From 1dee5e80173c73ad7815d67ea1b70ce85fc46050 Mon Sep 17 00:00:00 2001 From: de4dot Date: Tue, 15 Oct 2013 10:12:53 +0200 Subject: [PATCH] Support latest Dotfuscator --- .../Dotfuscator/StringDecrypter.cs | 22 +++++++++++++------ 1 file changed, 15 insertions(+), 7 deletions(-) diff --git a/de4dot.code/deobfuscators/Dotfuscator/StringDecrypter.cs b/de4dot.code/deobfuscators/Dotfuscator/StringDecrypter.cs index 71466c7b..5576b00f 100644 --- a/de4dot.code/deobfuscators/Dotfuscator/StringDecrypter.cs +++ b/de4dot.code/deobfuscators/Dotfuscator/StringDecrypter.cs @@ -73,15 +73,23 @@ namespace de4dot.code.deobfuscators.Dotfuscator { continue; simpleDeobfuscator.Deobfuscate(method); - var instructions = method.Body.Instructions; - for (int i = 0; i <= instructions.Count - 3; i++) { - var ldci4 = method.Body.Instructions[i]; + var instrs = method.Body.Instructions; + for (int i = 0; i < instrs.Count - 3; i++) { + var ldarg = instrs[i]; + if (!ldarg.IsLdarg() || ldarg.GetParameterIndex() != 0) + continue; + var callvirt = instrs[i + 1]; + if (callvirt.OpCode.Code != Code.Callvirt) + continue; + var calledMethod = callvirt.Operand as MemberRef; + if (calledMethod == null || calledMethod.FullName != "System.Char[] System.String::ToCharArray()") + continue; + var stloc = instrs[i + 2]; + if (!stloc.IsStloc()) + continue; + var ldci4 = instrs[i + 3]; if (!ldci4.IsLdcI4()) continue; - if (instructions[i + 1].OpCode.Code != Code.Ldarg_1) - continue; - if (instructions[i + 2].OpCode.Code != Code.Add) - continue; var info = new StringDecrypterInfo(method, ldci4.GetLdcI4Value()); stringDecrypterMethods.Add(info.method, info);