From 183619f979e7831fb21b413c72758d854751743a Mon Sep 17 00:00:00 2001 From: de4dot Date: Thu, 10 Nov 2011 14:51:19 +0100 Subject: [PATCH] Remove String.Intern() calls when decrypting strings --- de4dot.code/StringDecrypter.cs | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/de4dot.code/StringDecrypter.cs b/de4dot.code/StringDecrypter.cs index 6dd7c883..16b614d6 100644 --- a/de4dot.code/StringDecrypter.cs +++ b/de4dot.code/StringDecrypter.cs @@ -31,7 +31,21 @@ namespace de4dot { var block = callResult.block; int num = callResult.callEndIndex - callResult.callStartIndex + 1; - block.replace(callResult.callStartIndex, num, Instruction.Create(OpCodes.Ldstr, (string)callResult.returnValue)); + int ldstrIndex = callResult.callStartIndex; + block.replace(ldstrIndex, num, Instruction.Create(OpCodes.Ldstr, (string)callResult.returnValue)); + + // If it's followed by String.Intern(), then nop out that call + if (ldstrIndex + 1 < block.Instructions.Count) { + var instr = block.Instructions[ldstrIndex + 1]; + if (instr.OpCode.Code == Code.Call) { + var calledMethod = instr.Operand as MethodReference; + if (calledMethod != null && + calledMethod.FullName == "System.String System.String::Intern(System.String)") { + block.remove(ldstrIndex + 1, 1); + } + } + } + Log.v("Decrypted string: {0}", Utils.toCsharpString((string)callResult.returnValue)); } }