monocul.us/de4dot-cex
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fat header type is encoded in the lower 3 bits

Browse Source
This commit is contained in:
de4dot 2012-08-23 11:48:11 +02:00
parent a34b3f7855
commit 30a73371c8
1 changed files with 6 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
de4dot.code/deobfuscators/MethodBodyParser.cs
View File

@ -71,16 +71,15 @@ namespace de4dot.code.deobfuscators {
var mbHeader = new MethodBodyHeader(); var mbHeader = new MethodBodyHeader();
uint codeOffset; uint codeOffset;
switch (peek(reader) & 3) { byte b = peek(reader);
case 2: if ((b & 3) == 2) {
mbHeader.flags = 2; mbHeader.flags = 2;
mbHeader.maxStack = 8; mbHeader.maxStack = 8;
mbHeader.codeSize = (uint)(reader.ReadByte() >> 2); mbHeader.codeSize = (uint)(reader.ReadByte() >> 2);
mbHeader.localVarSigTok = 0; mbHeader.localVarSigTok = 0;
codeOffset = 1; codeOffset = 1;
break; }
else if ((b & 7) == 3) {
case 3:
mbHeader.flags = reader.ReadUInt16(); mbHeader.flags = reader.ReadUInt16();
codeOffset = (uint)(4 * (mbHeader.flags >> 12)); codeOffset = (uint)(4 * (mbHeader.flags >> 12));
if (codeOffset != 12) if (codeOffset != 12)
@ -92,11 +91,9 @@ namespace de4dot.code.deobfuscators {
mbHeader.localVarSigTok = reader.ReadUInt32(); mbHeader.localVarSigTok = reader.ReadUInt32();
if (mbHeader.localVarSigTok != 0 && (mbHeader.localVarSigTok >> 24) != 0x11) if (mbHeader.localVarSigTok != 0 && (mbHeader.localVarSigTok >> 24) != 0x11)
throw new InvalidMethodBody(); throw new InvalidMethodBody();
break;
default:
throw new InvalidMethodBody();
} }
else
throw new InvalidMethodBody();
if (mbHeader.codeSize + codeOffset > reader.BaseStream.Length) if (mbHeader.codeSize + codeOffset > reader.BaseStream.Length)
throw new InvalidMethodBody(); throw new InvalidMethodBody();