From 3311e28a87e3bcc5103950ec04f792555b9994e5 Mon Sep 17 00:00:00 2001
From: de4dot <de4dot@gmail.com>
Date: Wed, 30 Nov 2011 20:19:50 +0100
Subject: [PATCH] Don't re-read native file after unpacking it

---
 de4dot.code/deobfuscators/DeobfuscatorBase.cs            | 7 +++++++
 de4dot.code/deobfuscators/dotNET_Reactor/Deobfuscator.cs | 9 +++++++--
 2 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/de4dot.code/deobfuscators/DeobfuscatorBase.cs b/de4dot.code/deobfuscators/DeobfuscatorBase.cs
index 38d40d6c..6095d276 100644
--- a/de4dot.code/deobfuscators/DeobfuscatorBase.cs
+++ b/de4dot.code/deobfuscators/DeobfuscatorBase.cs
@@ -49,6 +49,12 @@ namespace de4dot.deobfuscators {
 		IList<RemoveInfo<ModuleReference>> modrefsToRemove = new List<RemoveInfo<ModuleReference>>();
 		List<string> namesToPossiblyRemove = new List<string>();
 		MethodCallRemover methodCallRemover = new MethodCallRemover();
+		byte[] moduleBytes;
+
+		protected byte[] ModuleBytes {
+			get { return moduleBytes; }
+			set { moduleBytes = value; }
+		}
 
 		internal class OptionsBase : IDeobfuscatorOptions {
 			public bool RenameResourcesInCode { get; set; }
@@ -121,6 +127,7 @@ namespace de4dot.deobfuscators {
 		}
 
 		public virtual void deobfuscateBegin() {
+			ModuleBytes = null;
 		}
 
 		public virtual void deobfuscateMethodBegin(Blocks blocks) {
diff --git a/de4dot.code/deobfuscators/dotNET_Reactor/Deobfuscator.cs b/de4dot.code/deobfuscators/dotNET_Reactor/Deobfuscator.cs
index 92460975..f1a16c72 100644
--- a/de4dot.code/deobfuscators/dotNET_Reactor/Deobfuscator.cs
+++ b/de4dot.code/deobfuscators/dotNET_Reactor/Deobfuscator.cs
@@ -157,8 +157,13 @@ namespace de4dot.deobfuscators.dotNET_Reactor {
 		}
 
 		public override byte[] unpackNativeFile(PeImage peImage) {
+			var data = new NativeImageUnpacker(peImage).unpack();
+			if (data == null)
+				return null;
+
 			unpackedNativeFile = true;
-			return new NativeImageUnpacker(peImage).unpack();
+			ModuleBytes = data;
+			return data;
 		}
 
 		public override void init(ModuleDefinition module) {
@@ -374,7 +379,7 @@ namespace de4dot.deobfuscators.dotNET_Reactor {
 		}
 
 		public override bool getDecryptedModule(ref byte[] newFileData, ref Dictionary<uint, DumpedMethod> dumpedMethods) {
-			fileData = DeobUtils.readModule(module);
+			fileData = ModuleBytes ?? DeobUtils.readModule(module);
 			peImage = new PeImage(fileData);
 
 			if (!options.DecryptMethods)