monocul.us/de4dot-cex
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Don't re-read native file after unpacking it

Browse Source
This commit is contained in:
de4dot 2011-11-30 20:19:50 +01:00
parent 68d962fb6e
commit 3311e28a87
2 changed files with 14 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
de4dot.code/deobfuscators/DeobfuscatorBase.cs
View File

@ -49,6 +49,12 @@ namespace de4dot.deobfuscators {
IList<RemoveInfo<ModuleReference>> modrefsToRemove = new List<RemoveInfo<ModuleReference>>(); IList<RemoveInfo<ModuleReference>> modrefsToRemove = new List<RemoveInfo<ModuleReference>>();
List<string> namesToPossiblyRemove = new List<string>(); List<string> namesToPossiblyRemove = new List<string>();
MethodCallRemover methodCallRemover = new MethodCallRemover(); MethodCallRemover methodCallRemover = new MethodCallRemover();
byte[] moduleBytes;
protected byte[] ModuleBytes {
get { return moduleBytes; }
set { moduleBytes = value; }
}
internal class OptionsBase : IDeobfuscatorOptions { internal class OptionsBase : IDeobfuscatorOptions {
public bool RenameResourcesInCode { get; set; } public bool RenameResourcesInCode { get; set; }
@ -121,6 +127,7 @@ namespace de4dot.deobfuscators {
} }
public virtual void deobfuscateBegin() { public virtual void deobfuscateBegin() {
ModuleBytes = null;
} }
public virtual void deobfuscateMethodBegin(Blocks blocks) { public virtual void deobfuscateMethodBegin(Blocks blocks) {

9
de4dot.code/deobfuscators/dotNET_Reactor/Deobfuscator.cs
View File

@ -157,8 +157,13 @@ namespace de4dot.deobfuscators.dotNET_Reactor {
} }
public override byte[] unpackNativeFile(PeImage peImage) { public override byte[] unpackNativeFile(PeImage peImage) {
var data = new NativeImageUnpacker(peImage).unpack();
if (data == null)
return null;
unpackedNativeFile = true; unpackedNativeFile = true;
return new NativeImageUnpacker(peImage).unpack(); ModuleBytes = data;
return data;
} }
public override void init(ModuleDefinition module) { public override void init(ModuleDefinition module) {
@ -374,7 +379,7 @@ namespace de4dot.deobfuscators.dotNET_Reactor {
} }
public override bool getDecryptedModule(ref byte[] newFileData, ref Dictionary<uint, DumpedMethod> dumpedMethods) { public override bool getDecryptedModule(ref byte[] newFileData, ref Dictionary<uint, DumpedMethod> dumpedMethods) {
fileData = DeobUtils.readModule(module); fileData = ModuleBytes ?? DeobUtils.readModule(module);
peImage = new PeImage(fileData); peImage = new PeImage(fileData);
if (!options.DecryptMethods) if (!options.DecryptMethods)