diff --git a/de4dot.code/deobfuscators/Spices_Net/Deobfuscator.cs b/de4dot.code/deobfuscators/Spices_Net/Deobfuscator.cs index 3d22a805..a267476b 100644 --- a/de4dot.code/deobfuscators/Spices_Net/Deobfuscator.cs +++ b/de4dot.code/deobfuscators/Spices_Net/Deobfuscator.cs @@ -165,6 +165,7 @@ namespace de4dot.code.deobfuscators.Spices_Net { if (Operations.DecryptStrings != OpDecryptString.None) { addTypeToBeRemoved(stringDecrypter.Type, "String decrypter type"); + addTypeToBeRemoved(stringDecrypter.EncryptedStringsType, "Encrypted strings field type"); stringDecrypter.cleanUp(); } diff --git a/de4dot.code/deobfuscators/Spices_Net/StringDecrypter.cs b/de4dot.code/deobfuscators/Spices_Net/StringDecrypter.cs index 95d63724..499c2d56 100644 --- a/de4dot.code/deobfuscators/Spices_Net/StringDecrypter.cs +++ b/de4dot.code/deobfuscators/Spices_Net/StringDecrypter.cs @@ -56,6 +56,22 @@ namespace de4dot.code.deobfuscators.Spices_Net { } } + public TypeDefinition EncryptedStringsType { + get { + if (encryptedDataField == null) + return null; + var type = encryptedDataField.FieldType as TypeDefinition; + if (type == null || type.Fields.Count != 1 || type.Fields[0] != encryptedDataField) + return null; + if (type.HasMethods || type.HasEvents || type.HasProperties || type.HasNestedTypes) + return null; + if (type.Interfaces.Count > 0) + return null; + + return type; + } + } + public TypeDefinition Type { get { return decrypterType; } }