monocul.us/de4dot-cex
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Detect Confuser 1.1 r50378 proxy methods creator

Browse Source
This commit is contained in:
de4dot 2012-08-10 20:43:11 +02:00
parent be29d8aed2
commit 35ddd30e08
1 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
de4dot.code/deobfuscators/Confuser/ProxyCallFixer.cs
View File

@ -41,6 +41,7 @@ namespace de4dot.code.deobfuscators.Confuser {
v10_r42915,
v10_r42919,
v10_r48717,
v11_r50378,
v14_r58564,
v14_r58857,
v17_r73740_normal,
@ -197,6 +198,7 @@ namespace de4dot.code.deobfuscators.Confuser {
break;
case ConfuserVersion.v10_r48717:
case ConfuserVersion.v11_r50378:
case ConfuserVersion.v14_r58564:
getCallInfo_v10_r48717(info, creatorInfo, out calledMethod, out callOpcode);
break;
@ -510,6 +512,8 @@ namespace de4dot.code.deobfuscators.Confuser {
theVersion = ConfuserVersion.v19_r76101_normal;
else if ((nativeMethod = findNativeMethod_v19_r76101(method)) != null)
theVersion = ConfuserVersion.v19_r76101_native;
else if (proxyType == ProxyCreatorType.CallOrCallvirt && !DotNetUtils.callsMethod(method, "System.Int32 System.String::get_Length()"))
theVersion = ConfuserVersion.v11_r50378;
}
else if (is_v17_r73740(method)) {
if (DotNetUtils.callsMethod(method, "System.Boolean System.Type::get_IsArray()")) {
@ -971,6 +975,11 @@ namespace de4dot.code.deobfuscators.Confuser {
case ConfuserVersion.v10_r48717:
minRev = 48717;
maxRev = 50359;
return true;
case ConfuserVersion.v11_r50378:
minRev = 50378;
maxRev = 58446;
return true;