Support Agile.NET 6.3.0.17
This commit is contained in:
parent
43453f3863
commit
27694eb19c
|
@ -62,10 +62,15 @@ namespace de4dot.code.deobfuscators.Agile_NET {
|
||||||
FindResourceType();
|
FindResourceType();
|
||||||
}
|
}
|
||||||
|
|
||||||
static readonly string[] requiredFields = new string[] {
|
static readonly string[] requiredFields1 = new string[] {
|
||||||
"System.Reflection.Assembly",
|
"System.Reflection.Assembly",
|
||||||
"System.String[]",
|
"System.String[]",
|
||||||
};
|
};
|
||||||
|
static readonly string[] requiredFields2 = new string[] {
|
||||||
|
"System.Reflection.Assembly",
|
||||||
|
"System.String[]",
|
||||||
|
"System.Collections.Hashtable",
|
||||||
|
};
|
||||||
void FindResourceType() {
|
void FindResourceType() {
|
||||||
var cctor = DotNetUtils.GetModuleTypeCctor(module);
|
var cctor = DotNetUtils.GetModuleTypeCctor(module);
|
||||||
if (cctor == null)
|
if (cctor == null)
|
||||||
|
@ -77,7 +82,9 @@ namespace de4dot.code.deobfuscators.Agile_NET {
|
||||||
if (!DotNetUtils.IsMethod(calledMethod, "System.Void", "()"))
|
if (!DotNetUtils.IsMethod(calledMethod, "System.Void", "()"))
|
||||||
continue;
|
continue;
|
||||||
var type = calledMethod.DeclaringType;
|
var type = calledMethod.DeclaringType;
|
||||||
if (!new FieldTypes(type).Exactly(requiredFields))
|
var fieldTypes = new FieldTypes(type);
|
||||||
|
if (!fieldTypes.Exactly(requiredFields1) &&
|
||||||
|
!fieldTypes.Exactly(requiredFields2))
|
||||||
continue;
|
continue;
|
||||||
|
|
||||||
var resolveHandler = DotNetUtils.GetMethod(type, "System.Reflection.Assembly", "(System.Object,System.ResolveEventArgs)");
|
var resolveHandler = DotNetUtils.GetMethod(type, "System.Reflection.Assembly", "(System.Object,System.ResolveEventArgs)");
|
||||||
|
|
BIN
de4dot.code/deobfuscators/Agile_NET/vm/v2/CSVM5.bin
Normal file
BIN
de4dot.code/deobfuscators/Agile_NET/vm/v2/CSVM5.bin
Normal file
Binary file not shown.
|
@ -81,7 +81,7 @@ namespace de4dot.code.deobfuscators.Agile_NET.vm.v2 {
|
||||||
foreach (var type in module.Types) {
|
foreach (var type in module.Types) {
|
||||||
if (!type.IsPublic || !type.IsAbstract)
|
if (!type.IsPublic || !type.IsAbstract)
|
||||||
continue;
|
continue;
|
||||||
if (type.HasFields || type.HasProperties || type.HasEvents)
|
if (type.HasProperties || type.HasEvents)
|
||||||
continue;
|
continue;
|
||||||
if (type.BaseType == null || type.BaseType.FullName != "System.Object")
|
if (type.BaseType == null || type.BaseType.FullName != "System.Object")
|
||||||
continue;
|
continue;
|
||||||
|
|
|
@ -1,7 +1,7 @@
|
||||||
//------------------------------------------------------------------------------
|
//------------------------------------------------------------------------------
|
||||||
// <auto-generated>
|
// <auto-generated>
|
||||||
// This code was generated by a tool.
|
// This code was generated by a tool.
|
||||||
// Runtime Version:4.0.30319.18052
|
// Runtime Version:4.0.30319.18444
|
||||||
//
|
//
|
||||||
// Changes to this file may cause incorrect behavior and will be lost if
|
// Changes to this file may cause incorrect behavior and will be lost if
|
||||||
// the code is regenerated.
|
// the code is regenerated.
|
||||||
|
@ -99,5 +99,15 @@ namespace de4dot.code.deobfuscators.Agile_NET.vm.v2 {
|
||||||
return ((byte[])(obj));
|
return ((byte[])(obj));
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
/// <summary>
|
||||||
|
/// Looks up a localized resource of type System.Byte[].
|
||||||
|
/// </summary>
|
||||||
|
internal static byte[] CSVM5 {
|
||||||
|
get {
|
||||||
|
object obj = ResourceManager.GetObject("CSVM5", resourceCulture);
|
||||||
|
return ((byte[])(obj));
|
||||||
|
}
|
||||||
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
|
@ -130,4 +130,8 @@
|
||||||
<data name="CSVM4" type="System.Resources.ResXFileRef, System.Windows.Forms">
|
<data name="CSVM4" type="System.Resources.ResXFileRef, System.Windows.Forms">
|
||||||
<value>CSVM4.bin;System.Byte[], mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
|
<value>CSVM4.bin;System.Byte[], mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
|
||||||
</data>
|
</data>
|
||||||
|
<assembly alias="System.Windows.Forms" name="System.Windows.Forms, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />
|
||||||
|
<data name="CSVM5" type="System.Resources.ResXFileRef, System.Windows.Forms">
|
||||||
|
<value>CSVM5.bin;System.Byte[], mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
|
||||||
|
</data>
|
||||||
</root>
|
</root>
|
|
@ -75,6 +75,7 @@ namespace de4dot.code.deobfuscators.Agile_NET.vm.v2 {
|
||||||
ReadOpCodeHandlerInfos(CsvmResources.CSVM2),
|
ReadOpCodeHandlerInfos(CsvmResources.CSVM2),
|
||||||
ReadOpCodeHandlerInfos(CsvmResources.CSVM3),
|
ReadOpCodeHandlerInfos(CsvmResources.CSVM3),
|
||||||
ReadOpCodeHandlerInfos(CsvmResources.CSVM4),
|
ReadOpCodeHandlerInfos(CsvmResources.CSVM4),
|
||||||
|
ReadOpCodeHandlerInfos(CsvmResources.CSVM5),
|
||||||
};
|
};
|
||||||
|
|
||||||
static IList<MethodSigInfo> ReadOpCodeHandlerInfos(byte[] data) {
|
static IList<MethodSigInfo> ReadOpCodeHandlerInfos(byte[] data) {
|
||||||
|
|
|
@ -254,7 +254,8 @@ namespace de4dot.code.deobfuscators.Agile_NET.vm.v2 {
|
||||||
if (cctor == null)
|
if (cctor == null)
|
||||||
continue;
|
continue;
|
||||||
requiredFields[0] = type.FullName;
|
requiredFields[0] = type.FullName;
|
||||||
if (!new FieldTypes(type).Exactly(requiredFields))
|
var fieldTypes = new FieldTypes(type);
|
||||||
|
if (!fieldTypes.All(requiredFields))
|
||||||
continue;
|
continue;
|
||||||
|
|
||||||
cflowDeobfuscator.Deobfuscate(cctor);
|
cflowDeobfuscator.Deobfuscate(cctor);
|
||||||
|
|
|
@ -596,6 +596,9 @@ namespace de4dot.mdecrypt {
|
||||||
new PatchInfo(0x000110A5, new byte[] { 0x33, 0xC0, 0xC2, 0x04, 0x00 }, new byte[] { 0xE9, 0x36, 0x3A, 0x00, 0x00 }),
|
new PatchInfo(0x000110A5, new byte[] { 0x33, 0xC0, 0xC2, 0x04, 0x00 }, new byte[] { 0xE9, 0x36, 0x3A, 0x00, 0x00 }),
|
||||||
new PatchInfo(0x000110AF, new byte[] { 0x33, 0xC0, 0xC2, 0x04, 0x00 }, new byte[] { 0xE9, 0x4C, 0x3C, 0x00, 0x00 }),
|
new PatchInfo(0x000110AF, new byte[] { 0x33, 0xC0, 0xC2, 0x04, 0x00 }, new byte[] { 0xE9, 0x4C, 0x3C, 0x00, 0x00 }),
|
||||||
new PatchInfo(0x000110AA, new byte[] { 0x33, 0xC0, 0xC2, 0x04, 0x00 }, new byte[] { 0xE9, 0xF1, 0x3A, 0x00, 0x00 }),
|
new PatchInfo(0x000110AA, new byte[] { 0x33, 0xC0, 0xC2, 0x04, 0x00 }, new byte[] { 0xE9, 0xF1, 0x3A, 0x00, 0x00 }),
|
||||||
|
new PatchInfo(0x00011019, new byte[] { 0x33, 0xC0, 0xC2, 0x04, 0x00 }, new byte[] { 0xE9, 0x12, 0x4B, 0x00, 0x00 }),
|
||||||
|
new PatchInfo(0x00011019, new byte[] { 0x33, 0xC0, 0xC2, 0x04, 0x00 }, new byte[] { 0xE9, 0x02, 0x4B, 0x00, 0x00 }),
|
||||||
|
new PatchInfo(0x00011019, new byte[] { 0x33, 0xC0, 0xC2, 0x04, 0x00 }, new byte[] { 0xE9, 0xA2, 0x4B, 0x00, 0x00 }),
|
||||||
};
|
};
|
||||||
|
|
||||||
static unsafe bool PatchCM(IntPtr addr, IntPtr origValue, IntPtr newValue) {
|
static unsafe bool PatchCM(IntPtr addr, IntPtr origValue, IntPtr newValue) {
|
||||||
|
|
Loading…
Reference in New Issue
Block a user