monocul.us/de4dot-cex
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Support old DS 3.0.3.41 - 3.0.4.44

Browse Source
This commit is contained in:
de4dot 2012-03-17 14:05:54 +01:00
parent 48c7d40fb6
commit 37450a1515
2 changed files with 41 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

37
de4dot.code/deobfuscators/DeepSea/AssemblyResolver.cs
View File

@ -27,9 +27,16 @@ using de4dot.blocks;
namespace de4dot.code.deobfuscators.DeepSea { namespace de4dot.code.deobfuscators.DeepSea {
class AssemblyResolver : ResolverBase { class AssemblyResolver : ResolverBase {
bool isV3; Version version;
List<FieldInfo> fieldInfos; List<FieldInfo> fieldInfos;
enum Version {
Unknown,
V3Old,
V3,
V4,
}
public class AssemblyInfo { public class AssemblyInfo {
public byte[] data; public byte[] data;
public string fullName; public string fullName;
@ -70,7 +77,10 @@ namespace de4dot.code.deobfuscators.DeepSea {
protected override bool checkHandlerMethodInternal(MethodDefinition handler) { protected override bool checkHandlerMethodInternal(MethodDefinition handler) {
if (checkHandlerV3(handler) || checkHandlerSL(handler)) { if (checkHandlerV3(handler) || checkHandlerSL(handler)) {
isV3 = true; if (isV3Old(handler))
version = Version.V3Old;
else
version = Version.V3;
return true; return true;
} }
@ -78,7 +88,7 @@ namespace de4dot.code.deobfuscators.DeepSea {
List<FieldInfo> fieldInfosTmp; List<FieldInfo> fieldInfosTmp;
if (checkHandlerV4(handler, out fieldInfosTmp) || if (checkHandlerV4(handler, out fieldInfosTmp) ||
checkHandlerV4_0_4(handler, out fieldInfosTmp)) { checkHandlerV4_0_4(handler, out fieldInfosTmp)) {
isV3 = false; version = Version.V4;
fieldInfos = fieldInfosTmp; fieldInfos = fieldInfosTmp;
return true; return true;
} }
@ -86,6 +96,11 @@ namespace de4dot.code.deobfuscators.DeepSea {
return false; return false;
} }
static bool isV3Old(MethodDefinition method) {
return DotNetUtils.callsMethod(method, "System.Int32 System.IO.Stream::Read(System.Byte[],System.Int32,System.Int32)") &&
!DotNetUtils.callsMethod(method, "System.Int32 System.IO.Stream::ReadByte()");
}
static string[] handlerLocalTypes_NET = new string[] { static string[] handlerLocalTypes_NET = new string[] {
"System.Byte[]", "System.Byte[]",
"System.IO.Compression.DeflateStream", "System.IO.Compression.DeflateStream",
@ -205,9 +220,18 @@ namespace de4dot.code.deobfuscators.DeepSea {
} }
public IEnumerable<AssemblyInfo> getAssemblyInfos() { public IEnumerable<AssemblyInfo> getAssemblyInfos() {
if (isV3) if (!Detected)
return new List<AssemblyInfo>();
switch (version) {
case Version.V3Old:
case Version.V3:
return getAssemblyInfosV3(); return getAssemblyInfosV3();
return getAssemblyInfosV4(); case Version.V4:
return getAssemblyInfosV4();
default:
throw new ApplicationException("Unknown version");
}
} }
IEnumerable<AssemblyInfo> getAssemblyInfosV3() { IEnumerable<AssemblyInfo> getAssemblyInfosV3() {
@ -230,7 +254,8 @@ namespace de4dot.code.deobfuscators.DeepSea {
AssemblyInfo getAssemblyInfoV3(EmbeddedResource resource) { AssemblyInfo getAssemblyInfoV3(EmbeddedResource resource) {
try { try {
return getAssemblyInfo(decryptResourceV3(resource), resource); var decrypted = version == Version.V3Old ? decryptResourceV3Old(resource) : decryptResourceV3(resource);
return getAssemblyInfo(decrypted, resource);
} }
catch (Exception) { catch (Exception) {
return null; return null;

10
de4dot.code/deobfuscators/DeepSea/ResolverBase.cs
View File

@ -130,6 +130,16 @@ namespace de4dot.code.deobfuscators.DeepSea {
protected abstract bool checkHandlerMethodInternal(MethodDefinition handler); protected abstract bool checkHandlerMethodInternal(MethodDefinition handler);
// 3.0.3.41 - 3.0.4.44
protected static byte[] decryptResourceV3Old(EmbeddedResource resource) {
return decryptResourceV3Old(resource.GetResourceData());
}
// 3.0.3.41 - 3.0.4.44
protected static byte[] decryptResourceV3Old(byte[] data) {
return decryptResource(data, 0, data.Length, 0);
}
protected static byte[] decryptResourceV3(EmbeddedResource resource) { protected static byte[] decryptResourceV3(EmbeddedResource resource) {
return decryptResourceV3(resource.GetResourceData()); return decryptResourceV3(resource.GetResourceData());
} }