monocul.us/de4dot-cex
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Support Confuser 1.7 r73404 constants encrypter

Browse Source
This commit is contained in:
de4dot 2012-08-02 19:14:35 +02:00
parent 7a77421c0e
commit 343ed177bb
1 changed files with 10 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
de4dot.code/deobfuscators/Confuser/ConstantsDecrypterV15.cs
View File

@ -40,6 +40,7 @@ namespace de4dot.code.deobfuscators.Confuser {
Unknown,
v15_r60785_normal,
v15_r60785_dynamic,
v17_r73404_normal,
}
public MethodDefinition Method {
@ -81,6 +82,10 @@ namespace de4dot.code.deobfuscators.Confuser {
continue;
if (localTypes.exists("System.Collections.BitArray")) // or System.Random
version = ConfuserVersion.v15_r60785_normal;
else if (DeobUtils.hasInteger(method, 0x100) &&
DeobUtils.hasInteger(method, 0x10000) &&
DeobUtils.hasInteger(method, 0xFFFF))
version = ConfuserVersion.v17_r73404_normal;
else
version = ConfuserVersion.v15_r60785_dynamic;
@ -320,6 +325,7 @@ namespace de4dot.code.deobfuscators.Confuser {
switch (version) {
case ConfuserVersion.v15_r60785_normal: return decryptConstant_v15_r60785_normal(encrypted, offs);
case ConfuserVersion.v15_r60785_dynamic: return decryptConstant_v15_r60785_dynamic(encrypted, offs);
case ConfuserVersion.v17_r73404_normal: return decryptConstant_v17_r73404_normal(encrypted, offs);
default: throw new ApplicationException("Invalid version");
}
}
@ -375,6 +381,10 @@ namespace de4dot.code.deobfuscators.Confuser {
return -1;
}
byte[] decryptConstant_v17_r73404_normal(byte[] encrypted, uint offs) {
return ConfuserUtils.decrypt(key0 ^ offs, encrypted);
}
uint calcHash(uint x) {
uint h0 = key1 ^ x;
uint h1 = key2;