Support Confuser 1.7 r73404 constants encrypter
This commit is contained in:
parent
7a77421c0e
commit
343ed177bb
|
@ -40,6 +40,7 @@ namespace de4dot.code.deobfuscators.Confuser {
|
||||||
Unknown,
|
Unknown,
|
||||||
v15_r60785_normal,
|
v15_r60785_normal,
|
||||||
v15_r60785_dynamic,
|
v15_r60785_dynamic,
|
||||||
|
v17_r73404_normal,
|
||||||
}
|
}
|
||||||
|
|
||||||
public MethodDefinition Method {
|
public MethodDefinition Method {
|
||||||
|
@ -81,6 +82,10 @@ namespace de4dot.code.deobfuscators.Confuser {
|
||||||
continue;
|
continue;
|
||||||
if (localTypes.exists("System.Collections.BitArray")) // or System.Random
|
if (localTypes.exists("System.Collections.BitArray")) // or System.Random
|
||||||
version = ConfuserVersion.v15_r60785_normal;
|
version = ConfuserVersion.v15_r60785_normal;
|
||||||
|
else if (DeobUtils.hasInteger(method, 0x100) &&
|
||||||
|
DeobUtils.hasInteger(method, 0x10000) &&
|
||||||
|
DeobUtils.hasInteger(method, 0xFFFF))
|
||||||
|
version = ConfuserVersion.v17_r73404_normal;
|
||||||
else
|
else
|
||||||
version = ConfuserVersion.v15_r60785_dynamic;
|
version = ConfuserVersion.v15_r60785_dynamic;
|
||||||
|
|
||||||
|
@ -320,6 +325,7 @@ namespace de4dot.code.deobfuscators.Confuser {
|
||||||
switch (version) {
|
switch (version) {
|
||||||
case ConfuserVersion.v15_r60785_normal: return decryptConstant_v15_r60785_normal(encrypted, offs);
|
case ConfuserVersion.v15_r60785_normal: return decryptConstant_v15_r60785_normal(encrypted, offs);
|
||||||
case ConfuserVersion.v15_r60785_dynamic: return decryptConstant_v15_r60785_dynamic(encrypted, offs);
|
case ConfuserVersion.v15_r60785_dynamic: return decryptConstant_v15_r60785_dynamic(encrypted, offs);
|
||||||
|
case ConfuserVersion.v17_r73404_normal: return decryptConstant_v17_r73404_normal(encrypted, offs);
|
||||||
default: throw new ApplicationException("Invalid version");
|
default: throw new ApplicationException("Invalid version");
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
@ -375,6 +381,10 @@ namespace de4dot.code.deobfuscators.Confuser {
|
||||||
return -1;
|
return -1;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
byte[] decryptConstant_v17_r73404_normal(byte[] encrypted, uint offs) {
|
||||||
|
return ConfuserUtils.decrypt(key0 ^ offs, encrypted);
|
||||||
|
}
|
||||||
|
|
||||||
uint calcHash(uint x) {
|
uint calcHash(uint x) {
|
||||||
uint h0 = key1 ^ x;
|
uint h0 = key1 ^ x;
|
||||||
uint h1 = key2;
|
uint h1 = key2;
|
||||||
|
|
Loading…
Reference in New Issue
Block a user