From 27694eb19c6317e09c577697124e7dfc7845b6e3 Mon Sep 17 00:00:00 2001 From: de4dot Date: Thu, 27 Mar 2014 11:41:18 +0100 Subject: [PATCH] Support Agile.NET 6.3.0.17 --- .../deobfuscators/Agile_NET/ResourceDecrypter.cs | 11 +++++++++-- .../deobfuscators/Agile_NET/vm/v2/CSVM5.bin | Bin 0 -> 9820 bytes .../deobfuscators/Agile_NET/vm/v2/CsvmInfo.cs | 2 +- .../Agile_NET/vm/v2/CsvmResources.Designer.cs | 12 +++++++++++- .../Agile_NET/vm/v2/CsvmResources.resx | 4 ++++ .../Agile_NET/vm/v2/OpCodeHandlerInfos.cs | 1 + .../Agile_NET/vm/v2/VmOpCodeHandlerDetector.cs | 3 ++- de4dot.mdecrypt/DynamicMethodsDecrypter.cs | 3 +++ 8 files changed, 31 insertions(+), 5 deletions(-) create mode 100644 de4dot.code/deobfuscators/Agile_NET/vm/v2/CSVM5.bin diff --git a/de4dot.code/deobfuscators/Agile_NET/ResourceDecrypter.cs b/de4dot.code/deobfuscators/Agile_NET/ResourceDecrypter.cs index c696f508..e1854f9c 100644 --- a/de4dot.code/deobfuscators/Agile_NET/ResourceDecrypter.cs +++ b/de4dot.code/deobfuscators/Agile_NET/ResourceDecrypter.cs @@ -62,10 +62,15 @@ namespace de4dot.code.deobfuscators.Agile_NET { FindResourceType(); } - static readonly string[] requiredFields = new string[] { + static readonly string[] requiredFields1 = new string[] { "System.Reflection.Assembly", "System.String[]", }; + static readonly string[] requiredFields2 = new string[] { + "System.Reflection.Assembly", + "System.String[]", + "System.Collections.Hashtable", + }; void FindResourceType() { var cctor = DotNetUtils.GetModuleTypeCctor(module); if (cctor == null) @@ -77,7 +82,9 @@ namespace de4dot.code.deobfuscators.Agile_NET { if (!DotNetUtils.IsMethod(calledMethod, "System.Void", "()")) continue; var type = calledMethod.DeclaringType; - if (!new FieldTypes(type).Exactly(requiredFields)) + var fieldTypes = new FieldTypes(type); + if (!fieldTypes.Exactly(requiredFields1) && + !fieldTypes.Exactly(requiredFields2)) continue; var resolveHandler = DotNetUtils.GetMethod(type, "System.Reflection.Assembly", "(System.Object,System.ResolveEventArgs)"); diff --git a/de4dot.code/deobfuscators/Agile_NET/vm/v2/CSVM5.bin b/de4dot.code/deobfuscators/Agile_NET/vm/v2/CSVM5.bin new file mode 100644 index 0000000000000000000000000000000000000000..1177d7fc1f8d763c2f89db0fc01b9ffa102f72d9 GIT binary patch literal 9820 zcmds+3y@A_7{||%kgyw;Ty~4Hi`I2lh>+D9f{nS#OuO-XnzAu0PQ)tYb3zvnq5YcZYRNCVxJbG4s#U^(VC{ ztYb3zvnq6@#)f;2WYRU!-h*01??F8p8gv}gTf7;}m=Qa}+Ev+$U`OdwWZgk;&QCe7 z#-NRDUT^jJ`d*FaX%9y)wR7RD5BQBV4JVA<;`u2Kny!Y5M^_Nt@1&ZUaBR}uxxGN* zbziM)caHXkZF{$QNxCr|5vzjG{t%rllITgi$2rfS&Xit60(#j$Y1UwgthBjKqgVQ-{3CcM?(71H=QD_>EuIAFKdc zy(uU&5YQYSpPOdof_B2Zo*uC(ojaKx{~`ktkEnfj4;yW|%j(X(DsA2Rg^i;3U$hMI z_Z^uRdC`qkMh#n4%t(->y4A)Wvs^-pbi~8AvzPth z`6fJL>J@v)&40QxI2W+dNzAgM{n}-OE1AEMReNhq{VEn~qLGeZ1F;!@t?bH{Xt6D4EGILRhRAxgGthqSv>tZ{?sOMi`{2rsxXA$~Fhp%uZY z9{4KUiERJwj%Awbtglturqix}q;r134^}($kP-7Dmw%yoDuQ`zMg)X;g=H6hNT^b> z3Q-up>xqtd7{{7E~(-g-2Y<@Vm&FX{g|ierU~;*l_K;=|H`2Qio1- zPEw&#nN=##VvQv?&Mbl3bBbu9kDlZi~wsZLF?BNHmzFg#QZ)PmaeXdK=F+-@9k3rR-v6)hFnOH?X3Mh#$v9EmvjZ-qOQ|Up&7pJUUG5 z3RgE8`Qjf?eMv_v>!lHldBjvoG9u?xgLhR+Q-qw+bahZ5J-?eX61Gm!)Dhhj@A=&w zN+Lw9qEENuI=@Qn?T9Z<=_YPE@}}%auw3F}_;0_je|`C%d9M@WB3a=| zueNk_y`34ig1LO)_3DjR4zXJHsU&K3&)<$%)D;dYoVX$iJmH* z_Di0h=TLAuq79w}NpeOdcSSlBR;X-u zgMX$jZbJv~1^4ws5N z9m~mp18YQAK=`B_UXbDW{mq+jJ$1G&&Yk`+x=FS!NB}u;UawgeIUoUK+2Y~(7CF!$ zPiAp!d2vxzQG<04)r{>yusG4D^%u%;^%@k1LwMhk // This code was generated by a tool. -// Runtime Version:4.0.30319.18052 +// Runtime Version:4.0.30319.18444 // // Changes to this file may cause incorrect behavior and will be lost if // the code is regenerated. @@ -99,5 +99,15 @@ namespace de4dot.code.deobfuscators.Agile_NET.vm.v2 { return ((byte[])(obj)); } } + + /// + /// Looks up a localized resource of type System.Byte[]. + /// + internal static byte[] CSVM5 { + get { + object obj = ResourceManager.GetObject("CSVM5", resourceCulture); + return ((byte[])(obj)); + } + } } } diff --git a/de4dot.code/deobfuscators/Agile_NET/vm/v2/CsvmResources.resx b/de4dot.code/deobfuscators/Agile_NET/vm/v2/CsvmResources.resx index 17159be0..3a91280c 100644 --- a/de4dot.code/deobfuscators/Agile_NET/vm/v2/CsvmResources.resx +++ b/de4dot.code/deobfuscators/Agile_NET/vm/v2/CsvmResources.resx @@ -130,4 +130,8 @@ CSVM4.bin;System.Byte[], mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 + + + CSVM5.bin;System.Byte[], mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 + \ No newline at end of file diff --git a/de4dot.code/deobfuscators/Agile_NET/vm/v2/OpCodeHandlerInfos.cs b/de4dot.code/deobfuscators/Agile_NET/vm/v2/OpCodeHandlerInfos.cs index f70dc4aa..37fa316d 100644 --- a/de4dot.code/deobfuscators/Agile_NET/vm/v2/OpCodeHandlerInfos.cs +++ b/de4dot.code/deobfuscators/Agile_NET/vm/v2/OpCodeHandlerInfos.cs @@ -75,6 +75,7 @@ namespace de4dot.code.deobfuscators.Agile_NET.vm.v2 { ReadOpCodeHandlerInfos(CsvmResources.CSVM2), ReadOpCodeHandlerInfos(CsvmResources.CSVM3), ReadOpCodeHandlerInfos(CsvmResources.CSVM4), + ReadOpCodeHandlerInfos(CsvmResources.CSVM5), }; static IList ReadOpCodeHandlerInfos(byte[] data) { diff --git a/de4dot.code/deobfuscators/Agile_NET/vm/v2/VmOpCodeHandlerDetector.cs b/de4dot.code/deobfuscators/Agile_NET/vm/v2/VmOpCodeHandlerDetector.cs index ccb40008..220044a3 100644 --- a/de4dot.code/deobfuscators/Agile_NET/vm/v2/VmOpCodeHandlerDetector.cs +++ b/de4dot.code/deobfuscators/Agile_NET/vm/v2/VmOpCodeHandlerDetector.cs @@ -254,7 +254,8 @@ namespace de4dot.code.deobfuscators.Agile_NET.vm.v2 { if (cctor == null) continue; requiredFields[0] = type.FullName; - if (!new FieldTypes(type).Exactly(requiredFields)) + var fieldTypes = new FieldTypes(type); + if (!fieldTypes.All(requiredFields)) continue; cflowDeobfuscator.Deobfuscate(cctor); diff --git a/de4dot.mdecrypt/DynamicMethodsDecrypter.cs b/de4dot.mdecrypt/DynamicMethodsDecrypter.cs index 24fa5816..58557ff5 100644 --- a/de4dot.mdecrypt/DynamicMethodsDecrypter.cs +++ b/de4dot.mdecrypt/DynamicMethodsDecrypter.cs @@ -596,6 +596,9 @@ namespace de4dot.mdecrypt { new PatchInfo(0x000110A5, new byte[] { 0x33, 0xC0, 0xC2, 0x04, 0x00 }, new byte[] { 0xE9, 0x36, 0x3A, 0x00, 0x00 }), new PatchInfo(0x000110AF, new byte[] { 0x33, 0xC0, 0xC2, 0x04, 0x00 }, new byte[] { 0xE9, 0x4C, 0x3C, 0x00, 0x00 }), new PatchInfo(0x000110AA, new byte[] { 0x33, 0xC0, 0xC2, 0x04, 0x00 }, new byte[] { 0xE9, 0xF1, 0x3A, 0x00, 0x00 }), + new PatchInfo(0x00011019, new byte[] { 0x33, 0xC0, 0xC2, 0x04, 0x00 }, new byte[] { 0xE9, 0x12, 0x4B, 0x00, 0x00 }), + new PatchInfo(0x00011019, new byte[] { 0x33, 0xC0, 0xC2, 0x04, 0x00 }, new byte[] { 0xE9, 0x02, 0x4B, 0x00, 0x00 }), + new PatchInfo(0x00011019, new byte[] { 0x33, 0xC0, 0xC2, 0x04, 0x00 }, new byte[] { 0xE9, 0xA2, 0x4B, 0x00, 0x00 }), }; static unsafe bool PatchCM(IntPtr addr, IntPtr origValue, IntPtr newValue) {