From 133814073c2e60718aa1c614d9f1619f9fcfaf42 Mon Sep 17 00:00:00 2001 From: angelsl Date: Fri, 28 Aug 2015 00:01:40 +0800 Subject: [PATCH] Actually use index of the not opcode Signed-off-by: angelsl --- .../deobfuscators/CryptoObfuscator/ResourceDecrypter.cs | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/de4dot.code/deobfuscators/CryptoObfuscator/ResourceDecrypter.cs b/de4dot.code/deobfuscators/CryptoObfuscator/ResourceDecrypter.cs index b32cc57f..171820f4 100644 --- a/de4dot.code/deobfuscators/CryptoObfuscator/ResourceDecrypter.cs +++ b/de4dot.code/deobfuscators/CryptoObfuscator/ResourceDecrypter.cs @@ -183,6 +183,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator { static bool CheckFlipBits(MethodDef method, out int index) { int nots = 0, i; var instrs = method.Body.Instructions; + index = -1; for (i = 0; i < instrs.Count - 1; i++) { var ldloc = instrs[i]; if (!ldloc.IsLdloc()) @@ -190,11 +191,11 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator { var local = ldloc.GetLocal(method.Body.Variables); if (local == null || local.Type.GetElementType().GetPrimitiveSize() < 0) continue; - - if (instrs[i + 1].OpCode.Code == Code.Not) + if (instrs[i + 1].OpCode.Code == Code.Not) { nots++; + index = i + 1; + } } - index = i; return (nots & 1) == 1; }