monocul.us/de4dot-cex
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Update detection of offset field

Browse Source
This commit is contained in:
de4dot 2012-01-08 19:08:23 +01:00
parent 0398666c93
commit 2f1ec392b9
1 changed files with 8 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
de4dot.code/deobfuscators/SmartAssembly/StringDecrypterInfo.cs
View File

@ -217,10 +217,15 @@ namespace de4dot.code.deobfuscators.SmartAssembly {
// Find the string decrypter string offset value or null if none found // Find the string decrypter string offset value or null if none found
int? findOffsetValue(MethodDefinition method) { int? findOffsetValue(MethodDefinition method) {
var fieldDict = new FieldDefinitionAndDeclaringTypeDict<FieldReference>();
foreach (var field in method.DeclaringType.Fields)
fieldDict.add(field, field);
var offsetField = findOffsetField(method); var offsetField = findOffsetField(method);
if (offsetField == null) if (offsetField == null)
return null; return null;
return findOffsetValue(method, offsetField);
return findOffsetValue(method, (FieldDefinition)fieldDict.find(offsetField), fieldDict);
} }
FieldReference findOffsetField(MethodDefinition method) { FieldReference findOffsetField(MethodDefinition method) {
@ -248,7 +253,7 @@ namespace de4dot.code.deobfuscators.SmartAssembly {
return null; return null;
} }
int? findOffsetValue(MethodDefinition method, FieldReference offsetField) { int? findOffsetValue(MethodDefinition method, FieldDefinition offsetField, FieldDefinitionAndDeclaringTypeDict<FieldReference> fields) {
var instructions = method.Body.Instructions; var instructions = method.Body.Instructions;
for (int i = 0; i <= instructions.Count - 2; i++) { for (int i = 0; i <= instructions.Count - 2; i++) {
var ldstr = instructions[i]; var ldstr = instructions[i];
@ -262,7 +267,7 @@ namespace de4dot.code.deobfuscators.SmartAssembly {
if (stsfld.OpCode.Code != Code.Stsfld) if (stsfld.OpCode.Code != Code.Stsfld)
continue; continue;
var field = stsfld.Operand as FieldReference; var field = stsfld.Operand as FieldReference;
if (field == null || !MemberReferenceHelper.compareFieldReference(offsetField, field)) if (field == null || fields.find(field) != offsetField)
continue; continue;
int value; int value;