monocul.us/de4dot-cex
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Port Xenocode deobfuscator

Browse Source
This commit is contained in:
de4dot 2012-11-06 15:53:01 +01:00
parent 054594dbfe
commit 3ed2daebd1
3 changed files with 8 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
de4dot.code/de4dot.code.csproj
View File

@ -261,8 +261,8 @@
<Compile Include="deobfuscators\UnpackedFile.cs" />
<Compile Include="deobfuscators\UnusedMethodsFinder.cs" />
<Compile Include="deobfuscators\ValueInlinerBase.cs" />
<None Include="deobfuscators\Xenocode\Deobfuscator.cs" />
<None Include="deobfuscators\Xenocode\StringDecrypter.cs" />
<Compile Include="deobfuscators\Xenocode\Deobfuscator.cs" />
<Compile Include="deobfuscators\Xenocode\StringDecrypter.cs" />
<Compile Include="IDeobfuscatorContext.cs" />
<Compile Include="IObfuscatedFile.cs" />
<Compile Include="Log.cs" />

10
de4dot.code/deobfuscators/Xenocode/StringDecrypter.cs
View File

@ -24,7 +24,7 @@ using de4dot.blocks;
namespace de4dot.code.deobfuscators.Xenocode {
class StringDecrypter {
const int STRING_DECRYPTER_KEY_CONST = 1789;
ModuleDefinition module;
ModuleDefMD module;
TypeDef stringDecrypterType;
MethodDef stringDecrypterMethod;
@ -40,7 +40,7 @@ namespace de4dot.code.deobfuscators.Xenocode {
get { return stringDecrypterMethod; }
}
public StringDecrypter(ModuleDefinition module) {
public StringDecrypter(ModuleDefMD module) {
this.module = module;
}
@ -64,12 +64,12 @@ namespace de4dot.code.deobfuscators.Xenocode {
method = null;
break;
}
if (method == null || method.Body == null)
if (method == null || method.CilBody == null)
continue;
bool foundConstant = false;
foreach (var instr in method.Body.Instructions) {
if (DotNetUtils.isLdcI4(instr) && DotNetUtils.getLdcI4Value(instr) == STRING_DECRYPTER_KEY_CONST) {
foreach (var instr in method.CilBody.Instructions) {
if (instr.IsLdcI4() && instr.GetLdcI4Value() == STRING_DECRYPTER_KEY_CONST) {
foundConstant = true;
break;
}

2
de4dot.cui/Program.cs
View File

@ -57,8 +57,8 @@ namespace de4dot.cui {
new de4dot.code.deobfuscators.Skater_NET.DeobfuscatorInfo(),
new de4dot.code.deobfuscators.SmartAssembly.DeobfuscatorInfo(),
new de4dot.code.deobfuscators.Spices_Net.DeobfuscatorInfo(),
new de4dot.code.deobfuscators.Xenocode.DeobfuscatorInfo(),
#endif
new de4dot.code.deobfuscators.Xenocode.DeobfuscatorInfo(),
};
}