diff --git a/de4dot.code/deobfuscators/CryptoObfuscator/AssemblyResolver.cs b/de4dot.code/deobfuscators/CryptoObfuscator/AssemblyResolver.cs index 998e952f..cd13f7f5 100644 --- a/de4dot.code/deobfuscators/CryptoObfuscator/AssemblyResolver.cs +++ b/de4dot.code/deobfuscators/CryptoObfuscator/AssemblyResolver.cs @@ -67,7 +67,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator { this.module = module; } - public void Find() { + public void Find(ISimpleDeobfuscator simpleDeobfuscator) { var cctor = DotNetUtils.GetModuleTypeCctor(module); if (cctor == null) return; @@ -77,14 +77,15 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator { continue; if (!method.IsStatic || !DotNetUtils.IsMethod(method, "System.Void", "()")) continue; - if (CheckType(method.DeclaringType, method)) + if (CheckType(method.DeclaringType, method, simpleDeobfuscator)) break; } } - bool CheckType(TypeDef type, MethodDef initMethod) { + bool CheckType(TypeDef type, MethodDef initMethod, ISimpleDeobfuscator simpleDeobfuscator) { if (DotNetUtils.FindFieldType(type, "System.Collections.Hashtable", true) == null) return false; + simpleDeobfuscator.Deobfuscate(initMethod); if (!CheckInitMethod(initMethod)) return false; if ((asmSeparator = FindAssemblySeparator(initMethod)) == null) diff --git a/de4dot.code/deobfuscators/CryptoObfuscator/Deobfuscator.cs b/de4dot.code/deobfuscators/CryptoObfuscator/Deobfuscator.cs index 851c6ae3..f38330e9 100644 --- a/de4dot.code/deobfuscators/CryptoObfuscator/Deobfuscator.cs +++ b/de4dot.code/deobfuscators/CryptoObfuscator/Deobfuscator.cs @@ -210,7 +210,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator { resourceResolver = new ResourceResolver(module, resourceDecrypter); assemblyResolver = new AssemblyResolver(module); resourceResolver.Find(); - assemblyResolver.Find(); + assemblyResolver.Find(DeobfuscatedFile); DecryptResources(); stringDecrypter.Initialize(resourceDecrypter); @@ -225,7 +225,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator { if (methodsDecrypter.Detected) { if (!assemblyResolver.Detected) - assemblyResolver.Find(); + assemblyResolver.Find(DeobfuscatedFile); if (!tamperDetection.Detected) tamperDetection.Find(); }