monocul.us/de4dot-cex
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Move methods

Browse Source
This commit is contained in:
de4dot 2012-08-11 22:34:08 +02:00
parent 77b8b0f471
commit 0d9c298dcb
3 changed files with 41 additions and 32 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

39
de4dot.code/deobfuscators/Confuser/ConfuserUtils.cs
View File

@ -132,5 +132,44 @@ namespace de4dot.code.deobfuscators.Confuser {
}
return decrypted;
}
public static int countCalls(MethodDefinition method, string methodFullName) {
if (method == null || method.Body == null)
return 0;
int count = 0;
foreach (var instr in method.Body.Instructions) {
if (instr.OpCode.Code != Code.Call && instr.OpCode.Code != Code.Callvirt && instr.OpCode.Code != Code.Newobj)
continue;
var calledMethod = instr.Operand as MethodReference;
if (calledMethod != null && calledMethod.FullName == methodFullName)
count++;
}
return count;
}
public static int countCalls(MethodDefinition method, MethodDefinition calledMethod) {
if (method == null || method.Body == null)
return 0;
int count = 0;
foreach (var instr in method.Body.Instructions) {
if (instr.OpCode.Code != Code.Call && instr.OpCode.Code != Code.Callvirt && instr.OpCode.Code != Code.Newobj)
continue;
if (instr.Operand == calledMethod)
count++;
}
return count;
}
public static int countOpCode(MethodDefinition method, Code code) {
if (method == null || method.Body == null)
return 0;
int count = 0;
foreach (var instr in method.Body.Instructions) {
if (instr.OpCode.Code == code)
count++;
}
return count;
}
}
}

16
de4dot.code/deobfuscators/Confuser/MemoryMethodsDecrypter.cs
View File

@ -72,7 +72,7 @@ namespace de4dot.code.deobfuscators.Confuser {
if (!DotNetUtils.hasString(initMethod, "Module error"))
version = ConfuserVersion.v14_r57884;
else if (virtProtect.IsPrivate && callsFileStreamCtor) {
int calls = countMethodCalls(initMethod, "System.Void System.Buffer::BlockCopy(System.Array,System.Int32,System.Array,System.Int32,System.Int32)");
int calls = ConfuserUtils.countCalls(initMethod, "System.Void System.Buffer::BlockCopy(System.Array,System.Int32,System.Array,System.Int32,System.Int32)");
if (calls <= 1)
version = ConfuserVersion.v14_r58564;
else if (calls == 2)
@ -100,20 +100,6 @@ namespace de4dot.code.deobfuscators.Confuser {
return true;
}
static int countMethodCalls(MethodDefinition method, string methodFullName) {
if (method == null || method.Body == null)
return 0;
int count = 0;
foreach (var instr in method.Body.Instructions) {
if (instr.OpCode.Code != Code.Call && instr.OpCode.Code != Code.Callvirt && instr.OpCode.Code != Code.Newobj)
continue;
var calledMethod = instr.Operand as MethodReference;
if (calledMethod != null && calledMethod.FullName == methodFullName)
count++;
}
return count;
}
public void initialize() {
if (initMethod == null)
return;

18
de4dot.code/deobfuscators/Confuser/ProxyCallFixer.cs
View File

@ -518,7 +518,7 @@ namespace de4dot.code.deobfuscators.Confuser {
else {
if (proxyType == ProxyCreatorType.CallOrCallvirt && !DotNetUtils.callsMethod(method, "System.Int32 System.String::get_Length()"))
theVersion = ConfuserVersion.v11_r50378;
int numCalls = countCalls(method, "System.Byte[] System.Text.Encoding::GetBytes(System.Char[],System.Int32,System.Int32)");
int numCalls = ConfuserUtils.countCalls(method, "System.Byte[] System.Text.Encoding::GetBytes(System.Char[],System.Int32,System.Int32)");
if (numCalls == 2)
theVersion = ConfuserVersion.v12_r54564;
if (!DotNetUtils.callsMethod(method, "System.Reflection.Assembly System.Reflection.Assembly::Load(System.Reflection.AssemblyName)"))
@ -609,22 +609,6 @@ namespace de4dot.code.deobfuscators.Confuser {
return -1;
}
static int countCalls(MethodDefinition method, string methodFullName) {
int count = 0;
foreach (var instr in method.Body.Instructions) {
if (instr.OpCode.Code != Code.Call && instr.OpCode.Code != Code.Callvirt && instr.OpCode.Code != Code.Newobj)
continue;
var calledMethod = instr.Operand as MethodReference;
if (calledMethod == null)
continue;
if (calledMethod.FullName != methodFullName)
continue;
count++;
}
return count;
}
static bool findMagic_v19_r76101(MethodDefinition method, out uint magic) {
var instrs = method.Body.Instructions;
for (int i = 0; i < instrs.Count - 7; i++) {