monocul.us/de4dot-cex
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Port Xenocode deobfuscator

Browse Source
This commit is contained in:
de4dot 2012-11-06 15:53:01 +01:00
parent 054594dbfe
commit 3ed2daebd1
3 changed files with 8 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
de4dot.code/de4dot.code.csproj
View File

@ -261,8 +261,8 @@
<Compile Include="deobfuscators\UnpackedFile.cs" /> <Compile Include="deobfuscators\UnpackedFile.cs" />
<Compile Include="deobfuscators\UnusedMethodsFinder.cs" /> <Compile Include="deobfuscators\UnusedMethodsFinder.cs" />
<Compile Include="deobfuscators\ValueInlinerBase.cs" /> <Compile Include="deobfuscators\ValueInlinerBase.cs" />
<None Include="deobfuscators\Xenocode\Deobfuscator.cs" /> <Compile Include="deobfuscators\Xenocode\Deobfuscator.cs" />
<None Include="deobfuscators\Xenocode\StringDecrypter.cs" /> <Compile Include="deobfuscators\Xenocode\StringDecrypter.cs" />
<Compile Include="IDeobfuscatorContext.cs" /> <Compile Include="IDeobfuscatorContext.cs" />
<Compile Include="IObfuscatedFile.cs" /> <Compile Include="IObfuscatedFile.cs" />
<Compile Include="Log.cs" /> <Compile Include="Log.cs" />

10
de4dot.code/deobfuscators/Xenocode/StringDecrypter.cs
View File

@ -24,7 +24,7 @@ using de4dot.blocks;
namespace de4dot.code.deobfuscators.Xenocode { namespace de4dot.code.deobfuscators.Xenocode {
class StringDecrypter { class StringDecrypter {
const int STRING_DECRYPTER_KEY_CONST = 1789; const int STRING_DECRYPTER_KEY_CONST = 1789;
ModuleDefinition module; ModuleDefMD module;
TypeDef stringDecrypterType; TypeDef stringDecrypterType;
MethodDef stringDecrypterMethod; MethodDef stringDecrypterMethod;
@ -40,7 +40,7 @@ namespace de4dot.code.deobfuscators.Xenocode {
get { return stringDecrypterMethod; } get { return stringDecrypterMethod; }
} }
public StringDecrypter(ModuleDefinition module) { public StringDecrypter(ModuleDefMD module) {
this.module = module; this.module = module;
} }
@ -64,12 +64,12 @@ namespace de4dot.code.deobfuscators.Xenocode {
method = null; method = null;
break; break;
} }
if (method == null || method.Body == null) if (method == null || method.CilBody == null)
continue; continue;
bool foundConstant = false; bool foundConstant = false;
foreach (var instr in method.Body.Instructions) { foreach (var instr in method.CilBody.Instructions) {
if (DotNetUtils.isLdcI4(instr) && DotNetUtils.getLdcI4Value(instr) == STRING_DECRYPTER_KEY_CONST) { if (instr.IsLdcI4() && instr.GetLdcI4Value() == STRING_DECRYPTER_KEY_CONST) {
foundConstant = true; foundConstant = true;
break; break;
} }

2
de4dot.cui/Program.cs
View File

@ -57,8 +57,8 @@ namespace de4dot.cui {
new de4dot.code.deobfuscators.Skater_NET.DeobfuscatorInfo(), new de4dot.code.deobfuscators.Skater_NET.DeobfuscatorInfo(),
new de4dot.code.deobfuscators.SmartAssembly.DeobfuscatorInfo(), new de4dot.code.deobfuscators.SmartAssembly.DeobfuscatorInfo(),
new de4dot.code.deobfuscators.Spices_Net.DeobfuscatorInfo(), new de4dot.code.deobfuscators.Spices_Net.DeobfuscatorInfo(),
new de4dot.code.deobfuscators.Xenocode.DeobfuscatorInfo(),
#endif #endif
new de4dot.code.deobfuscators.Xenocode.DeobfuscatorInfo(),
}; };
} }