monocul.us/de4dot-cex
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge branch 'master' into confuser

Browse Source
This commit is contained in:
de4dot 2012-07-27 08:03:30 +02:00
commit 135dcd5a3c
6 changed files with 38 additions and 50 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
cecil

@ -1 +1 @@
Subproject commit c1333d2061882d3bdf3a0ef43f10374371bd7de4
Subproject commit 83f3b84ac48445132ba5e6e9ad5fed25e497abc0

19
de4dot.code/deobfuscators/Babel_NET/ProxyCallFixer.cs
View File

@ -95,25 +95,6 @@ namespace de4dot.code.deobfuscators.Babel_NET {
return null;
}
protected override Dictionary<FieldDefinition, MethodDefinition> getFieldToMethodDictionary(TypeDefinition type) {
var dict = new Dictionary<FieldDefinition, MethodDefinition>();
foreach (var method in type.Methods) {
if (!method.IsStatic || !method.HasBody || method.Name == ".cctor")
continue;
var instructions = method.Body.Instructions;
for (int i = 0; i < instructions.Count; i++) {
var instr = instructions[i];
if (instr.OpCode.Code != Code.Ldsfld)
continue;
dict[(FieldDefinition)instr.Operand] = method;
break;
}
}
return dict;
}
protected override void getCallInfo(object context, FieldDefinition field, out MethodReference calledMethod, out OpCode callOpcode) {
var ctx = (Context)context;

19
de4dot.code/deobfuscators/CryptoObfuscator/ProxyCallFixer.cs
View File

@ -73,25 +73,6 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
return null;
}
protected override Dictionary<FieldDefinition, MethodDefinition> getFieldToMethodDictionary(TypeDefinition type) {
var dict = new Dictionary<FieldDefinition, MethodDefinition>();
foreach (var method in type.Methods) {
if (!method.IsStatic || !method.HasBody || method.Name == ".cctor")
continue;
var instructions = method.Body.Instructions;
for (int i = 0; i < instructions.Count; i++) {
var instr = instructions[i];
if (instr.OpCode.Code != Code.Ldsfld)
continue;
dict[(FieldDefinition)instr.Operand] = method;
break;
}
}
return dict;
}
protected override void getCallInfo(object context, FieldDefinition field, out MethodReference calledMethod, out OpCode callOpcode) {
var ctx = (Context)context;

17
de4dot.code/deobfuscators/DeobfuscatorBase.cs
View File

@ -472,9 +472,10 @@ namespace de4dot.code.deobfuscators {
Log.v("Removing types");
Log.indent();
var moduleType = DotNetUtils.getModuleType(module);
foreach (var info in typesToRemove) {
var typeDef = info.obj;
if (typeDef == null)
if (typeDef == null || typeDef == moduleType)
continue;
bool removed;
if (typeDef.IsNested)
@ -663,18 +664,22 @@ namespace de4dot.code.deobfuscators {
}
}
protected void removeProxyDelegates(ProxyCallFixerBase proxyCallFixer) {
removeProxyDelegates(proxyCallFixer, true);
protected bool removeProxyDelegates(ProxyCallFixerBase proxyCallFixer) {
return removeProxyDelegates(proxyCallFixer, true);
}
protected void removeProxyDelegates(ProxyCallFixerBase proxyCallFixer, bool removeCreators) {
protected bool removeProxyDelegates(ProxyCallFixerBase proxyCallFixer, bool removeCreators) {
if (proxyCallFixer.Errors != 0) {
Log.v("Not removing proxy delegates and creator type since errors were detected.");
return;
return false;
}
addTypesToBeRemoved(proxyCallFixer.DelegateTypes, "Proxy delegate type");
if (removeCreators && proxyCallFixer.RemovedDelegateCreatorCalls > 0)
if (removeCreators && proxyCallFixer.RemovedDelegateCreatorCalls > 0) {
addTypesToBeRemoved(proxyCallFixer.DelegateCreatorTypes, "Proxy delegate creator type");
foreach (var tuple in proxyCallFixer.OtherMethods)
addMethodToBeRemoved(tuple.Item1, tuple.Item2);
}
return true;
}
protected Resource getResource(IEnumerable<string> strings) {

4
de4dot.code/deobfuscators/Goliath_NET/ProxyCallFixer.cs
View File

@ -136,10 +136,6 @@ namespace de4dot.code.deobfuscators.Goliath_NET {
throw new System.NotImplementedException();
}
protected override Dictionary<FieldDefinition, MethodDefinition> getFieldToMethodDictionary(TypeDefinition type) {
throw new NotImplementedException();
}
protected override void getCallInfo(object context, FieldDefinition field, out MethodReference calledMethod, out OpCode callOpcode) {
throw new System.NotImplementedException();
}

27
de4dot.code/deobfuscators/ProxyCallFixerBase.cs
View File

@ -58,6 +58,10 @@ namespace de4dot.code.deobfuscators {
}
}
public virtual IEnumerable<Tuple<MethodDefinition, string>> OtherMethods {
get { return new List<Tuple<MethodDefinition, string>>(); }
}
public bool Detected {
get { return delegateCreatorMethods.Count != 0; }
}
@ -431,9 +435,30 @@ namespace de4dot.code.deobfuscators {
}
protected abstract object checkCctor(TypeDefinition type, MethodDefinition cctor);
protected abstract Dictionary<FieldDefinition, MethodDefinition> getFieldToMethodDictionary(TypeDefinition type);
protected abstract void getCallInfo(object context, FieldDefinition field, out MethodReference calledMethod, out OpCode callOpcode);
Dictionary<FieldDefinition, MethodDefinition> getFieldToMethodDictionary(TypeDefinition type) {
var dict = new Dictionary<FieldDefinition, MethodDefinition>();
foreach (var method in type.Methods) {
if (!method.IsStatic || !method.HasBody || method.Name == ".cctor")
continue;
var instructions = method.Body.Instructions;
for (int i = 0; i < instructions.Count; i++) {
var instr = instructions[i];
if (instr.OpCode.Code != Code.Ldsfld)
continue;
var field = instr.Operand as FieldDefinition;
if (field == null)
continue;
dict[field] = method;
break;
}
}
return dict;
}
protected override bool deobfuscate(Blocks blocks, IList<Block> allBlocks) {
var removeInfos = new Dictionary<Block, List<RemoveInfo>>();