diff --git a/de4dot.code/deobfuscators/CodeVeil/Deobfuscator.cs b/de4dot.code/deobfuscators/CodeVeil/Deobfuscator.cs index b1280d4a..19ae1ca1 100644 --- a/de4dot.code/deobfuscators/CodeVeil/Deobfuscator.cs +++ b/de4dot.code/deobfuscators/CodeVeil/Deobfuscator.cs @@ -17,6 +17,7 @@ along with de4dot. If not, see . */ +using System; using System.Collections.Generic; using Mono.Cecil; using Mono.MyStuff; @@ -102,6 +103,31 @@ namespace de4dot.code.deobfuscators.CodeVeil { methodsDecrypter.find(); stringDecrypter = new StringDecrypter(module); stringDecrypter.find(); + var version = detectVersion(); + if (!string.IsNullOrEmpty(version)) + obfuscatorName = obfuscatorName + " " + version; + } + + string detectVersion() { + switch (methodsDecrypter.Version) { + case MethodsDecrypter.TypeVersion.Unknown: + return null; + + case MethodsDecrypter.TypeVersion.V3: + return "3.x"; + + case MethodsDecrypter.TypeVersion.V4_0: + return "4.0"; + + case MethodsDecrypter.TypeVersion.V4_1: + return "4.1"; + + case MethodsDecrypter.TypeVersion.V5: + return "5.x"; + + default: + throw new ApplicationException("Unknown version"); + } } void findKillType() { diff --git a/de4dot.code/deobfuscators/CodeVeil/MethodsDecrypter.cs b/de4dot.code/deobfuscators/CodeVeil/MethodsDecrypter.cs index f99c70de..49eab8ab 100644 --- a/de4dot.code/deobfuscators/CodeVeil/MethodsDecrypter.cs +++ b/de4dot.code/deobfuscators/CodeVeil/MethodsDecrypter.cs @@ -34,13 +34,18 @@ namespace de4dot.code.deobfuscators.CodeVeil { List rvas; // _stub and _executive IDecrypter decrypter; - enum TypeVersion { + public enum TypeVersion { Unknown, V3, - V4, + V4_0, + V4_1, V5, } + public TypeVersion Version { + get { return decrypter == null ? TypeVersion.Unknown : decrypter.TypeVersion; } + } + interface IDecrypter { TypeVersion TypeVersion { get; } void initialize(byte[] methodsData); @@ -210,8 +215,12 @@ namespace de4dot.code.deobfuscators.CodeVeil { if (!DotNetUtils.isMethod(initMethod, "System.Void", "(System.Boolean,System.Boolean)")) return false; - if (hasCodeString(initMethod, "E_FullTrust")) - decrypter = new Decrypter(TypeVersion.V4); + if (hasCodeString(initMethod, "E_FullTrust")) { + if (DotNetUtils.getPInvokeMethod(initMethod.DeclaringType, "user32", "CallWindowProcW") != null) + decrypter = new Decrypter(TypeVersion.V4_1); + else + decrypter = new Decrypter(TypeVersion.V4_0); + } else if (hasCodeString(initMethod, "Full Trust Required")) decrypter = new Decrypter(TypeVersion.V3); else if (initMethod.DeclaringType.HasNestedTypes && new FieldTypes(initMethod.DeclaringType).all(fieldTypesV5))