monocul.us/de4dot-cex
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Use field dict and update code

Browse Source
This commit is contained in:
de4dot 2011-12-28 13:33:10 +01:00
parent 8de51ca227
commit 3e70d1fa63
1 changed files with 11 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
de4dot.code/deobfuscators/ProxyDelegateFinderBase.cs
View File

@ -27,8 +27,8 @@ namespace de4dot.code.deobfuscators {
abstract class ProxyDelegateFinderBase {
protected ModuleDefinition module;
protected List<MethodDefinition> delegateCreatorMethods = new List<MethodDefinition>();
Dictionary<TypeDefinition, bool> delegateTypesDict = new Dictionary<TypeDefinition, bool>();
Dictionary<FieldReferenceAndDeclaringTypeKey, DelegateInfo> fieldToDelegateInfo = new Dictionary<FieldReferenceAndDeclaringTypeKey, DelegateInfo>();
protected Dictionary<TypeDefinition, bool> delegateTypesDict = new Dictionary<TypeDefinition, bool>();
FieldDefinitionAndDeclaringTypeDict<DelegateInfo> fieldToDelegateInfo = new FieldDefinitionAndDeclaringTypeDict<DelegateInfo>();
Dictionary<MethodDefinition, FieldDefinition> proxyMethodToField = new Dictionary<MethodDefinition, FieldDefinition>();
int errors = 0;
@ -36,7 +36,7 @@ namespace de4dot.code.deobfuscators {
get { return errors; }
}
class DelegateInfo {
protected class DelegateInfo {
public MethodReference methodRef; // Method we should call
public FieldDefinition field; // Field holding the Delegate instance
public OpCode callOpcode;
@ -115,7 +115,7 @@ namespace de4dot.code.deobfuscators {
if (calledMethod == null)
throw new ApplicationException("calledMethod is null");
fieldToDelegateInfo[new FieldReferenceAndDeclaringTypeKey(field)] = new DelegateInfo(field, calledMethod, callOpcode);
addDelegateInfo(new DelegateInfo(field, calledMethod, callOpcode));
Log.v("Field: {0}, Opcode: {1}, Method: {2} ({3:X8})", field.Name, callOpcode, calledMethod, calledMethod.MetadataToken.ToUInt32());
}
Log.deIndent();
@ -123,6 +123,10 @@ namespace de4dot.code.deobfuscators {
}
}
protected void addDelegateInfo(DelegateInfo di) {
fieldToDelegateInfo.add(di.field, di);
}
protected virtual void onFoundProxyDelegate(TypeDefinition type) {
}
@ -148,10 +152,7 @@ namespace de4dot.code.deobfuscators {
DelegateInfo getDelegateInfo(FieldReference field) {
if (field == null)
return null;
DelegateInfo di;
if (fieldToDelegateInfo.TryGetValue(new FieldReferenceAndDeclaringTypeKey(field), out di))
return di;
return null;
return fieldToDelegateInfo.find(field);
}
class BlockInstr {
@ -168,6 +169,8 @@ namespace de4dot.code.deobfuscators {
}
public void deobfuscate(Blocks blocks) {
if (blocks.Method.DeclaringType != null && delegateTypesDict.ContainsKey(blocks.Method.DeclaringType))
return;
var removeInfos = new Dictionary<Block, List<RemoveInfo>>();
var allBlocks = blocks.MethodBlocks.getAllBlocks();