Remove earlyDetect()
This commit is contained in:
parent
3b45ddc336
commit
1768de1d6b
|
@ -248,7 +248,6 @@ namespace de4dot.code {
|
|||
if (this.deob != null) {
|
||||
deob.init(module);
|
||||
deob.DeobfuscatedFile = this;
|
||||
deob.earlyDetect();
|
||||
deob.detect();
|
||||
return;
|
||||
}
|
||||
|
@ -261,35 +260,14 @@ namespace de4dot.code {
|
|||
if (options.ForcedObfuscatorType != null) {
|
||||
foreach (var deob in deobfuscators) {
|
||||
if (string.Equals(options.ForcedObfuscatorType, deob.Type, StringComparison.OrdinalIgnoreCase)) {
|
||||
deob.earlyDetect();
|
||||
this.deob = deob;
|
||||
deob.detect();
|
||||
return;
|
||||
}
|
||||
}
|
||||
}
|
||||
else {
|
||||
this.deob = earlyDetectObfuscator(deobfuscators);
|
||||
if (this.deob == null)
|
||||
this.deob = detectObfuscator2(deobfuscators);
|
||||
else
|
||||
this.deob.detect();
|
||||
}
|
||||
}
|
||||
|
||||
IDeobfuscator earlyDetectObfuscator(IEnumerable<IDeobfuscator> deobfuscators) {
|
||||
IDeobfuscator detected = null;
|
||||
int detectVal = 0;
|
||||
foreach (var deob in deobfuscators) {
|
||||
int val = deob.earlyDetect();
|
||||
if (val > 0)
|
||||
Log.v("{0,3}: {1}", val, deob.TypeLong);
|
||||
if (val > detectVal) {
|
||||
detectVal = val;
|
||||
detected = deob;
|
||||
}
|
||||
}
|
||||
return detected;
|
||||
else
|
||||
this.deob = detectObfuscator2(deobfuscators);
|
||||
}
|
||||
|
||||
IDeobfuscator detectObfuscator2(IEnumerable<IDeobfuscator> deobfuscators) {
|
||||
|
|
|
@ -127,10 +127,6 @@ namespace de4dot.code.deobfuscators {
|
|||
return optionsBase.ValidNameRegex.isMatch(name);
|
||||
}
|
||||
|
||||
public virtual int earlyDetect() {
|
||||
return 0;
|
||||
}
|
||||
|
||||
public virtual int detect() {
|
||||
scanForObfuscator();
|
||||
return detectInternal();
|
||||
|
|
|
@ -72,11 +72,6 @@ namespace de4dot.code.deobfuscators {
|
|||
|
||||
void init(ModuleDefinition module);
|
||||
|
||||
// Same as detect() but may be used by deobfuscators to detect obfuscator that decrypt
|
||||
// metadata at runtime. Code in detect() assume they can access everything. 0 should be
|
||||
// returned if not detected.
|
||||
int earlyDetect();
|
||||
|
||||
// Returns 0 if it's not detected, or > 0 if detected (higher value => more likely true).
|
||||
// This method is always called.
|
||||
int detect();
|
||||
|
|
|
@ -76,19 +76,6 @@ namespace de4dot.code.deobfuscators.Unknown {
|
|||
obfuscatorName = string.Format("{0} (not supported)", name);
|
||||
}
|
||||
|
||||
public override int earlyDetect() {
|
||||
setName(earlyScanTypes());
|
||||
return obfuscatorName != null ? 1 : 0;
|
||||
}
|
||||
|
||||
string earlyScanTypes() {
|
||||
foreach (var type in module.Types) {
|
||||
if (type.FullName == "ConfusedByAttribute")
|
||||
return "Confuser";
|
||||
}
|
||||
return null;
|
||||
}
|
||||
|
||||
protected override int detectInternal() {
|
||||
setName(scanTypes());
|
||||
return 1;
|
||||
|
@ -99,6 +86,8 @@ namespace de4dot.code.deobfuscators.Unknown {
|
|||
|
||||
string scanTypes() {
|
||||
foreach (var type in module.Types) {
|
||||
if (type.FullName == "ConfusedByAttribute")
|
||||
return "Confuser";
|
||||
if (type.FullName == "ZYXDNGuarder")
|
||||
return "DNGuard HVM";
|
||||
if (type.Name.Contains("();\t"))
|
||||
|
|
Loading…
Reference in New Issue
Block a user