From 15b4cefe8968a7deb601b6ec226761f1a5d56eb2 Mon Sep 17 00:00:00 2001 From: de4dot Date: Wed, 21 Dec 2011 00:30:17 +0100 Subject: [PATCH] Move method to base class --- de4dot.code/deobfuscators/DeobfuscatorBase.cs | 52 ++++++++++++++++++ .../dotNET_Reactor4/Deobfuscator.cs | 54 +------------------ 2 files changed, 53 insertions(+), 53 deletions(-) diff --git a/de4dot.code/deobfuscators/DeobfuscatorBase.cs b/de4dot.code/deobfuscators/DeobfuscatorBase.cs index d6a553e5..60ffc73e 100644 --- a/de4dot.code/deobfuscators/DeobfuscatorBase.cs +++ b/de4dot.code/deobfuscators/DeobfuscatorBase.cs @@ -589,5 +589,57 @@ namespace de4dot.code.deobfuscators { var inlinedMethods = InlinedMethodsFinder.find(module); addMethodsToBeRemoved(new UnusedMethodsFinder(module, inlinedMethods).find(), "Inlined method"); } + + protected bool isTypeCalled(TypeDefinition decrypterType) { + if (decrypterType == null) + return false; + + var decrypterMethods = new Dictionary(); + foreach (var type in TypeDefinition.GetTypes(new List { decrypterType })) + addMethods(type, decrypterMethods); + + var removedMethods = new Dictionary(); + foreach (var method in getMethodsToRemove()) + removedMethods[new MethodReferenceAndDeclaringTypeKey(method)] = true; + foreach (var type in TypeDefinition.GetTypes(getTypesToRemove())) + addMethods(type, removedMethods); + + foreach (var type in module.GetTypes()) { + foreach (var method in type.Methods) { + if (method.Body == null) + continue; + var key = new MethodReferenceAndDeclaringTypeKey(method); + if (decrypterMethods.ContainsKey(key)) + break; // decrypter type / nested type method + if (removedMethods.ContainsKey(key)) + continue; + + foreach (var instr in method.Body.Instructions) { + switch (instr.OpCode.Code) { + case Code.Call: + case Code.Callvirt: + case Code.Newobj: + var calledMethod = instr.Operand as MethodReference; + if (calledMethod == null) + break; + key = new MethodReferenceAndDeclaringTypeKey(calledMethod); + if (decrypterMethods.ContainsKey(key)) + return true; + break; + + default: + break; + } + } + } + } + + return false; + } + + static void addMethods(TypeDefinition type, Dictionary methods) { + foreach (var method in type.Methods) + methods[new MethodReferenceAndDeclaringTypeKey(method)] = true; + } } } diff --git a/de4dot.code/deobfuscators/dotNET_Reactor4/Deobfuscator.cs b/de4dot.code/deobfuscators/dotNET_Reactor4/Deobfuscator.cs index e90ba79e..c4656643 100644 --- a/de4dot.code/deobfuscators/dotNET_Reactor4/Deobfuscator.cs +++ b/de4dot.code/deobfuscators/dotNET_Reactor4/Deobfuscator.cs @@ -581,7 +581,7 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor4 { new TypesRestorer(module).deobfuscate(); var decrypterType = getDecrypterType(); - if (canRemoveDecrypterType && isDecrypterTypeCalled(decrypterType)) + if (canRemoveDecrypterType && isTypeCalled(decrypterType)) canRemoveDecrypterType = false; if (canRemoveDecrypterType) @@ -612,57 +612,5 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor4 { return; methodsDecrypter.encryptNativeMethods(builder); } - - bool isDecrypterTypeCalled(TypeDefinition decrypterType) { - if (decrypterType == null) - return false; - - var decrypterMethods = new Dictionary(); - foreach (var type in TypeDefinition.GetTypes(new List { decrypterType })) - addMethods(type, decrypterMethods); - - var removedMethods = new Dictionary(); - foreach (var method in getMethodsToRemove()) - removedMethods[new MethodReferenceAndDeclaringTypeKey(method)] = true; - foreach (var type in TypeDefinition.GetTypes(getTypesToRemove())) - addMethods(type, removedMethods); - - foreach (var type in module.GetTypes()) { - foreach (var method in type.Methods) { - if (method.Body == null) - continue; - var key = new MethodReferenceAndDeclaringTypeKey(method); - if (decrypterMethods.ContainsKey(key)) - break; // decrypter type / nested type method - if (removedMethods.ContainsKey(key)) - continue; - - foreach (var instr in method.Body.Instructions) { - switch (instr.OpCode.Code) { - case Code.Call: - case Code.Callvirt: - case Code.Newobj: - var calledMethod = instr.Operand as MethodReference; - if (calledMethod == null) - break; - key = new MethodReferenceAndDeclaringTypeKey(calledMethod); - if (decrypterMethods.ContainsKey(key)) - return true; - break; - - default: - break; - } - } - } - } - - return false; - } - - static void addMethods(TypeDefinition type, Dictionary methods) { - foreach (var method in type.Methods) - methods[new MethodReferenceAndDeclaringTypeKey(method)] = true; - } } }