Merge branch 'master' into confuser
This commit is contained in:
commit
135dcd5a3c
2
cecil
2
cecil
|
@ -1 +1 @@
|
||||||
Subproject commit c1333d2061882d3bdf3a0ef43f10374371bd7de4
|
Subproject commit 83f3b84ac48445132ba5e6e9ad5fed25e497abc0
|
|
@ -95,25 +95,6 @@ namespace de4dot.code.deobfuscators.Babel_NET {
|
||||||
return null;
|
return null;
|
||||||
}
|
}
|
||||||
|
|
||||||
protected override Dictionary<FieldDefinition, MethodDefinition> getFieldToMethodDictionary(TypeDefinition type) {
|
|
||||||
var dict = new Dictionary<FieldDefinition, MethodDefinition>();
|
|
||||||
foreach (var method in type.Methods) {
|
|
||||||
if (!method.IsStatic || !method.HasBody || method.Name == ".cctor")
|
|
||||||
continue;
|
|
||||||
|
|
||||||
var instructions = method.Body.Instructions;
|
|
||||||
for (int i = 0; i < instructions.Count; i++) {
|
|
||||||
var instr = instructions[i];
|
|
||||||
if (instr.OpCode.Code != Code.Ldsfld)
|
|
||||||
continue;
|
|
||||||
|
|
||||||
dict[(FieldDefinition)instr.Operand] = method;
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return dict;
|
|
||||||
}
|
|
||||||
|
|
||||||
protected override void getCallInfo(object context, FieldDefinition field, out MethodReference calledMethod, out OpCode callOpcode) {
|
protected override void getCallInfo(object context, FieldDefinition field, out MethodReference calledMethod, out OpCode callOpcode) {
|
||||||
var ctx = (Context)context;
|
var ctx = (Context)context;
|
||||||
|
|
||||||
|
|
|
@ -73,25 +73,6 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
|
||||||
return null;
|
return null;
|
||||||
}
|
}
|
||||||
|
|
||||||
protected override Dictionary<FieldDefinition, MethodDefinition> getFieldToMethodDictionary(TypeDefinition type) {
|
|
||||||
var dict = new Dictionary<FieldDefinition, MethodDefinition>();
|
|
||||||
foreach (var method in type.Methods) {
|
|
||||||
if (!method.IsStatic || !method.HasBody || method.Name == ".cctor")
|
|
||||||
continue;
|
|
||||||
|
|
||||||
var instructions = method.Body.Instructions;
|
|
||||||
for (int i = 0; i < instructions.Count; i++) {
|
|
||||||
var instr = instructions[i];
|
|
||||||
if (instr.OpCode.Code != Code.Ldsfld)
|
|
||||||
continue;
|
|
||||||
|
|
||||||
dict[(FieldDefinition)instr.Operand] = method;
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return dict;
|
|
||||||
}
|
|
||||||
|
|
||||||
protected override void getCallInfo(object context, FieldDefinition field, out MethodReference calledMethod, out OpCode callOpcode) {
|
protected override void getCallInfo(object context, FieldDefinition field, out MethodReference calledMethod, out OpCode callOpcode) {
|
||||||
var ctx = (Context)context;
|
var ctx = (Context)context;
|
||||||
|
|
||||||
|
|
|
@ -472,9 +472,10 @@ namespace de4dot.code.deobfuscators {
|
||||||
|
|
||||||
Log.v("Removing types");
|
Log.v("Removing types");
|
||||||
Log.indent();
|
Log.indent();
|
||||||
|
var moduleType = DotNetUtils.getModuleType(module);
|
||||||
foreach (var info in typesToRemove) {
|
foreach (var info in typesToRemove) {
|
||||||
var typeDef = info.obj;
|
var typeDef = info.obj;
|
||||||
if (typeDef == null)
|
if (typeDef == null || typeDef == moduleType)
|
||||||
continue;
|
continue;
|
||||||
bool removed;
|
bool removed;
|
||||||
if (typeDef.IsNested)
|
if (typeDef.IsNested)
|
||||||
|
@ -663,18 +664,22 @@ namespace de4dot.code.deobfuscators {
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
protected void removeProxyDelegates(ProxyCallFixerBase proxyCallFixer) {
|
protected bool removeProxyDelegates(ProxyCallFixerBase proxyCallFixer) {
|
||||||
removeProxyDelegates(proxyCallFixer, true);
|
return removeProxyDelegates(proxyCallFixer, true);
|
||||||
}
|
}
|
||||||
|
|
||||||
protected void removeProxyDelegates(ProxyCallFixerBase proxyCallFixer, bool removeCreators) {
|
protected bool removeProxyDelegates(ProxyCallFixerBase proxyCallFixer, bool removeCreators) {
|
||||||
if (proxyCallFixer.Errors != 0) {
|
if (proxyCallFixer.Errors != 0) {
|
||||||
Log.v("Not removing proxy delegates and creator type since errors were detected.");
|
Log.v("Not removing proxy delegates and creator type since errors were detected.");
|
||||||
return;
|
return false;
|
||||||
}
|
}
|
||||||
addTypesToBeRemoved(proxyCallFixer.DelegateTypes, "Proxy delegate type");
|
addTypesToBeRemoved(proxyCallFixer.DelegateTypes, "Proxy delegate type");
|
||||||
if (removeCreators && proxyCallFixer.RemovedDelegateCreatorCalls > 0)
|
if (removeCreators && proxyCallFixer.RemovedDelegateCreatorCalls > 0) {
|
||||||
addTypesToBeRemoved(proxyCallFixer.DelegateCreatorTypes, "Proxy delegate creator type");
|
addTypesToBeRemoved(proxyCallFixer.DelegateCreatorTypes, "Proxy delegate creator type");
|
||||||
|
foreach (var tuple in proxyCallFixer.OtherMethods)
|
||||||
|
addMethodToBeRemoved(tuple.Item1, tuple.Item2);
|
||||||
|
}
|
||||||
|
return true;
|
||||||
}
|
}
|
||||||
|
|
||||||
protected Resource getResource(IEnumerable<string> strings) {
|
protected Resource getResource(IEnumerable<string> strings) {
|
||||||
|
|
|
@ -136,10 +136,6 @@ namespace de4dot.code.deobfuscators.Goliath_NET {
|
||||||
throw new System.NotImplementedException();
|
throw new System.NotImplementedException();
|
||||||
}
|
}
|
||||||
|
|
||||||
protected override Dictionary<FieldDefinition, MethodDefinition> getFieldToMethodDictionary(TypeDefinition type) {
|
|
||||||
throw new NotImplementedException();
|
|
||||||
}
|
|
||||||
|
|
||||||
protected override void getCallInfo(object context, FieldDefinition field, out MethodReference calledMethod, out OpCode callOpcode) {
|
protected override void getCallInfo(object context, FieldDefinition field, out MethodReference calledMethod, out OpCode callOpcode) {
|
||||||
throw new System.NotImplementedException();
|
throw new System.NotImplementedException();
|
||||||
}
|
}
|
||||||
|
|
|
@ -58,6 +58,10 @@ namespace de4dot.code.deobfuscators {
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
public virtual IEnumerable<Tuple<MethodDefinition, string>> OtherMethods {
|
||||||
|
get { return new List<Tuple<MethodDefinition, string>>(); }
|
||||||
|
}
|
||||||
|
|
||||||
public bool Detected {
|
public bool Detected {
|
||||||
get { return delegateCreatorMethods.Count != 0; }
|
get { return delegateCreatorMethods.Count != 0; }
|
||||||
}
|
}
|
||||||
|
@ -431,9 +435,30 @@ namespace de4dot.code.deobfuscators {
|
||||||
}
|
}
|
||||||
|
|
||||||
protected abstract object checkCctor(TypeDefinition type, MethodDefinition cctor);
|
protected abstract object checkCctor(TypeDefinition type, MethodDefinition cctor);
|
||||||
protected abstract Dictionary<FieldDefinition, MethodDefinition> getFieldToMethodDictionary(TypeDefinition type);
|
|
||||||
protected abstract void getCallInfo(object context, FieldDefinition field, out MethodReference calledMethod, out OpCode callOpcode);
|
protected abstract void getCallInfo(object context, FieldDefinition field, out MethodReference calledMethod, out OpCode callOpcode);
|
||||||
|
|
||||||
|
Dictionary<FieldDefinition, MethodDefinition> getFieldToMethodDictionary(TypeDefinition type) {
|
||||||
|
var dict = new Dictionary<FieldDefinition, MethodDefinition>();
|
||||||
|
foreach (var method in type.Methods) {
|
||||||
|
if (!method.IsStatic || !method.HasBody || method.Name == ".cctor")
|
||||||
|
continue;
|
||||||
|
|
||||||
|
var instructions = method.Body.Instructions;
|
||||||
|
for (int i = 0; i < instructions.Count; i++) {
|
||||||
|
var instr = instructions[i];
|
||||||
|
if (instr.OpCode.Code != Code.Ldsfld)
|
||||||
|
continue;
|
||||||
|
var field = instr.Operand as FieldDefinition;
|
||||||
|
if (field == null)
|
||||||
|
continue;
|
||||||
|
|
||||||
|
dict[field] = method;
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return dict;
|
||||||
|
}
|
||||||
|
|
||||||
protected override bool deobfuscate(Blocks blocks, IList<Block> allBlocks) {
|
protected override bool deobfuscate(Blocks blocks, IList<Block> allBlocks) {
|
||||||
var removeInfos = new Dictionary<Block, List<RemoveInfo>>();
|
var removeInfos = new Dictionary<Block, List<RemoveInfo>>();
|
||||||
|
|
||||||
|
|
Loading…
Reference in New Issue
Block a user