diff --git a/de4dot.code/deobfuscators/CodeWall/Deobfuscator.cs b/de4dot.code/deobfuscators/CodeWall/Deobfuscator.cs index 0c99c8dc..43499342 100644 --- a/de4dot.code/deobfuscators/CodeWall/Deobfuscator.cs +++ b/de4dot.code/deobfuscators/CodeWall/Deobfuscator.cs @@ -93,6 +93,12 @@ namespace de4dot.code.deobfuscators.CodeWall { if (sum > 0) val += 100 + 10 * (sum - 1); + // If methods are encrypted, and more than one obfuscator has been used, then CW + // was most likely the last obfuscator used. Increment val so the user doesn't have + // to force CW. + if (methodsDecrypter.Detected) + val += 50; + return val; }