monocul.us/de4dot-cex
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Attributes are worth less

Browse Source
This commit is contained in:
de4dot 2012-02-29 00:13:57 +01:00
parent b27635f493
commit 167368f488
8 changed files with 25 additions and 27 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
de4dot.code/deobfuscators/Babel_NET/Deobfuscator.cs
View File

@ -114,8 +114,7 @@ namespace de4dot.code.deobfuscators.Babel_NET {
protected override int detectInternal() {
int val = 0;
int sum = toInt32(foundBabelAttribute) +
toInt32(resourceResolver.Detected) +
int sum = toInt32(resourceResolver.Detected) +
toInt32(assemblyResolver.Detected) +
toInt32(stringDecrypter.Detected) +
toInt32(constantsDecrypter.Detected) +
@ -124,6 +123,8 @@ namespace de4dot.code.deobfuscators.Babel_NET {
toInt32(hasMetadataStream("Babel"));
if (sum > 0)
val += 100 + 10 * (sum - 1);
if (foundBabelAttribute)
val += 10;
return val;
}

11
de4dot.code/deobfuscators/CliSecure/Deobfuscator.cs
View File

@ -106,11 +106,12 @@ namespace de4dot.code.deobfuscators.CliSecure {
protected override int detectInternal() {
int val = 0;
if (cliSecureRtType.Detected || cliSecureAttribute != null)
val += 100;
if (stringDecrypter.Detected)
val += 10;
if (proxyDelegateFinder.Detected)
int sum = toInt32(cliSecureRtType.Detected) +
toInt32(stringDecrypter.Detected) +
toInt32(proxyDelegateFinder.Detected);
if (sum > 0)
val += 100 + 10 * (sum - 1);
if (cliSecureAttribute != null)
val += 10;
return val;

2
de4dot.code/deobfuscators/CodeVeil/Deobfuscator.cs
View File

@ -95,8 +95,6 @@ namespace de4dot.code.deobfuscators.CodeVeil {
toInt32(proxyDelegateFinder.Detected);
if (sum > 0)
val += 100 + 10 * (sum - 1);
if (killType != null)
val += 10;
return val;
}

15
de4dot.code/deobfuscators/CryptoObfuscator/Deobfuscator.cs
View File

@ -99,15 +99,12 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
protected override int detectInternal() {
int val = 0;
if (foundCryptoObfuscatorAttribute)
val += 100;
else if (foundObfuscatedSymbols)
val += 10;
if (stringDecrypter.Detected)
val += 10;
if (tamperDetection.Detected)
val += 10;
if (proxyDelegateFinder.Detected)
int sum = toInt32(stringDecrypter.Detected) +
toInt32(tamperDetection.Detected) +
toInt32(proxyDelegateFinder.Detected);
if (sum > 0)
val += 100 + 10 * (sum - 1);
if (foundCryptoObfuscatorAttribute || foundObfuscatedSymbols)
val += 10;
return val;

5
de4dot.code/deobfuscators/Goliath_NET/Deobfuscator.cs
View File

@ -126,14 +126,15 @@ namespace de4dot.code.deobfuscators.Goliath_NET {
protected override int detectInternal() {
int val = 0;
int sum = toInt32(foundGoliathAttribute) +
toInt32(stringDecrypter.Detected) +
int sum = toInt32(stringDecrypter.Detected) +
toInt32(integerDecrypter.Detected) +
toInt32(arrayDecrypter.Detected) +
toInt32(strongNameChecker.Detected) +
toInt32(hasMetadataStream("#GOLIATH"));
if (sum > 0)
val += 100 + 10 * (sum - 1);
if (foundGoliathAttribute)
val += 10;
return val;
}

5
de4dot.code/deobfuscators/SmartAssembly/Deobfuscator.cs
View File

@ -130,10 +130,9 @@ namespace de4dot.code.deobfuscators.SmartAssembly {
protected override int detectInternal() {
int val = 0;
if (foundSmartAssemblyAttribute)
val += 100;
if (memoryManagerInfo.Detected)
val += 100;
if (foundSmartAssemblyAttribute)
val += 10;
return val;

5
de4dot.code/deobfuscators/Spices_Net/Deobfuscator.cs
View File

@ -121,10 +121,11 @@ namespace de4dot.code.deobfuscators.Spices_Net {
protected override int detectInternal() {
int val = 0;
int sum = toInt32(stringDecrypter.Detected) +
toInt32(foundSpicesAttribute);
int sum = toInt32(stringDecrypter.Detected);
if (sum > 0)
val += 100 + 10 * (sum - 1);
if (foundSpicesAttribute)
val += 10;
return val;
}

4
de4dot.code/deobfuscators/Xenocode/Deobfuscator.cs
View File

@ -70,9 +70,9 @@ namespace de4dot.code.deobfuscators.Xenocode {
protected override int detectInternal() {
int val = 0;
if (foundXenocodeAttribute || stringDecrypter.Detected)
if (stringDecrypter.Detected)
val += 100;
if (foundXenocodeAttribute && stringDecrypter.Detected)
if (foundXenocodeAttribute)
val += 10;
return val;