From 226d18dff7d453e382be7a87e08b6d86e5752459 Mon Sep 17 00:00:00 2001
From: de4dot <de4dot@gmail.com>
Date: Wed, 14 Nov 2012 11:29:22 +0100
Subject: [PATCH] Only set ILOnly if there are no native methods

---
 .../deobfuscators/Agile_NET/Deobfuscator.cs      |  7 +++++--
 de4dot.code/deobfuscators/DeobfuscatorBase.cs    | 16 ++++++++++++++++
 2 files changed, 21 insertions(+), 2 deletions(-)

diff --git a/de4dot.code/deobfuscators/Agile_NET/Deobfuscator.cs b/de4dot.code/deobfuscators/Agile_NET/Deobfuscator.cs
index f9c0974d..fcfe1e5e 100644
--- a/de4dot.code/deobfuscators/Agile_NET/Deobfuscator.cs
+++ b/de4dot.code/deobfuscators/Agile_NET/Deobfuscator.cs
@@ -307,9 +307,12 @@ namespace de4dot.code.deobfuscators.Agile_NET {
 				addResources("Obfuscator protection files");
 			}
 
-			module.IsILOnly = true;
-
 			base.deobfuscateEnd();
+
+			// Call hasNativeMethods() after all types/methods/etc have been removed since
+			// some of the removed methods could be native methods
+			if (!module.IsILOnly && !hasNativeMethods())
+				module.IsILOnly = true;
 		}
 
 		public override IEnumerable<int> getStringDecrypterMethods() {
diff --git a/de4dot.code/deobfuscators/DeobfuscatorBase.cs b/de4dot.code/deobfuscators/DeobfuscatorBase.cs
index 1c567670..fa855f13 100644
--- a/de4dot.code/deobfuscators/DeobfuscatorBase.cs
+++ b/de4dot.code/deobfuscators/DeobfuscatorBase.cs
@@ -763,6 +763,22 @@ namespace de4dot.code.deobfuscators {
 			return false;
 		}
 
+		protected bool hasNativeMethods() {
+			if (module.VTableFixups != null)
+				return true;
+			foreach (var type in module.GetTypes()) {
+				foreach (var method in type.Methods) {
+					var mb = method.MethodBody;
+					if (mb == null)
+						continue;
+					if (mb is CilBody)
+						continue;
+					return true;
+				}
+			}
+			return false;
+		}
+
 		protected static int toInt32(bool b) {
 			return b ? 1 : 0;
 		}