From 2e61a8a757013c86de7686268001320b9fae39c4 Mon Sep 17 00:00:00 2001 From: de4dot Date: Sun, 18 Nov 2012 07:32:57 +0100 Subject: [PATCH] Move disposing of module to caller The reason is that some deobfuscators require it to be non-disposed when their reload() method is called. --- de4dot.code/AssemblyModule.cs | 2 -- de4dot.code/ObfuscatedFile.cs | 16 ++++++++++++++-- 2 files changed, 14 insertions(+), 4 deletions(-) diff --git a/de4dot.code/AssemblyModule.cs b/de4dot.code/AssemblyModule.cs index 36e9c0ed..527d6443 100644 --- a/de4dot.code/AssemblyModule.cs +++ b/de4dot.code/AssemblyModule.cs @@ -44,8 +44,6 @@ namespace de4dot.code { } ModuleDefMD setModule(ModuleDefMD newModule) { - if (module != null) - module.Dispose(); module = newModule; TheAssemblyResolver.Instance.addModule(module); module.EnableTypeDefFindCache = true; diff --git a/de4dot.code/ObfuscatedFile.cs b/de4dot.code/ObfuscatedFile.cs index 4def00b3..743101b8 100644 --- a/de4dot.code/ObfuscatedFile.cs +++ b/de4dot.code/ObfuscatedFile.cs @@ -171,6 +171,7 @@ namespace de4dot.code { } void loadModule(IEnumerable deobfuscators) { + ModuleDefMD oldModule = module; try { module = assemblyModule.load(); } @@ -179,6 +180,10 @@ namespace de4dot.code { throw new BadImageFormatException(); Logger.v("Unpacked native file"); } + finally { + if (oldModule != null) + oldModule.Dispose(); + } } bool unpackNativeImage(IEnumerable deobfuscators) { @@ -194,6 +199,7 @@ namespace de4dot.code { if (unpackedData == null) continue; + var oldModule = module; try { module = assemblyModule.load(unpackedData); } @@ -201,6 +207,10 @@ namespace de4dot.code { Logger.w("Could not load unpacked data. File: {0}, deobfuscator: {0}", peImage.FileName ?? "(unknown filename)", deob.TypeLong); continue; } + finally { + if (oldModule != null) + oldModule.Dispose(); + } this.deob = deob; return true; } @@ -372,8 +382,10 @@ namespace de4dot.code { void reloadModule(byte[] newModuleData, DumpedMethods dumpedMethods) { Logger.v("Reloading decrypted assembly (original filename: {0})", Filename); simpleDeobfuscatorFlags.Clear(); - module = assemblyModule.reload(newModuleData, createDumpedMethodsRestorer(dumpedMethods), deob as IStringDecrypter); - deob = deob.moduleReloaded(module); + using (var oldModule = module) { + module = assemblyModule.reload(newModuleData, createDumpedMethodsRestorer(dumpedMethods), deob as IStringDecrypter); + deob = deob.moduleReloaded(module); + } initializeDeobfuscator(); deob.DeobfuscatedFile = this; updateDynamicStringInliner();