diff --git a/de4dot.code/deobfuscators/Agile_NET/ResourceDecrypter.cs b/de4dot.code/deobfuscators/Agile_NET/ResourceDecrypter.cs index c696f508..e1854f9c 100644 --- a/de4dot.code/deobfuscators/Agile_NET/ResourceDecrypter.cs +++ b/de4dot.code/deobfuscators/Agile_NET/ResourceDecrypter.cs @@ -62,10 +62,15 @@ namespace de4dot.code.deobfuscators.Agile_NET { FindResourceType(); } - static readonly string[] requiredFields = new string[] { + static readonly string[] requiredFields1 = new string[] { "System.Reflection.Assembly", "System.String[]", }; + static readonly string[] requiredFields2 = new string[] { + "System.Reflection.Assembly", + "System.String[]", + "System.Collections.Hashtable", + }; void FindResourceType() { var cctor = DotNetUtils.GetModuleTypeCctor(module); if (cctor == null) @@ -77,7 +82,9 @@ namespace de4dot.code.deobfuscators.Agile_NET { if (!DotNetUtils.IsMethod(calledMethod, "System.Void", "()")) continue; var type = calledMethod.DeclaringType; - if (!new FieldTypes(type).Exactly(requiredFields)) + var fieldTypes = new FieldTypes(type); + if (!fieldTypes.Exactly(requiredFields1) && + !fieldTypes.Exactly(requiredFields2)) continue; var resolveHandler = DotNetUtils.GetMethod(type, "System.Reflection.Assembly", "(System.Object,System.ResolveEventArgs)"); diff --git a/de4dot.code/deobfuscators/Agile_NET/vm/v2/CSVM5.bin b/de4dot.code/deobfuscators/Agile_NET/vm/v2/CSVM5.bin new file mode 100644 index 00000000..1177d7fc Binary files /dev/null and b/de4dot.code/deobfuscators/Agile_NET/vm/v2/CSVM5.bin differ diff --git a/de4dot.code/deobfuscators/Agile_NET/vm/v2/CsvmInfo.cs b/de4dot.code/deobfuscators/Agile_NET/vm/v2/CsvmInfo.cs index 11ebea38..488f3e14 100644 --- a/de4dot.code/deobfuscators/Agile_NET/vm/v2/CsvmInfo.cs +++ b/de4dot.code/deobfuscators/Agile_NET/vm/v2/CsvmInfo.cs @@ -81,7 +81,7 @@ namespace de4dot.code.deobfuscators.Agile_NET.vm.v2 { foreach (var type in module.Types) { if (!type.IsPublic || !type.IsAbstract) continue; - if (type.HasFields || type.HasProperties || type.HasEvents) + if (type.HasProperties || type.HasEvents) continue; if (type.BaseType == null || type.BaseType.FullName != "System.Object") continue; diff --git a/de4dot.code/deobfuscators/Agile_NET/vm/v2/CsvmResources.Designer.cs b/de4dot.code/deobfuscators/Agile_NET/vm/v2/CsvmResources.Designer.cs index 3a090f84..bea0bf1c 100644 --- a/de4dot.code/deobfuscators/Agile_NET/vm/v2/CsvmResources.Designer.cs +++ b/de4dot.code/deobfuscators/Agile_NET/vm/v2/CsvmResources.Designer.cs @@ -1,7 +1,7 @@ //------------------------------------------------------------------------------ // // This code was generated by a tool. -// Runtime Version:4.0.30319.18052 +// Runtime Version:4.0.30319.18444 // // Changes to this file may cause incorrect behavior and will be lost if // the code is regenerated. @@ -99,5 +99,15 @@ namespace de4dot.code.deobfuscators.Agile_NET.vm.v2 { return ((byte[])(obj)); } } + + /// + /// Looks up a localized resource of type System.Byte[]. + /// + internal static byte[] CSVM5 { + get { + object obj = ResourceManager.GetObject("CSVM5", resourceCulture); + return ((byte[])(obj)); + } + } } } diff --git a/de4dot.code/deobfuscators/Agile_NET/vm/v2/CsvmResources.resx b/de4dot.code/deobfuscators/Agile_NET/vm/v2/CsvmResources.resx index 17159be0..3a91280c 100644 --- a/de4dot.code/deobfuscators/Agile_NET/vm/v2/CsvmResources.resx +++ b/de4dot.code/deobfuscators/Agile_NET/vm/v2/CsvmResources.resx @@ -130,4 +130,8 @@ CSVM4.bin;System.Byte[], mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 + + + CSVM5.bin;System.Byte[], mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 + \ No newline at end of file diff --git a/de4dot.code/deobfuscators/Agile_NET/vm/v2/OpCodeHandlerInfos.cs b/de4dot.code/deobfuscators/Agile_NET/vm/v2/OpCodeHandlerInfos.cs index f70dc4aa..37fa316d 100644 --- a/de4dot.code/deobfuscators/Agile_NET/vm/v2/OpCodeHandlerInfos.cs +++ b/de4dot.code/deobfuscators/Agile_NET/vm/v2/OpCodeHandlerInfos.cs @@ -75,6 +75,7 @@ namespace de4dot.code.deobfuscators.Agile_NET.vm.v2 { ReadOpCodeHandlerInfos(CsvmResources.CSVM2), ReadOpCodeHandlerInfos(CsvmResources.CSVM3), ReadOpCodeHandlerInfos(CsvmResources.CSVM4), + ReadOpCodeHandlerInfos(CsvmResources.CSVM5), }; static IList ReadOpCodeHandlerInfos(byte[] data) { diff --git a/de4dot.code/deobfuscators/Agile_NET/vm/v2/VmOpCodeHandlerDetector.cs b/de4dot.code/deobfuscators/Agile_NET/vm/v2/VmOpCodeHandlerDetector.cs index ccb40008..220044a3 100644 --- a/de4dot.code/deobfuscators/Agile_NET/vm/v2/VmOpCodeHandlerDetector.cs +++ b/de4dot.code/deobfuscators/Agile_NET/vm/v2/VmOpCodeHandlerDetector.cs @@ -254,7 +254,8 @@ namespace de4dot.code.deobfuscators.Agile_NET.vm.v2 { if (cctor == null) continue; requiredFields[0] = type.FullName; - if (!new FieldTypes(type).Exactly(requiredFields)) + var fieldTypes = new FieldTypes(type); + if (!fieldTypes.All(requiredFields)) continue; cflowDeobfuscator.Deobfuscate(cctor); diff --git a/de4dot.mdecrypt/DynamicMethodsDecrypter.cs b/de4dot.mdecrypt/DynamicMethodsDecrypter.cs index 24fa5816..58557ff5 100644 --- a/de4dot.mdecrypt/DynamicMethodsDecrypter.cs +++ b/de4dot.mdecrypt/DynamicMethodsDecrypter.cs @@ -596,6 +596,9 @@ namespace de4dot.mdecrypt { new PatchInfo(0x000110A5, new byte[] { 0x33, 0xC0, 0xC2, 0x04, 0x00 }, new byte[] { 0xE9, 0x36, 0x3A, 0x00, 0x00 }), new PatchInfo(0x000110AF, new byte[] { 0x33, 0xC0, 0xC2, 0x04, 0x00 }, new byte[] { 0xE9, 0x4C, 0x3C, 0x00, 0x00 }), new PatchInfo(0x000110AA, new byte[] { 0x33, 0xC0, 0xC2, 0x04, 0x00 }, new byte[] { 0xE9, 0xF1, 0x3A, 0x00, 0x00 }), + new PatchInfo(0x00011019, new byte[] { 0x33, 0xC0, 0xC2, 0x04, 0x00 }, new byte[] { 0xE9, 0x12, 0x4B, 0x00, 0x00 }), + new PatchInfo(0x00011019, new byte[] { 0x33, 0xC0, 0xC2, 0x04, 0x00 }, new byte[] { 0xE9, 0x02, 0x4B, 0x00, 0x00 }), + new PatchInfo(0x00011019, new byte[] { 0x33, 0xC0, 0xC2, 0x04, 0x00 }, new byte[] { 0xE9, 0xA2, 0x4B, 0x00, 0x00 }), }; static unsafe bool PatchCM(IntPtr addr, IntPtr origValue, IntPtr newValue) {