removeInlinedMethods = new BoolOption(null, makeArgName("remove-inlined"), "Remove inlined methods", true);
 			removeNamespaces = new BoolOption(null, makeArgName("ns1"), "Clear namespace if there's only one class in it", true);
+			restoreResourceNames = new BoolOption(null, makeArgName("rsrc"), "Restore resource names", true);
 		}
 
 		public override string Name {
@@ -52,6 +54,7 @@ namespace de4dot.code.deobfuscators.Spices_Net {
 				InlineMethods = inlineMethods.get(),
 				RemoveInlinedMethods = removeInlinedMethods.get(),
 				RemoveNamespaces = removeNamespaces.get(),
+				RestoreResourceNames = restoreResourceNames.get(),
 			});
 		}
 
@@ -60,6 +63,7 @@ namespace de4dot.code.deobfuscators.Spices_Net {
 				inlineMethods,
 				removeInlinedMethods,
 				removeNamespaces,
+				restoreResourceNames,
 			};
 		}
 	}
@@ -71,11 +75,13 @@ namespace de4dot.code.deobfuscators.Spices_Net {
 
 		StringDecrypter stringDecrypter;
 		SpicesMethodCallInliner methodCallInliner;
+		ResourceNamesRestorer resourceNamesRestorer;
 
 		internal class Options : OptionsBase {
 			public bool InlineMethods { get; set; }
 			public bool RemoveInlinedMethods { get; set; }
 			public bool RemoveNamespaces { get; set; }
+			public bool RestoreResourceNames { get; set; }
 		}
 
 		public override string Type {
@@ -147,6 +153,12 @@ namespace de4dot.code.deobfuscators.Spices_Net {
 
 			methodCallInliner.initialize();
 
+			if (options.RestoreResourceNames) {
+				resourceNamesRestorer = new ResourceNamesRestorer(module);
+				resourceNamesRestorer.find();
+				resourceNamesRestorer.renameResources();
+			}
+
 			stringDecrypter.initialize();
 			foreach (var info in stringDecrypter.DecrypterInfos) {
 				staticStringInliner.add(info.method, (method2, args) => {
@@ -160,12 +172,19 @@ namespace de4dot.code.deobfuscators.Spices_Net {
 
 		public override void deobfuscateMethodEnd(Blocks blocks) {
 			methodCallInliner.deobfuscate(blocks);
+			if (options.RestoreResourceNames)
+				resourceNamesRestorer.deobfuscate(blocks);
 			base.deobfuscateMethodEnd(blocks);
 		}
 
 		public override void deobfuscateEnd() {
 			removeInlinedMethods();
 
+			if (options.RestoreResourceNames) {
+				addTypeToBeRemoved(resourceNamesRestorer.ResourceManagerType, "Obfuscator ResourceManager type");
+				addTypeToBeRemoved(resourceNamesRestorer.ComponentResourceManagerType, "Obfuscator ComponentResourceManager type");
+			}
+
 			if (Operations.DecryptStrings != OpDecryptString.None) {
 				addTypeToBeRemoved(stringDecrypter.Type, "String decrypter type");
 				addTypeToBeRemoved(stringDecrypter.EncryptedStringsType, "Encrypted strings field type");

de4dot.code/deobfuscators/Spices_Net/ResourceNamesRestorer.cs

@@ -0,0 +1,167 @@
+/*
+    Copyright (C) 2011-2012 de4dot@gmail.com
+
+    This file is part of de4dot.
+
+    de4dot is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    de4dot is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with de4dot.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+using System.Collections.Generic;
+using Mono.Cecil;
+using Mono.Cecil.Cil;
+using de4dot.blocks;
+
+namespace de4dot.code.deobfuscators.Spices_Net {
+	class ResourceNamesRestorer {
+		ModuleDefinition module;
+		TypeDefinition resourceManagerType;
+		TypeDefinition componentResourceManagerType;
+		MethodDefinitionAndDeclaringTypeDict<MethodReference> resourceManagerCtors = new MethodDefinitionAndDeclaringTypeDict<MethodReference>();
+		MethodDefinitionAndDeclaringTypeDict<MethodReference> componentManagerCtors = new MethodDefinitionAndDeclaringTypeDict<MethodReference>();
+
+		public TypeDefinition ResourceManagerType {
+			get { return resourceManagerType; }
+		}
+
+		public TypeDefinition ComponentResourceManagerType {
+			get { return componentResourceManagerType; }
+		}
+
+		public ResourceNamesRestorer(ModuleDefinition module) {
+			this.module = module;
+		}
+
+		public void find() {
+			foreach (var type in module.Types) {
+				if (isResourceType(type, "System.Resources.ResourceManager"))
+					resourceManagerType = type;
+				else if (isResourceType(type, "System.ComponentModel.ComponentResourceManager"))
+					componentResourceManagerType = type;
+			}
+
+			initializeCtors(resourceManagerType, resourceManagerCtors);
+			initializeCtors(componentResourceManagerType, componentManagerCtors);
+		}
+
+		static void initializeCtors(TypeDefinition manager, MethodDefinitionAndDeclaringTypeDict<MethodReference> ctors) {
+			if (manager == null)
+				return;
+
+			foreach (var ctor in manager.Methods) {
+				if (ctor.Name != ".ctor")
+					continue;
+
+				var newCtor = new MethodReference(ctor.Name, ctor.MethodReturnType.ReturnType, manager.BaseType);
+				newCtor.HasThis = true;
+				foreach (var param in ctor.Parameters)
+					newCtor.Parameters.Add(new ParameterDefinition(param.ParameterType));
+				ctors.add(ctor, newCtor);
+			}
+		}
+
+		static bool isResourceType(TypeDefinition type, string baseTypeName) {
+			if (type.BaseType == null || type.BaseType.FullName != baseTypeName)
+				return false;
+			if (type.HasProperties || type.HasEvents || type.HasFields)
+				return false;
+			if (type.Interfaces.Count > 0)
+				return false;
+			var method = DotNetUtils.getMethod(type, "GetResourceFileName");
+			if (!DotNetUtils.isMethod(method, "System.String", "(System.Globalization.CultureInfo)"))
+				return false;
+
+			return true;
+		}
+
+		public void renameResources() {
+			if (resourceManagerType == null && componentResourceManagerType == null)
+				return;
+
+			var numToResource = new Dictionary<uint, Resource>(module.Resources.Count);
+			foreach (var resource in module.Resources) {
+				var name = resource.Name;
+				int index = name.LastIndexOf('.');
+				string ext;
+				if (index < 0)
+					ext = name;
+				else
+					ext = name.Substring(index + 1);
+				uint extNum;
+				if (!uint.TryParse(ext, out extNum))
+					continue;
+				numToResource[extNum] = resource;
+			}
+
+			foreach (var type in module.GetTypes()) {
+				rename(numToResource, "", type.FullName);
+				rename(numToResource, type.Namespace, type.Name);
+			}
+		}
+
+		static void rename(Dictionary<uint, Resource> numToResource, string ns, string name) {
+			var resourceName = name + ".resources";
+			uint hash = getResourceHash(resourceName);
+			Resource resource;
+			if (!numToResource.TryGetValue(hash, out resource))
+				return;
+
+			int index = resource.Name.LastIndexOf('.');
+			string resourceNamespace, newName;
+			if (index < 0) {
+				resourceNamespace = "";
+				newName = resourceName;
+			}
+			else {
+				resourceNamespace = resource.Name.Substring(0, index);
+				newName = resourceNamespace + "." + resourceName;
+			}
+			if (resourceNamespace != ns)
+				return;
+
+			resource.Name = newName;
+			numToResource.Remove(hash);
+		}
+
+		static uint getResourceHash(string name) {
+			uint hash = 0;
+			foreach (var c in name)
+				hash = ror(hash ^ c, 1);
+			return hash;
+		}
+
+		static uint ror(uint val, int n) {
+			return (val << (32 - n)) + (val >> n);
+		}
+
+		public void deobfuscate(Blocks blocks) {
+			foreach (var block in blocks.MethodBlocks.getAllBlocks()) {
+				var instrs = block.Instructions;
+				for (int i = 0; i < instrs.Count; i++) {
+					var instr = instrs[i];
+					if (instr.OpCode.Code != Code.Newobj)
+						continue;
+					var ctor = instr.Operand as MethodReference;
+					if (ctor == null)
+						continue;
+					var newCtor = resourceManagerCtors.find(ctor);
+					if (newCtor == null)
+						newCtor = componentManagerCtors.find(ctor);
+					if (newCtor == null)
+						continue;
+					instr.Operand = newCtor;
+				}
+			}
+		}
+	}
+}