Detect Confuser 1.1 r50378 proxy methods creator
This commit is contained in:
parent
be29d8aed2
commit
35ddd30e08
|
@ -41,6 +41,7 @@ namespace de4dot.code.deobfuscators.Confuser {
|
||||||
v10_r42915,
|
v10_r42915,
|
||||||
v10_r42919,
|
v10_r42919,
|
||||||
v10_r48717,
|
v10_r48717,
|
||||||
|
v11_r50378,
|
||||||
v14_r58564,
|
v14_r58564,
|
||||||
v14_r58857,
|
v14_r58857,
|
||||||
v17_r73740_normal,
|
v17_r73740_normal,
|
||||||
|
@ -197,6 +198,7 @@ namespace de4dot.code.deobfuscators.Confuser {
|
||||||
break;
|
break;
|
||||||
|
|
||||||
case ConfuserVersion.v10_r48717:
|
case ConfuserVersion.v10_r48717:
|
||||||
|
case ConfuserVersion.v11_r50378:
|
||||||
case ConfuserVersion.v14_r58564:
|
case ConfuserVersion.v14_r58564:
|
||||||
getCallInfo_v10_r48717(info, creatorInfo, out calledMethod, out callOpcode);
|
getCallInfo_v10_r48717(info, creatorInfo, out calledMethod, out callOpcode);
|
||||||
break;
|
break;
|
||||||
|
@ -510,6 +512,8 @@ namespace de4dot.code.deobfuscators.Confuser {
|
||||||
theVersion = ConfuserVersion.v19_r76101_normal;
|
theVersion = ConfuserVersion.v19_r76101_normal;
|
||||||
else if ((nativeMethod = findNativeMethod_v19_r76101(method)) != null)
|
else if ((nativeMethod = findNativeMethod_v19_r76101(method)) != null)
|
||||||
theVersion = ConfuserVersion.v19_r76101_native;
|
theVersion = ConfuserVersion.v19_r76101_native;
|
||||||
|
else if (proxyType == ProxyCreatorType.CallOrCallvirt && !DotNetUtils.callsMethod(method, "System.Int32 System.String::get_Length()"))
|
||||||
|
theVersion = ConfuserVersion.v11_r50378;
|
||||||
}
|
}
|
||||||
else if (is_v17_r73740(method)) {
|
else if (is_v17_r73740(method)) {
|
||||||
if (DotNetUtils.callsMethod(method, "System.Boolean System.Type::get_IsArray()")) {
|
if (DotNetUtils.callsMethod(method, "System.Boolean System.Type::get_IsArray()")) {
|
||||||
|
@ -971,6 +975,11 @@ namespace de4dot.code.deobfuscators.Confuser {
|
||||||
|
|
||||||
case ConfuserVersion.v10_r48717:
|
case ConfuserVersion.v10_r48717:
|
||||||
minRev = 48717;
|
minRev = 48717;
|
||||||
|
maxRev = 50359;
|
||||||
|
return true;
|
||||||
|
|
||||||
|
case ConfuserVersion.v11_r50378:
|
||||||
|
minRev = 50378;
|
||||||
maxRev = 58446;
|
maxRev = 58446;
|
||||||
return true;
|
return true;
|
||||||
|
|
||||||
|
|
Loading…
Reference in New Issue
Block a user