monocul.us/de4dot-cex
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Move reading variable length int32 code to DeobUtils

Browse Source
This commit is contained in:
de4dot 2012-02-12 16:54:48 +01:00
parent 67efd5e7e7
commit 3e3be639e5
4 changed files with 15 additions and 35 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
de4dot.code/deobfuscators/Babel_NET/ImageReader.cs
View File

@ -470,15 +470,7 @@ namespace de4dot.code.deobfuscators.Babel_NET {
} }
public int readVariableLengthInt32() { public int readVariableLengthInt32() {
byte b = reader.ReadByte(); return DeobUtils.readVariableLengthInt32(reader);
if ((b & 0x80) == 0)
return b;
if ((b & 0x40) == 0)
return (((int)b & 0x3F) << 8) + reader.ReadByte();
return (((int)b & 0x3F) << 24) +
((int)reader.ReadByte() << 16) +
((int)reader.ReadByte() << 8) +
reader.ReadByte();
} }
int getMetadataOffset() { int getMetadataOffset() {

14
de4dot.code/deobfuscators/CryptoObfuscator/StringDecrypter.cs
View File

@ -92,19 +92,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
} }
public string decrypt(int index) { public string decrypt(int index) {
int len; int len = DeobUtils.readVariableLengthInt32(decryptedData, ref index);
byte b = decryptedData[index++];
if ((b & 0x80) == 0)
len = b;
else if ((b & 0x40) == 0)
len = ((b & 0x3F) << 8) + decryptedData[index++];
else {
len = ((b & 0x3F) << 24) +
((int)decryptedData[index++] << 16) +
((int)decryptedData[index++] << 8) +
decryptedData[index++];
}
return Encoding.Unicode.GetString(decryptedData, index, len); return Encoding.Unicode.GetString(decryptedData, index, len);
} }

12
de4dot.code/deobfuscators/DeobUtils.cs
View File

@ -163,6 +163,18 @@ namespace de4dot.code.deobfuscators {
reader.ReadByte(); reader.ReadByte();
} }
public static int readVariableLengthInt32(byte[] data, ref int index) {
byte b = data[index++];
if ((b & 0x80) == 0)
return b;
if ((b & 0x40) == 0)
return (((int)b & 0x3F) << 8) + data[index++];
return (((int)b & 0x3F) << 24) +
((int)data[index++] << 16) +
((int)data[index++] << 8) +
data[index++];
}
public static bool hasInteger(MethodDefinition method, uint value) { public static bool hasInteger(MethodDefinition method, uint value) {
return hasInteger(method, (int)value); return hasInteger(method, (int)value);
} }

14
de4dot.code/deobfuscators/SmartAssembly/StringDecrypter.cs
View File

@ -54,19 +54,7 @@ namespace de4dot.code.deobfuscators.SmartAssembly {
throw new ApplicationException("Can't decrypt strings since decryptedData is null"); throw new ApplicationException("Can't decrypt strings since decryptedData is null");
int index = id - (token & 0x00FFFFFF) - stringOffset; int index = id - (token & 0x00FFFFFF) - stringOffset;
int len = DeobUtils.readVariableLengthInt32(decryptedData, ref index);
int len;
byte b = decryptedData[index++];
if ((b & 0x80) == 0)
len = b;
else if ((b & 0x40) == 0)
len = ((b & 0x3F) << 8) + decryptedData[index++];
else {
len = ((b & 0x1F) << 24) +
((int)decryptedData[index++] << 16) +
((int)decryptedData[index++] << 8) +
decryptedData[index++];
}
switch (StringDecrypterInfo.DecrypterVersion) { switch (StringDecrypterInfo.DecrypterVersion) {
case StringDecrypterVersion.V1: case StringDecrypterVersion.V1: