diff --git a/de4dot.code/deobfuscators/Babel_NET/ImageReader.cs b/de4dot.code/deobfuscators/Babel_NET/ImageReader.cs index 7ab6bcd0..a81f2f66 100644 --- a/de4dot.code/deobfuscators/Babel_NET/ImageReader.cs +++ b/de4dot.code/deobfuscators/Babel_NET/ImageReader.cs @@ -470,15 +470,7 @@ namespace de4dot.code.deobfuscators.Babel_NET { } public int readVariableLengthInt32() { - byte b = reader.ReadByte(); - if ((b & 0x80) == 0) - return b; - if ((b & 0x40) == 0) - return (((int)b & 0x3F) << 8) + reader.ReadByte(); - return (((int)b & 0x3F) << 24) + - ((int)reader.ReadByte() << 16) + - ((int)reader.ReadByte() << 8) + - reader.ReadByte(); + return DeobUtils.readVariableLengthInt32(reader); } int getMetadataOffset() { diff --git a/de4dot.code/deobfuscators/CryptoObfuscator/StringDecrypter.cs b/de4dot.code/deobfuscators/CryptoObfuscator/StringDecrypter.cs index 599f076c..ceb79bff 100644 --- a/de4dot.code/deobfuscators/CryptoObfuscator/StringDecrypter.cs +++ b/de4dot.code/deobfuscators/CryptoObfuscator/StringDecrypter.cs @@ -92,19 +92,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator { } public string decrypt(int index) { - int len; - byte b = decryptedData[index++]; - if ((b & 0x80) == 0) - len = b; - else if ((b & 0x40) == 0) - len = ((b & 0x3F) << 8) + decryptedData[index++]; - else { - len = ((b & 0x3F) << 24) + - ((int)decryptedData[index++] << 16) + - ((int)decryptedData[index++] << 8) + - decryptedData[index++]; - } - + int len = DeobUtils.readVariableLengthInt32(decryptedData, ref index); return Encoding.Unicode.GetString(decryptedData, index, len); } diff --git a/de4dot.code/deobfuscators/DeobUtils.cs b/de4dot.code/deobfuscators/DeobUtils.cs index 4332f8a7..45d52c5a 100644 --- a/de4dot.code/deobfuscators/DeobUtils.cs +++ b/de4dot.code/deobfuscators/DeobUtils.cs @@ -163,6 +163,18 @@ namespace de4dot.code.deobfuscators { reader.ReadByte(); } + public static int readVariableLengthInt32(byte[] data, ref int index) { + byte b = data[index++]; + if ((b & 0x80) == 0) + return b; + if ((b & 0x40) == 0) + return (((int)b & 0x3F) << 8) + data[index++]; + return (((int)b & 0x3F) << 24) + + ((int)data[index++] << 16) + + ((int)data[index++] << 8) + + data[index++]; + } + public static bool hasInteger(MethodDefinition method, uint value) { return hasInteger(method, (int)value); } diff --git a/de4dot.code/deobfuscators/SmartAssembly/StringDecrypter.cs b/de4dot.code/deobfuscators/SmartAssembly/StringDecrypter.cs index 4d9dfe17..531817e2 100644 --- a/de4dot.code/deobfuscators/SmartAssembly/StringDecrypter.cs +++ b/de4dot.code/deobfuscators/SmartAssembly/StringDecrypter.cs @@ -54,19 +54,7 @@ namespace de4dot.code.deobfuscators.SmartAssembly { throw new ApplicationException("Can't decrypt strings since decryptedData is null"); int index = id - (token & 0x00FFFFFF) - stringOffset; - - int len; - byte b = decryptedData[index++]; - if ((b & 0x80) == 0) - len = b; - else if ((b & 0x40) == 0) - len = ((b & 0x3F) << 8) + decryptedData[index++]; - else { - len = ((b & 0x1F) << 24) + - ((int)decryptedData[index++] << 16) + - ((int)decryptedData[index++] << 8) + - decryptedData[index++]; - } + int len = DeobUtils.readVariableLengthInt32(decryptedData, ref index); switch (StringDecrypterInfo.DecrypterVersion) { case StringDecrypterVersion.V1: