diff --git a/de4dot.code/deobfuscators/Confuser/AntiDebugger.cs b/de4dot.code/deobfuscators/Confuser/AntiDebugger.cs index e497bdf4..68200b40 100644 --- a/de4dot.code/deobfuscators/Confuser/AntiDebugger.cs +++ b/de4dot.code/deobfuscators/Confuser/AntiDebugger.cs @@ -58,12 +58,12 @@ namespace de4dot.code.deobfuscators.Confuser { this.module = module; } - public void find() { - if (checkMethod(DotNetUtils.getModuleTypeCctor(module))) + public void Find() { + if (CheckMethod(DotNetUtils.GetModuleTypeCctor(module))) return; } - bool checkMethod(MethodDef method) { + bool CheckMethod(MethodDef method) { if (method == null || method.Body == null) return false; @@ -73,13 +73,13 @@ namespace de4dot.code.deobfuscators.Confuser { var calledMethod = instr.Operand as MethodDef; if (calledMethod == null || !calledMethod.IsStatic) continue; - if (!DotNetUtils.isMethod(calledMethod, "System.Void", "()")) + if (!DotNetUtils.IsMethod(calledMethod, "System.Void", "()")) continue; var type = calledMethod.DeclaringType; if (type == null) continue; - if (checkMethod_normal(type, calledMethod) || checkMethod_safe(type, calledMethod)) { + if (CheckMethod_normal(type, calledMethod) || CheckMethod_safe(type, calledMethod)) { initMethod = calledMethod; return true; } @@ -88,27 +88,27 @@ namespace de4dot.code.deobfuscators.Confuser { return false; } - static bool checkProfilerStrings1(MethodDef method) { - if (!DotNetUtils.hasString(method, "COR_ENABLE_PROFILING")) + static bool CheckProfilerStrings1(MethodDef method) { + if (!DotNetUtils.HasString(method, "COR_ENABLE_PROFILING")) return false; - if (!DotNetUtils.hasString(method, "COR_PROFILER")) + if (!DotNetUtils.HasString(method, "COR_PROFILER")) return false; return true; } - static bool checkProfilerStrings2(MethodDef method) { - if (!DotNetUtils.hasString(method, "COR_")) + static bool CheckProfilerStrings2(MethodDef method) { + if (!DotNetUtils.HasString(method, "COR_")) return false; - if (!DotNetUtils.hasString(method, "ENABLE_PROFILING")) + if (!DotNetUtils.HasString(method, "ENABLE_PROFILING")) return false; - if (!DotNetUtils.hasString(method, "PROFILER")) + if (!DotNetUtils.HasString(method, "PROFILER")) return false; return true; } - static MethodDef getAntiDebugMethod(TypeDef type, MethodDef initMethod) { + static MethodDef GetAntiDebugMethod(TypeDef type, MethodDef initMethod) { foreach (var method in type.Methods) { if (method.Body == null || method == initMethod) continue; @@ -116,7 +116,7 @@ namespace de4dot.code.deobfuscators.Confuser { continue; if (!method.IsPrivate) continue; - if (!DotNetUtils.isMethod(method, "System.Void", "()") && !DotNetUtils.isMethod(method, "System.Void", "(System.Object)")) + if (!DotNetUtils.IsMethod(method, "System.Void", "()") && !DotNetUtils.IsMethod(method, "System.Void", "(System.Object)")) continue; return method; @@ -124,59 +124,59 @@ namespace de4dot.code.deobfuscators.Confuser { return null; } - bool checkMethod_normal(TypeDef type, MethodDef initMethod) { - var ntQueryInformationProcess = DotNetUtils.getPInvokeMethod(type, "ntdll", "NtQueryInformationProcess"); + bool CheckMethod_normal(TypeDef type, MethodDef initMethod) { + var ntQueryInformationProcess = DotNetUtils.GetPInvokeMethod(type, "ntdll", "NtQueryInformationProcess"); if (ntQueryInformationProcess == null) return false; - if (DotNetUtils.getPInvokeMethod(type, "ntdll", "NtSetInformationProcess") == null) + if (DotNetUtils.GetPInvokeMethod(type, "ntdll", "NtSetInformationProcess") == null) return false; - if (DotNetUtils.getPInvokeMethod(type, "kernel32", "CloseHandle") == null) + if (DotNetUtils.GetPInvokeMethod(type, "kernel32", "CloseHandle") == null) return false; - var antiDebugMethod = getAntiDebugMethod(type, initMethod); + var antiDebugMethod = GetAntiDebugMethod(type, initMethod); if (antiDebugMethod == null) return false; - if (!DotNetUtils.hasString(antiDebugMethod, "Debugger detected (Managed)")) + if (!DotNetUtils.HasString(antiDebugMethod, "Debugger detected (Managed)")) return false; - if (DotNetUtils.callsMethod(initMethod, "System.Void System.Threading.Thread::.ctor(System.Threading.ParameterizedThreadStart)")) { - int failFastCalls = ConfuserUtils.countCalls(antiDebugMethod, "System.Void System.Environment::FailFast(System.String)"); + if (DotNetUtils.CallsMethod(initMethod, "System.Void System.Threading.Thread::.ctor(System.Threading.ParameterizedThreadStart)")) { + int failFastCalls = ConfuserUtils.CountCalls(antiDebugMethod, "System.Void System.Environment::FailFast(System.String)"); if (failFastCalls != 6 && failFastCalls != 8) return false; - if (!checkProfilerStrings1(initMethod)) + if (!CheckProfilerStrings1(initMethod)) return false; - if (!DotNetUtils.callsMethod(antiDebugMethod, "System.Void System.Threading.Thread::.ctor(System.Threading.ParameterizedThreadStart)")) { - if (ConfuserUtils.countCalls(antiDebugMethod, ntQueryInformationProcess) != 2) + if (!DotNetUtils.CallsMethod(antiDebugMethod, "System.Void System.Threading.Thread::.ctor(System.Threading.ParameterizedThreadStart)")) { + if (ConfuserUtils.CountCalls(antiDebugMethod, ntQueryInformationProcess) != 2) return false; version = ConfuserVersion.v16_r61954_normal; } else if (failFastCalls == 8) { - if (ConfuserUtils.countCalls(antiDebugMethod, ntQueryInformationProcess) != 2) + if (ConfuserUtils.CountCalls(antiDebugMethod, ntQueryInformationProcess) != 2) return false; version = ConfuserVersion.v17_r73822_normal; } else if (failFastCalls == 6) { - if (DotNetUtils.getPInvokeMethod(type, "IsDebuggerPresent") == null) + if (DotNetUtils.GetPInvokeMethod(type, "IsDebuggerPresent") == null) return false; - if (ConfuserUtils.countCalls(antiDebugMethod, ntQueryInformationProcess) != 0) + if (ConfuserUtils.CountCalls(antiDebugMethod, ntQueryInformationProcess) != 0) return false; version = ConfuserVersion.v17_r74021_normal; } else return false; } - else if (!DotNetUtils.callsMethod(initMethod, "System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)")) { - if (!DotNetUtils.callsMethod(initMethod, "System.Void System.Diagnostics.Process::EnterDebugMode()")) + else if (!DotNetUtils.CallsMethod(initMethod, "System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)")) { + if (!DotNetUtils.CallsMethod(initMethod, "System.Void System.Diagnostics.Process::EnterDebugMode()")) return false; - if (!checkProfilerStrings1(antiDebugMethod)) + if (!CheckProfilerStrings1(antiDebugMethod)) return false; version = ConfuserVersion.v14_r57588_normal; } else { - if (!DotNetUtils.callsMethod(initMethod, "System.Void System.Diagnostics.Process::EnterDebugMode()")) + if (!DotNetUtils.CallsMethod(initMethod, "System.Void System.Diagnostics.Process::EnterDebugMode()")) return false; - if (!checkProfilerStrings1(antiDebugMethod)) + if (!CheckProfilerStrings1(antiDebugMethod)) return false; version = ConfuserVersion.v14_r60785_normal; } @@ -184,45 +184,45 @@ namespace de4dot.code.deobfuscators.Confuser { return true; } - bool checkMethod_safe(TypeDef type, MethodDef initMethod) { - if (type == DotNetUtils.getModuleType(module)) { - if (!DotNetUtils.hasString(initMethod, "Debugger detected (Managed)")) + bool CheckMethod_safe(TypeDef type, MethodDef initMethod) { + if (type == DotNetUtils.GetModuleType(module)) { + if (!DotNetUtils.HasString(initMethod, "Debugger detected (Managed)")) return false; - if (!checkProfilerStrings1(initMethod)) + if (!CheckProfilerStrings1(initMethod)) return false; version = ConfuserVersion.v14_r57588_safe; } else { - var ntQueryInformationProcess = DotNetUtils.getPInvokeMethod(type, "ntdll", "NtQueryInformationProcess"); + var ntQueryInformationProcess = DotNetUtils.GetPInvokeMethod(type, "ntdll", "NtQueryInformationProcess"); if (ntQueryInformationProcess == null) return false; - if (DotNetUtils.getPInvokeMethod(type, "ntdll", "NtSetInformationProcess") == null) + if (DotNetUtils.GetPInvokeMethod(type, "ntdll", "NtSetInformationProcess") == null) return false; - if (DotNetUtils.getPInvokeMethod(type, "kernel32", "CloseHandle") == null) + if (DotNetUtils.GetPInvokeMethod(type, "kernel32", "CloseHandle") == null) return false; - var antiDebugMethod = getAntiDebugMethod(type, initMethod); + var antiDebugMethod = GetAntiDebugMethod(type, initMethod); if (antiDebugMethod == null) return false; - if (!DotNetUtils.hasString(antiDebugMethod, "Debugger detected (Managed)") && - !DotNetUtils.hasString(antiDebugMethod, "Debugger is detected (Managed)")) + if (!DotNetUtils.HasString(antiDebugMethod, "Debugger detected (Managed)") && + !DotNetUtils.HasString(antiDebugMethod, "Debugger is detected (Managed)")) return false; - if (!DotNetUtils.callsMethod(initMethod, "System.Void System.Threading.Thread::.ctor(System.Threading.ParameterizedThreadStart)")) + if (!DotNetUtils.CallsMethod(initMethod, "System.Void System.Threading.Thread::.ctor(System.Threading.ParameterizedThreadStart)")) return false; - if (ConfuserUtils.countCalls(antiDebugMethod, ntQueryInformationProcess) != 0) + if (ConfuserUtils.CountCalls(antiDebugMethod, ntQueryInformationProcess) != 0) return false; - if (!checkProfilerStrings1(initMethod) && !checkProfilerStrings2(initMethod)) + if (!CheckProfilerStrings1(initMethod) && !CheckProfilerStrings2(initMethod)) return false; - int failFastCalls = ConfuserUtils.countCalls(antiDebugMethod, "System.Void System.Environment::FailFast(System.String)"); + int failFastCalls = ConfuserUtils.CountCalls(antiDebugMethod, "System.Void System.Environment::FailFast(System.String)"); if (failFastCalls != 2) return false; - if (!DotNetUtils.callsMethod(antiDebugMethod, "System.Void System.Threading.Thread::.ctor(System.Threading.ParameterizedThreadStart)")) + if (!DotNetUtils.CallsMethod(antiDebugMethod, "System.Void System.Threading.Thread::.ctor(System.Threading.ParameterizedThreadStart)")) version = ConfuserVersion.v16_r61954_safe; - else if (DotNetUtils.getPInvokeMethod(type, "IsDebuggerPresent") == null) + else if (DotNetUtils.GetPInvokeMethod(type, "IsDebuggerPresent") == null) version = ConfuserVersion.v17_r73822_safe; - else if (checkProfilerStrings1(initMethod)) + else if (CheckProfilerStrings1(initMethod)) version = ConfuserVersion.v17_r74021_safe; else version = ConfuserVersion.v19_r76119_safe; @@ -231,7 +231,7 @@ namespace de4dot.code.deobfuscators.Confuser { return true; } - public bool getRevisionRange(out int minRev, out int maxRev) { + public bool GetRevisionRange(out int minRev, out int maxRev) { switch (version) { case ConfuserVersion.Unknown: minRev = maxRev = 0; diff --git a/de4dot.code/deobfuscators/Confuser/AntiDumping.cs b/de4dot.code/deobfuscators/Confuser/AntiDumping.cs index 789c5b29..09973263 100644 --- a/de4dot.code/deobfuscators/Confuser/AntiDumping.cs +++ b/de4dot.code/deobfuscators/Confuser/AntiDumping.cs @@ -55,12 +55,12 @@ namespace de4dot.code.deobfuscators.Confuser { this.module = module; } - public void find(ISimpleDeobfuscator simpleDeobfuscator) { - if (checkMethod(simpleDeobfuscator, DotNetUtils.getModuleTypeCctor(module))) + public void Find(ISimpleDeobfuscator simpleDeobfuscator) { + if (CheckMethod(simpleDeobfuscator, DotNetUtils.GetModuleTypeCctor(module))) return; } - bool checkMethod(ISimpleDeobfuscator simpleDeobfuscator, MethodDef method) { + bool CheckMethod(ISimpleDeobfuscator simpleDeobfuscator, MethodDef method) { if (method == null || method.Body == null) return false; @@ -72,14 +72,14 @@ namespace de4dot.code.deobfuscators.Confuser { continue; if (calledMethod == null || !calledMethod.IsStatic) continue; - if (!DotNetUtils.isMethod(calledMethod, "System.Void", "()")) + if (!DotNetUtils.IsMethod(calledMethod, "System.Void", "()")) continue; var type = calledMethod.DeclaringType; if (type.NestedTypes.Count > 0) continue; - simpleDeobfuscator.deobfuscate(calledMethod, true); - if (checkType(type, calledMethod)) { + simpleDeobfuscator.Deobfuscate(calledMethod, true); + if (CheckType(type, calledMethod)) { initMethod = calledMethod; return true; } @@ -87,52 +87,52 @@ namespace de4dot.code.deobfuscators.Confuser { return false; } - bool checkType(TypeDef type, MethodDef initMethod) { - return checkType_v14_r58564(type, initMethod) || - checkType_v14_r58852(type, initMethod); + bool CheckType(TypeDef type, MethodDef initMethod) { + return CheckType_v14_r58564(type, initMethod) || + CheckType_v14_r58852(type, initMethod); } - bool checkType_v14_r58564(TypeDef type, MethodDef initMethod) { - var virtualProtect = DotNetUtils.getPInvokeMethod(type, "VirtualProtect"); + bool CheckType_v14_r58564(TypeDef type, MethodDef initMethod) { + var virtualProtect = DotNetUtils.GetPInvokeMethod(type, "VirtualProtect"); if (virtualProtect == null) return false; - if (!DotNetUtils.callsMethod(initMethod, "System.IntPtr System.Runtime.InteropServices.Marshal::GetHINSTANCE(System.Reflection.Module)")) + if (!DotNetUtils.CallsMethod(initMethod, "System.IntPtr System.Runtime.InteropServices.Marshal::GetHINSTANCE(System.Reflection.Module)")) return false; - if (ConfuserUtils.countCalls(initMethod, virtualProtect) != 3) + if (ConfuserUtils.CountCalls(initMethod, virtualProtect) != 3) return false; - if (!DeobUtils.hasInteger(initMethod, 224)) + if (!DeobUtils.HasInteger(initMethod, 224)) return false; - if (!DeobUtils.hasInteger(initMethod, 240)) + if (!DeobUtils.HasInteger(initMethod, 240)) return false; - if (!DeobUtils.hasInteger(initMethod, 267)) + if (!DeobUtils.HasInteger(initMethod, 267)) return false; version = ConfuserVersion.v14_r58564; return true; } - bool checkType_v14_r58852(TypeDef type, MethodDef initMethod) { - var virtualProtect = DotNetUtils.getPInvokeMethod(type, "VirtualProtect"); + bool CheckType_v14_r58852(TypeDef type, MethodDef initMethod) { + var virtualProtect = DotNetUtils.GetPInvokeMethod(type, "VirtualProtect"); if (virtualProtect == null) return false; - if (!DotNetUtils.callsMethod(initMethod, "System.IntPtr System.Runtime.InteropServices.Marshal::GetHINSTANCE(System.Reflection.Module)")) + if (!DotNetUtils.CallsMethod(initMethod, "System.IntPtr System.Runtime.InteropServices.Marshal::GetHINSTANCE(System.Reflection.Module)")) return false; - int virtualProtectCalls = ConfuserUtils.countCalls(initMethod, virtualProtect); + int virtualProtectCalls = ConfuserUtils.CountCalls(initMethod, virtualProtect); if (virtualProtectCalls != 14 && virtualProtectCalls != 16) return false; - if (!DeobUtils.hasInteger(initMethod, 0x3C)) + if (!DeobUtils.HasInteger(initMethod, 0x3C)) return false; - if (!DeobUtils.hasInteger(initMethod, 0x6c64746e)) + if (!DeobUtils.HasInteger(initMethod, 0x6c64746e)) return false; - if (!DeobUtils.hasInteger(initMethod, 0x6c642e6c)) + if (!DeobUtils.HasInteger(initMethod, 0x6c642e6c)) return false; - if (!DeobUtils.hasInteger(initMethod, 0x6f43744e)) + if (!DeobUtils.HasInteger(initMethod, 0x6f43744e)) return false; - if (!DeobUtils.hasInteger(initMethod, 0x6e69746e)) + if (!DeobUtils.HasInteger(initMethod, 0x6e69746e)) return false; - int locallocs = ConfuserUtils.countOpCode(initMethod, Code.Localloc); + int locallocs = ConfuserUtils.CountOpCode(initMethod, Code.Localloc); - if (DeobUtils.hasInteger(initMethod, 0x18)) + if (DeobUtils.HasInteger(initMethod, 0x18)) version = ConfuserVersion.v14_r58852; else if (virtualProtectCalls == 16) version = ConfuserVersion.v16_r69339; @@ -140,9 +140,9 @@ namespace de4dot.code.deobfuscators.Confuser { if (locallocs == 2) version = ConfuserVersion.v17_r74708; else if (locallocs == 1) { - if (DotNetUtils.hasString(initMethod, "")) + if (DotNetUtils.HasString(initMethod, "")) version = ConfuserVersion.v18_r75257; - else if (isRev75725(initMethod)) + else if (IsRev75725(initMethod)) version = ConfuserVersion.v19_r75725; else version = ConfuserVersion.v19_r76186; @@ -156,7 +156,7 @@ namespace de4dot.code.deobfuscators.Confuser { return true; } - static bool isRev75725(MethodDef method) { + static bool IsRev75725(MethodDef method) { var instrs = method.Body.Instructions; for (int i = 0; i < instrs.Count - 9; i++) { if (!instrs[i].IsLdcI4() || instrs[i].GetLdcI4Value() != 8) @@ -197,7 +197,7 @@ namespace de4dot.code.deobfuscators.Confuser { return false; } - public bool getRevisionRange(out int minRev, out int maxRev) { + public bool GetRevisionRange(out int minRev, out int maxRev) { switch (version) { case ConfuserVersion.Unknown: minRev = maxRev = 0; diff --git a/de4dot.code/deobfuscators/Confuser/Arg64ConstantsReader.cs b/de4dot.code/deobfuscators/Confuser/Arg64ConstantsReader.cs index b6dbb47e..dc2b869d 100644 --- a/de4dot.code/deobfuscators/Confuser/Arg64ConstantsReader.cs +++ b/de4dot.code/deobfuscators/Confuser/Arg64ConstantsReader.cs @@ -37,7 +37,7 @@ namespace de4dot.code.deobfuscators.Confuser { : base(instrs, emulateConvInstrs) { } - protected override bool processInstructionInt64(ref int index, Stack> stack) { + protected override bool ProcessInstructionInt64(ref int index, Stack> stack) { if (!firstTime) return false; firstTime = false; diff --git a/de4dot.code/deobfuscators/Confuser/ConfuserUtils.cs b/de4dot.code/deobfuscators/Confuser/ConfuserUtils.cs index ef682a59..35e380f4 100644 --- a/de4dot.code/deobfuscators/Confuser/ConfuserUtils.cs +++ b/de4dot.code/deobfuscators/Confuser/ConfuserUtils.cs @@ -26,9 +26,9 @@ using de4dot.blocks; namespace de4dot.code.deobfuscators.Confuser { static class ConfuserUtils { - public static int findCallMethod(IList instrs, int index, Code callCode, string methodFullName) { + public static int FindCallMethod(IList instrs, int index, Code callCode, string methodFullName) { for (int i = index; i < instrs.Count; i++) { - if (!isCallMethod(instrs[i], callCode, methodFullName)) + if (!IsCallMethod(instrs[i], callCode, methodFullName)) continue; return i; @@ -36,9 +36,9 @@ namespace de4dot.code.deobfuscators.Confuser { return -1; } - public static int findCallMethod(IList instrs, int index, Code callCode, string methodFullName) { + public static int FindCallMethod(IList instrs, int index, Code callCode, string methodFullName) { for (int i = index; i < instrs.Count; i++) { - if (!isCallMethod(instrs[i].Instruction, callCode, methodFullName)) + if (!IsCallMethod(instrs[i].Instruction, callCode, methodFullName)) continue; return i; @@ -46,24 +46,24 @@ namespace de4dot.code.deobfuscators.Confuser { return -1; } - public static bool isCallMethod(Instruction instr, Code callCode, string methodFullName) { + public static bool IsCallMethod(Instruction instr, Code callCode, string methodFullName) { if (instr.OpCode.Code != callCode) return false; var calledMethod = instr.Operand as IMethod; return calledMethod != null && calledMethod.FullName == methodFullName; } - public static bool removeResourceHookCode(Blocks blocks, MethodDef handler) { - return removeResolveHandlerCode(blocks, handler, "System.Void System.AppDomain::add_ResourceResolve(System.ResolveEventHandler)"); + public static bool RemoveResourceHookCode(Blocks blocks, MethodDef handler) { + return RemoveResolveHandlerCode(blocks, handler, "System.Void System.AppDomain::add_ResourceResolve(System.ResolveEventHandler)"); } - public static bool removeAssemblyHookCode(Blocks blocks, MethodDef handler) { - return removeResolveHandlerCode(blocks, handler, "System.Void System.AppDomain::add_AssemblyResolve(System.ResolveEventHandler)"); + public static bool RemoveAssemblyHookCode(Blocks blocks, MethodDef handler) { + return RemoveResolveHandlerCode(blocks, handler, "System.Void System.AppDomain::add_AssemblyResolve(System.ResolveEventHandler)"); } - static bool removeResolveHandlerCode(Blocks blocks, MethodDef handler, string installHandlerMethod) { + static bool RemoveResolveHandlerCode(Blocks blocks, MethodDef handler, string installHandlerMethod) { bool modified = false; - foreach (var block in blocks.MethodBlocks.getAllBlocks()) { + foreach (var block in blocks.MethodBlocks.GetAllBlocks()) { var instrs = block.Instructions; for (int i = 0; i < instrs.Count - 4; i++) { var call = instrs[i]; @@ -96,19 +96,19 @@ namespace de4dot.code.deobfuscators.Confuser { if (calledMethod == null || calledMethod.FullName != installHandlerMethod) continue; - block.remove(i, 5); + block.Remove(i, 5); modified = true; } } return modified; } - public static byte[] decryptCompressedInt32Data(Arg64ConstantsReader constReader, int exprStart, int exprEnd, IBinaryReader reader, byte[] decrypted) { + public static byte[] DecryptCompressedInt32Data(Arg64ConstantsReader constReader, int exprStart, int exprEnd, IBinaryReader reader, byte[] decrypted) { for (int i = 0; i < decrypted.Length; i++) { constReader.Arg = reader.Read7BitEncodedInt32(); int index = exprStart; long result; - if (!constReader.getInt64(ref index, out result) || index != exprEnd) + if (!constReader.GetInt64(ref index, out result) || index != exprEnd) throw new ApplicationException("Could not decrypt integer"); decrypted[i] = (byte)result; } @@ -116,11 +116,11 @@ namespace de4dot.code.deobfuscators.Confuser { } static readonly byte[] defaultDecryptKey = new byte[1]; - public static byte[] decrypt(uint seed, byte[] encrypted) { - return decrypt(seed, encrypted, defaultDecryptKey); + public static byte[] Decrypt(uint seed, byte[] encrypted) { + return Decrypt(seed, encrypted, defaultDecryptKey); } - public static byte[] decrypt(uint seed, byte[] encrypted, byte[] key) { + public static byte[] Decrypt(uint seed, byte[] encrypted, byte[] key) { var decrypted = new byte[encrypted.Length]; ushort _m = (ushort)(seed >> 16); ushort _c = (ushort)seed; @@ -133,7 +133,7 @@ namespace de4dot.code.deobfuscators.Confuser { return decrypted; } - public static int countCalls(MethodDef method, string methodFullName) { + public static int CountCalls(MethodDef method, string methodFullName) { if (method == null || method.Body == null) return 0; int count = 0; @@ -147,7 +147,7 @@ namespace de4dot.code.deobfuscators.Confuser { return count; } - public static int countCalls(MethodDef method, MethodDef calledMethod) { + public static int CountCalls(MethodDef method, MethodDef calledMethod) { if (method == null || method.Body == null) return 0; int count = 0; @@ -160,7 +160,7 @@ namespace de4dot.code.deobfuscators.Confuser { return count; } - public static int countOpCode(MethodDef method, Code code) { + public static int CountOpCode(MethodDef method, Code code) { if (method == null || method.Body == null) return 0; diff --git a/de4dot.code/deobfuscators/Confuser/ConstantsDecrypterBase.cs b/de4dot.code/deobfuscators/Confuser/ConstantsDecrypterBase.cs index 2cc591cc..140b8aa3 100644 --- a/de4dot.code/deobfuscators/Confuser/ConstantsDecrypterBase.cs +++ b/de4dot.code/deobfuscators/Confuser/ConstantsDecrypterBase.cs @@ -41,25 +41,25 @@ namespace de4dot.code.deobfuscators.Confuser { public uint key0, key1, key2, key3; public byte doubleType, singleType, int32Type, int64Type, stringType; - public void initialize() { - if (!initializeKeys()) + public void Initialize() { + if (!InitializeKeys()) throw new ApplicationException("Could not find all keys"); - if (!initializeTypeCodes()) + if (!InitializeTypeCodes()) throw new ApplicationException("Could not find all type codes"); } - protected virtual bool initializeKeys() { - if (!findKey0(decryptMethod, out key0)) + protected virtual bool InitializeKeys() { + if (!FindKey0(decryptMethod, out key0)) return false; - if (!findKey1(decryptMethod, out key1)) + if (!FindKey1(decryptMethod, out key1)) return false; - if (!findKey2Key3(decryptMethod, out key2, out key3)) + if (!FindKey2Key3(decryptMethod, out key2, out key3)) return false; return true; } - protected static bool findKey0(MethodDef method, out uint key) { + protected static bool FindKey0(MethodDef method, out uint key) { var instrs = method.Body.Instructions; for (int i = 0; i < instrs.Count - 5; i++) { if (!instrs[i].IsLdloc()) @@ -83,10 +83,10 @@ namespace de4dot.code.deobfuscators.Confuser { return false; } - static bool findKey1(MethodDef method, out uint key) { + static bool FindKey1(MethodDef method, out uint key) { var instrs = method.Body.Instructions; for (int i = 0; i < instrs.Count; i++) { - int index = ConfuserUtils.findCallMethod(instrs, i, Code.Callvirt, "System.Int32 System.Reflection.MemberInfo::get_MetadataToken()"); + int index = ConfuserUtils.FindCallMethod(instrs, i, Code.Callvirt, "System.Int32 System.Reflection.MemberInfo::get_MetadataToken()"); if (index < 0) break; if (index + 2 > instrs.Count) @@ -104,7 +104,7 @@ namespace de4dot.code.deobfuscators.Confuser { return false; } - protected static bool findKey2Key3(MethodDef method, out uint key2, out uint key3) { + protected static bool FindKey2Key3(MethodDef method, out uint key2, out uint key3) { var instrs = method.Body.Instructions; for (int i = 0; i < instrs.Count - 3; i++) { var ldci4_1 = instrs[i]; @@ -127,31 +127,31 @@ namespace de4dot.code.deobfuscators.Confuser { return false; } - bool initializeTypeCodes() { - var allBlocks = new Blocks(decryptMethod).MethodBlocks.getAllBlocks(); - if (!findTypeCode(allBlocks, out doubleType, Code.Call, "System.Double System.BitConverter::ToDouble(System.Byte[],System.Int32)")) + bool InitializeTypeCodes() { + var allBlocks = new Blocks(decryptMethod).MethodBlocks.GetAllBlocks(); + if (!FindTypeCode(allBlocks, out doubleType, Code.Call, "System.Double System.BitConverter::ToDouble(System.Byte[],System.Int32)")) return false; - if (!findTypeCode(allBlocks, out singleType, Code.Call, "System.Single System.BitConverter::ToSingle(System.Byte[],System.Int32)")) + if (!FindTypeCode(allBlocks, out singleType, Code.Call, "System.Single System.BitConverter::ToSingle(System.Byte[],System.Int32)")) return false; - if (!findTypeCode(allBlocks, out int32Type, Code.Call, "System.Int32 System.BitConverter::ToInt32(System.Byte[],System.Int32)")) + if (!FindTypeCode(allBlocks, out int32Type, Code.Call, "System.Int32 System.BitConverter::ToInt32(System.Byte[],System.Int32)")) return false; - if (!findTypeCode(allBlocks, out int64Type, Code.Call, "System.Int64 System.BitConverter::ToInt64(System.Byte[],System.Int32)")) + if (!FindTypeCode(allBlocks, out int64Type, Code.Call, "System.Int64 System.BitConverter::ToInt64(System.Byte[],System.Int32)")) return false; - if (!findTypeCode(allBlocks, out stringType, Code.Callvirt, "System.String System.Text.Encoding::GetString(System.Byte[])") && - !findTypeCode(allBlocks, out stringType, Code.Callvirt, "System.String System.Text.Encoding::GetString(System.Byte[],System.Int32,System.Int32)")) + if (!FindTypeCode(allBlocks, out stringType, Code.Callvirt, "System.String System.Text.Encoding::GetString(System.Byte[])") && + !FindTypeCode(allBlocks, out stringType, Code.Callvirt, "System.String System.Text.Encoding::GetString(System.Byte[],System.Int32,System.Int32)")) return false; return true; } - static bool findTypeCode(IList allBlocks, out byte typeCode, Code callCode, string bitConverterMethod) { + static bool FindTypeCode(IList allBlocks, out byte typeCode, Code callCode, string bitConverterMethod) { foreach (var block in allBlocks) { if (block.Sources.Count != 1) continue; - int index = ConfuserUtils.findCallMethod(block.Instructions, 0, callCode, bitConverterMethod); + int index = ConfuserUtils.FindCallMethod(block.Instructions, 0, callCode, bitConverterMethod); if (index < 0) continue; - if (!findTypeCode(block.Sources[0], out typeCode)) + if (!FindTypeCode(block.Sources[0], out typeCode)) continue; return true; @@ -160,10 +160,10 @@ namespace de4dot.code.deobfuscators.Confuser { return false; } - static Block fixBlock(Block block) { + static Block FixBlock(Block block) { if (block.Sources.Count != 1) return block; - if (block.getOnlyTarget() == null) + if (block.GetOnlyTarget() == null) return block; if (block.Instructions.Count == 0) { } @@ -174,8 +174,8 @@ namespace de4dot.code.deobfuscators.Confuser { return block.Sources[0]; } - static bool findTypeCode(Block block, out byte typeCode) { - block = fixBlock(block); + static bool FindTypeCode(Block block, out byte typeCode) { + block = FixBlock(block); var instrs = block.Instructions; int numCeq = 0; @@ -197,7 +197,7 @@ namespace de4dot.code.deobfuscators.Confuser { return false; } - public uint calcHash(uint x) { + public uint CalcHash(uint x) { uint h0 = key1 ^ x; uint h1 = key2; uint h2 = key3; @@ -240,7 +240,7 @@ namespace de4dot.code.deobfuscators.Confuser { } public IEnumerable Fields { - get { return fields.getKeys(); } + get { return fields.GetKeys(); } } protected bool HasDecrypterInfos { @@ -248,7 +248,7 @@ namespace de4dot.code.deobfuscators.Confuser { } public IEnumerable DecrypterInfos { - get { return methodToDecrypterInfo.getValues(); } + get { return methodToDecrypterInfo.GetValues(); } } public ConstantsDecrypterBase(ModuleDefMD module, byte[] fileData, ISimpleDeobfuscator simpleDeobfuscator) { @@ -257,36 +257,36 @@ namespace de4dot.code.deobfuscators.Confuser { this.simpleDeobfuscator = simpleDeobfuscator; } - public abstract bool getRevisionRange(out int minRev, out int maxRev); - public abstract void initialize(); + public abstract bool GetRevisionRange(out int minRev, out int maxRev); + public abstract void Initialize(); - protected void add(DecrypterInfo info) { - methodToDecrypterInfo.add(info.decryptMethod, info); + protected void Add(DecrypterInfo info) { + methodToDecrypterInfo.Add(info.decryptMethod, info); } - protected bool add(FieldDef field) { + protected bool Add(FieldDef field) { if (field == null) return false; - fields.add(field, true); + fields.Add(field, true); return true; } - protected void initializeDecrypterInfos() { - foreach (var info in methodToDecrypterInfo.getValues()) { - simpleDeobfuscator.deobfuscate(info.decryptMethod); - info.initialize(); + protected void InitializeDecrypterInfos() { + foreach (var info in methodToDecrypterInfo.GetValues()) { + simpleDeobfuscator.Deobfuscate(info.decryptMethod); + info.Initialize(); } } - protected void setConstantsData(byte[] constants) { + protected void SetConstantsData(byte[] constants) { reader = MemoryImageStream.Create(constants); } - protected EmbeddedResource findResource(MethodDef method) { - return DotNetUtils.getResource(module, DotNetUtils.getCodeStrings(method)) as EmbeddedResource; + protected EmbeddedResource FindResource(MethodDef method) { + return DotNetUtils.GetResource(module, DotNetUtils.GetCodeStrings(method)) as EmbeddedResource; } - protected static MethodDef findNativeMethod(MethodDef method) { + protected static MethodDef FindNativeMethod(MethodDef method) { var instrs = method.Body.Instructions; for (int i = 0; i < instrs.Count; i++) { var call = instrs[i]; @@ -295,7 +295,7 @@ namespace de4dot.code.deobfuscators.Confuser { var calledMethod = call.Operand as MethodDef; if (calledMethod == null || !calledMethod.IsStatic || !calledMethod.IsNative) continue; - if (!DotNetUtils.isMethod(calledMethod, "System.Int32", "(System.Int32)")) + if (!DotNetUtils.IsMethod(calledMethod, "System.Int32", "(System.Int32)")) continue; return calledMethod; @@ -303,10 +303,10 @@ namespace de4dot.code.deobfuscators.Confuser { return null; } - static Local getDynamicLocal_v17_r73740(MethodDef method) { + static Local GetDynamicLocal_v17_r73740(MethodDef method) { var instrs = method.Body.Instructions; for (int i = 0; i < instrs.Count; i++) { - i = ConfuserUtils.findCallMethod(instrs, i, Code.Callvirt, "System.Byte System.IO.BinaryReader::ReadByte()"); + i = ConfuserUtils.FindCallMethod(instrs, i, Code.Callvirt, "System.Byte System.IO.BinaryReader::ReadByte()"); if (i < 0 || i + 5 >= instrs.Count) break; if (!instrs[i + 1].IsStloc()) @@ -327,7 +327,7 @@ namespace de4dot.code.deobfuscators.Confuser { return null; } - static int getDynamicEndIndex_v17_r73740(MethodDef method, Local local) { + static int GetDynamicEndIndex_v17_r73740(MethodDef method, Local local) { var instrs = method.Body.Instructions; for (int i = 0; i < instrs.Count - 5; i++) { int index = i; @@ -358,7 +358,7 @@ namespace de4dot.code.deobfuscators.Confuser { return -1; } - static int getDynamicEndIndex_v17_r74788(MethodDef method, Local local) { + static int GetDynamicEndIndex_v17_r74788(MethodDef method, Local local) { var instrs = method.Body.Instructions; for (int i = 0; i < instrs.Count - 11; i++) { var stloc = instrs[i]; @@ -393,7 +393,7 @@ namespace de4dot.code.deobfuscators.Confuser { return -1; } - static int getDynamicStartIndex_v17_r73740(MethodDef method, int endIndex) { + static int GetDynamicStartIndex_v17_r73740(MethodDef method, int endIndex) { if (endIndex < 0) return -1; var instrs = method.Body.Instructions; @@ -409,42 +409,42 @@ namespace de4dot.code.deobfuscators.Confuser { } static readonly byte[] defaultDecryptKey_v17 = new byte[1]; - protected byte[] decryptConstant_v17_r73740_dynamic(DecrypterInfo info, byte[] encrypted, uint offs, uint key) { - return decryptConstant_v17_r73740_dynamic(info, encrypted, offs, key, defaultDecryptKey_v17); + protected byte[] DecryptConstant_v17_r73740_dynamic(DecrypterInfo info, byte[] encrypted, uint offs, uint key) { + return DecryptConstant_v17_r73740_dynamic(info, encrypted, offs, key, defaultDecryptKey_v17); } - protected byte[] decryptConstant_v17_r73740_dynamic(DecrypterInfo info, byte[] encrypted, uint offs, uint key1, byte[] key2) { - var local = getDynamicLocal_v17_r73740(info.decryptMethod); + protected byte[] DecryptConstant_v17_r73740_dynamic(DecrypterInfo info, byte[] encrypted, uint offs, uint key1, byte[] key2) { + var local = GetDynamicLocal_v17_r73740(info.decryptMethod); if (local == null) throw new ApplicationException("Could not find local"); - int endIndex = getDynamicEndIndex_v17_r73740(info.decryptMethod, local); + int endIndex = GetDynamicEndIndex_v17_r73740(info.decryptMethod, local); if (endIndex < 0) - endIndex = getDynamicEndIndex_v17_r74788(info.decryptMethod, local); - int startIndex = getDynamicStartIndex_v17_r73740(info.decryptMethod, endIndex); + endIndex = GetDynamicEndIndex_v17_r74788(info.decryptMethod, local); + int startIndex = GetDynamicStartIndex_v17_r73740(info.decryptMethod, endIndex); if (startIndex < 0) throw new ApplicationException("Could not find start/end index"); var constReader = new ConstantsReader(info.decryptMethod); - return decrypt(encrypted, key1, (magic, i) => { - constReader.setConstantInt32(local, magic); + return Decrypt(encrypted, key1, (magic, i) => { + constReader.SetConstantInt32(local, magic); int index = startIndex, result; - if (!constReader.getNextInt32(ref index, out result) || index != endIndex) + if (!constReader.GetNextInt32(ref index, out result) || index != endIndex) throw new ApplicationException("Could not decrypt integer"); return (byte)(result ^ key2[i % key2.Length]); }); } - protected byte[] decryptConstant_v17_r73764_native(DecrypterInfo info, byte[] encrypted, uint offs, uint key) { - return decryptConstant_v17_r73764_native(info, encrypted, offs, key, defaultDecryptKey_v17); + protected byte[] DecryptConstant_v17_r73764_native(DecrypterInfo info, byte[] encrypted, uint offs, uint key) { + return DecryptConstant_v17_r73764_native(info, encrypted, offs, key, defaultDecryptKey_v17); } - protected byte[] decryptConstant_v17_r73764_native(DecrypterInfo info, byte[] encrypted, uint offs, uint key1, byte[] key2) { + protected byte[] DecryptConstant_v17_r73764_native(DecrypterInfo info, byte[] encrypted, uint offs, uint key1, byte[] key2) { using (var x86Emu = new x86Emulator(fileData)) - return decrypt(encrypted, key1, (magic, i) => (byte)(x86Emu.emulate((uint)nativeMethod.RVA, magic) ^ key2[i % key2.Length])); + return Decrypt(encrypted, key1, (magic, i) => (byte)(x86Emu.Emulate((uint)nativeMethod.RVA, magic) ^ key2[i % key2.Length])); } - static byte[] decrypt(byte[] encrypted, uint key, Func decryptFunc) { + static byte[] Decrypt(byte[] encrypted, uint key, Func decryptFunc) { var reader = MemoryImageStream.Create(encrypted); var decrypted = new byte[reader.ReadInt32() ^ key]; for (int i = 0; i < decrypted.Length; i++) { @@ -455,10 +455,10 @@ namespace de4dot.code.deobfuscators.Confuser { return decrypted; } - public object decryptInt32(MethodDef caller, MethodDef decryptMethod, object[] args) { - var info = methodToDecrypterInfo.find(decryptMethod); + public object DecryptInt32(MethodDef caller, MethodDef decryptMethod, object[] args) { + var info = methodToDecrypterInfo.Find(decryptMethod); byte typeCode; - var data = decryptData(info, caller, args, out typeCode); + var data = DecryptData(info, caller, args, out typeCode); if (typeCode != info.int32Type) return null; if (data.Length != 4) @@ -466,10 +466,10 @@ namespace de4dot.code.deobfuscators.Confuser { return BitConverter.ToInt32(data, 0); } - public object decryptInt64(MethodDef caller, MethodDef decryptMethod, object[] args) { - var info = methodToDecrypterInfo.find(decryptMethod); + public object DecryptInt64(MethodDef caller, MethodDef decryptMethod, object[] args) { + var info = methodToDecrypterInfo.Find(decryptMethod); byte typeCode; - var data = decryptData(info, caller, args, out typeCode); + var data = DecryptData(info, caller, args, out typeCode); if (typeCode != info.int64Type) return null; if (data.Length != 8) @@ -477,10 +477,10 @@ namespace de4dot.code.deobfuscators.Confuser { return BitConverter.ToInt64(data, 0); } - public object decryptSingle(MethodDef caller, MethodDef decryptMethod, object[] args) { - var info = methodToDecrypterInfo.find(decryptMethod); + public object DecryptSingle(MethodDef caller, MethodDef decryptMethod, object[] args) { + var info = methodToDecrypterInfo.Find(decryptMethod); byte typeCode; - var data = decryptData(info, caller, args, out typeCode); + var data = DecryptData(info, caller, args, out typeCode); if (typeCode != info.singleType) return null; if (data.Length != 4) @@ -488,10 +488,10 @@ namespace de4dot.code.deobfuscators.Confuser { return BitConverter.ToSingle(data, 0); } - public object decryptDouble(MethodDef caller, MethodDef decryptMethod, object[] args) { - var info = methodToDecrypterInfo.find(decryptMethod); + public object DecryptDouble(MethodDef caller, MethodDef decryptMethod, object[] args) { + var info = methodToDecrypterInfo.Find(decryptMethod); byte typeCode; - var data = decryptData(info, caller, args, out typeCode); + var data = DecryptData(info, caller, args, out typeCode); if (typeCode != info.doubleType) return null; if (data.Length != 8) @@ -499,15 +499,15 @@ namespace de4dot.code.deobfuscators.Confuser { return BitConverter.ToDouble(data, 0); } - public string decryptString(MethodDef caller, MethodDef decryptMethod, object[] args) { - var info = methodToDecrypterInfo.find(decryptMethod); + public string DecryptString(MethodDef caller, MethodDef decryptMethod, object[] args) { + var info = methodToDecrypterInfo.Find(decryptMethod); byte typeCode; - var data = decryptData(info, caller, args, out typeCode); + var data = DecryptData(info, caller, args, out typeCode); if (typeCode != info.stringType) return null; return Encoding.UTF8.GetString(data); } - protected abstract byte[] decryptData(DecrypterInfo info, MethodDef caller, object[] args, out byte typeCode); + protected abstract byte[] DecryptData(DecrypterInfo info, MethodDef caller, object[] args, out byte typeCode); } } diff --git a/de4dot.code/deobfuscators/Confuser/ConstantsDecrypterUtils.cs b/de4dot.code/deobfuscators/Confuser/ConstantsDecrypterUtils.cs index 0b5d521c..97129915 100644 --- a/de4dot.code/deobfuscators/Confuser/ConstantsDecrypterUtils.cs +++ b/de4dot.code/deobfuscators/Confuser/ConstantsDecrypterUtils.cs @@ -22,7 +22,7 @@ using dnlib.DotNet.Emit; namespace de4dot.code.deobfuscators.Confuser { static class ConstantsDecrypterUtils { - public static FieldDef findDictField(MethodDef method, TypeDef declaringType) { + public static FieldDef FindDictField(MethodDef method, TypeDef declaringType) { var instrs = method.Body.Instructions; for (int i = 0; i < instrs.Count - 1; i++) { var newobj = instrs[i]; @@ -46,7 +46,7 @@ namespace de4dot.code.deobfuscators.Confuser { return null; } - public static FieldDef findDataField(MethodDef method, TypeDef declaringType) { + public static FieldDef FindDataField(MethodDef method, TypeDef declaringType) { var instrs = method.Body.Instructions; for (int i = 0; i < instrs.Count - 1; i++) { var callvirt = instrs[i]; @@ -70,15 +70,15 @@ namespace de4dot.code.deobfuscators.Confuser { return null; } - public static FieldDef findStreamField(MethodDef method, TypeDef declaringType) { - return findStreamField(method, declaringType, "System.IO.Stream"); + public static FieldDef FindStreamField(MethodDef method, TypeDef declaringType) { + return FindStreamField(method, declaringType, "System.IO.Stream"); } - public static FieldDef findMemoryStreamField(MethodDef method, TypeDef declaringType) { - return findStreamField(method, declaringType, "System.IO.MemoryStream"); + public static FieldDef FindMemoryStreamField(MethodDef method, TypeDef declaringType) { + return FindStreamField(method, declaringType, "System.IO.MemoryStream"); } - public static FieldDef findStreamField(MethodDef method, TypeDef declaringType, string fieldTypeName) { + public static FieldDef FindStreamField(MethodDef method, TypeDef declaringType, string fieldTypeName) { var instrs = method.Body.Instructions; for (int i = 0; i < instrs.Count - 1; i++) { var newobj = instrs[i]; diff --git a/de4dot.code/deobfuscators/Confuser/ConstantsDecrypterV15.cs b/de4dot.code/deobfuscators/Confuser/ConstantsDecrypterV15.cs index 6872e23b..ebb025d7 100644 --- a/de4dot.code/deobfuscators/Confuser/ConstantsDecrypterV15.cs +++ b/de4dot.code/deobfuscators/Confuser/ConstantsDecrypterV15.cs @@ -69,28 +69,28 @@ namespace de4dot.code.deobfuscators.Confuser { "System.IO.Compression.DeflateStream", "System.Reflection.Assembly", }; - public void find() { - var type = DotNetUtils.getModuleType(module); + public void Find() { + var type = DotNetUtils.GetModuleType(module); if (type == null) return; foreach (var method in type.Methods) { if (!method.IsStatic || method.Body == null) continue; - if (!DotNetUtils.isMethod(method, "System.Object", "(System.UInt32)")) + if (!DotNetUtils.IsMethod(method, "System.Object", "(System.UInt32)")) continue; DecrypterInfo info = new DecrypterInfo(); var localTypes = new LocalTypes(method); - if (localTypes.all(requiredLocals1)) { - if (localTypes.exists("System.Collections.BitArray")) // or System.Random + if (localTypes.All(requiredLocals1)) { + if (localTypes.Exists("System.Collections.BitArray")) // or System.Random version = ConfuserVersion.v15_r60785_normal; - else if (DeobUtils.hasInteger(method, 0x100) && - DeobUtils.hasInteger(method, 0x10000) && - DeobUtils.hasInteger(method, 0xFFFF)) + else if (DeobUtils.HasInteger(method, 0x100) && + DeobUtils.HasInteger(method, 0x10000) && + DeobUtils.HasInteger(method, 0xFFFF)) version = ConfuserVersion.v17_r73404_normal; - else if (DotNetUtils.callsMethod(method, "System.String System.Text.Encoding::GetString(System.Byte[])")) { - if (findInstruction(method.Body.Instructions, 0, Code.Conv_I8) >= 0) { - if (DotNetUtils.callsMethod(method, "System.Void System.Console::WriteLine()")) + else if (DotNetUtils.CallsMethod(method, "System.String System.Text.Encoding::GetString(System.Byte[])")) { + if (FindInstruction(method.Body.Instructions, 0, Code.Conv_I8) >= 0) { + if (DotNetUtils.CallsMethod(method, "System.Void System.Console::WriteLine()")) version = ConfuserVersion.v15_r60785_dynamic; else version = ConfuserVersion.v17_r72989_dynamic; @@ -98,8 +98,8 @@ namespace de4dot.code.deobfuscators.Confuser { else version = ConfuserVersion.v17_r73740_dynamic; } - else if (DotNetUtils.callsMethod(method, "System.String System.Text.Encoding::GetString(System.Byte[],System.Int32,System.Int32)")) { - if ((nativeMethod = findNativeMethod(method)) == null) + else if (DotNetUtils.CallsMethod(method, "System.String System.Text.Encoding::GetString(System.Byte[],System.Int32,System.Int32)")) { + if ((nativeMethod = FindNativeMethod(method)) == null) version = ConfuserVersion.v17_r73764_dynamic; else version = ConfuserVersion.v17_r73764_native; @@ -107,18 +107,18 @@ namespace de4dot.code.deobfuscators.Confuser { else continue; } - else if (localTypes.all(requiredLocals2)) { - if (DeobUtils.hasInteger(method, 0x100) && - DeobUtils.hasInteger(method, 0x10000) && - DeobUtils.hasInteger(method, 0xFFFF)) + else if (localTypes.All(requiredLocals2)) { + if (DeobUtils.HasInteger(method, 0x100) && + DeobUtils.HasInteger(method, 0x10000) && + DeobUtils.HasInteger(method, 0xFFFF)) version = ConfuserVersion.v17_r73822_normal; - else if (DotNetUtils.callsMethod(method, "System.Int32 System.Object::GetHashCode()")) { - if ((nativeMethod = findNativeMethod(method)) == null) + else if (DotNetUtils.CallsMethod(method, "System.Int32 System.Object::GetHashCode()")) { + if ((nativeMethod = FindNativeMethod(method)) == null) version = ConfuserVersion.v17_r74021_dynamic; else version = ConfuserVersion.v17_r74021_native; } - else if ((nativeMethod = findNativeMethod(method)) == null) + else if ((nativeMethod = FindNativeMethod(method)) == null) version = ConfuserVersion.v17_r73822_dynamic; else version = ConfuserVersion.v17_r73822_native; @@ -128,32 +128,32 @@ namespace de4dot.code.deobfuscators.Confuser { info.decryptMethod = method; theDecrypterInfo = info; - add(info); + Add(info); break; } } - public override void initialize() { - if ((resource = findResource(theDecrypterInfo.decryptMethod)) == null) + public override void Initialize() { + if ((resource = FindResource(theDecrypterInfo.decryptMethod)) == null) throw new ApplicationException("Could not find encrypted consts resource"); - initializeDecrypterInfos(); - if (!initializeFields(theDecrypterInfo)) + InitializeDecrypterInfos(); + if (!InitializeFields(theDecrypterInfo)) throw new ApplicationException("Could not find all fields"); - setConstantsData(DeobUtils.inflate(resource.GetResourceData(), true)); + SetConstantsData(DeobUtils.Inflate(resource.GetResourceData(), true)); } - bool initializeFields(DecrypterInfo info) { + bool InitializeFields(DecrypterInfo info) { switch (version) { case ConfuserVersion.v17_r73822_normal: case ConfuserVersion.v17_r73822_dynamic: case ConfuserVersion.v17_r73822_native: case ConfuserVersion.v17_r74021_dynamic: case ConfuserVersion.v17_r74021_native: - if (!add(ConstantsDecrypterUtils.findDictField(info.decryptMethod, info.decryptMethod.DeclaringType))) + if (!Add(ConstantsDecrypterUtils.FindDictField(info.decryptMethod, info.decryptMethod.DeclaringType))) return false; - if (!add(ConstantsDecrypterUtils.findMemoryStreamField(info.decryptMethod, info.decryptMethod.DeclaringType))) + if (!Add(ConstantsDecrypterUtils.FindMemoryStreamField(info.decryptMethod, info.decryptMethod.DeclaringType))) return false; break; @@ -164,8 +164,8 @@ namespace de4dot.code.deobfuscators.Confuser { return true; } - protected override byte[] decryptData(DecrypterInfo info, MethodDef caller, object[] args, out byte typeCode) { - uint offs = info.calcHash(caller.MDToken.ToUInt32()) ^ (uint)args[0]; + protected override byte[] DecryptData(DecrypterInfo info, MethodDef caller, object[] args, out byte typeCode) { + uint offs = info.CalcHash(caller.MDToken.ToUInt32()) ^ (uint)args[0]; reader.Position = offs; typeCode = reader.ReadByte(); if (typeCode != info.int32Type && typeCode != info.int64Type && @@ -174,28 +174,28 @@ namespace de4dot.code.deobfuscators.Confuser { throw new ApplicationException("Invalid type code"); var encrypted = reader.ReadBytes(reader.ReadInt32()); - return decryptConstant(info, encrypted, offs); + return DecryptConstant(info, encrypted, offs); } - byte[] decryptConstant(DecrypterInfo info, byte[] encrypted, uint offs) { + byte[] DecryptConstant(DecrypterInfo info, byte[] encrypted, uint offs) { switch (version) { - case ConfuserVersion.v15_r60785_normal: return decryptConstant_v15_r60785_normal(info, encrypted, offs); - case ConfuserVersion.v15_r60785_dynamic: return decryptConstant_v15_r60785_dynamic(info, encrypted, offs); - case ConfuserVersion.v17_r72989_dynamic: return decryptConstant_v15_r60785_dynamic(info, encrypted, offs); - case ConfuserVersion.v17_r73404_normal: return decryptConstant_v17_r73404_normal(info, encrypted, offs); - case ConfuserVersion.v17_r73740_dynamic: return decryptConstant_v17_r73740_dynamic(info, encrypted, offs, 0); - case ConfuserVersion.v17_r73764_dynamic: return decryptConstant_v17_r73740_dynamic(info, encrypted, offs, 0); - case ConfuserVersion.v17_r73764_native: return decryptConstant_v17_r73764_native(info, encrypted, offs, 0); - case ConfuserVersion.v17_r73822_normal: return decryptConstant_v17_r73404_normal(info, encrypted, offs); - case ConfuserVersion.v17_r73822_dynamic: return decryptConstant_v17_r73740_dynamic(info, encrypted, offs, 0); - case ConfuserVersion.v17_r73822_native: return decryptConstant_v17_r73764_native(info, encrypted, offs, 0); - case ConfuserVersion.v17_r74021_dynamic: return decryptConstant_v17_r73740_dynamic(info, encrypted, offs, 0); - case ConfuserVersion.v17_r74021_native: return decryptConstant_v17_r73764_native(info, encrypted, offs, 0); + case ConfuserVersion.v15_r60785_normal: return DecryptConstant_v15_r60785_normal(info, encrypted, offs); + case ConfuserVersion.v15_r60785_dynamic: return DecryptConstant_v15_r60785_dynamic(info, encrypted, offs); + case ConfuserVersion.v17_r72989_dynamic: return DecryptConstant_v15_r60785_dynamic(info, encrypted, offs); + case ConfuserVersion.v17_r73404_normal: return DecryptConstant_v17_r73404_normal(info, encrypted, offs); + case ConfuserVersion.v17_r73740_dynamic: return DecryptConstant_v17_r73740_dynamic(info, encrypted, offs, 0); + case ConfuserVersion.v17_r73764_dynamic: return DecryptConstant_v17_r73740_dynamic(info, encrypted, offs, 0); + case ConfuserVersion.v17_r73764_native: return DecryptConstant_v17_r73764_native(info, encrypted, offs, 0); + case ConfuserVersion.v17_r73822_normal: return DecryptConstant_v17_r73404_normal(info, encrypted, offs); + case ConfuserVersion.v17_r73822_dynamic: return DecryptConstant_v17_r73740_dynamic(info, encrypted, offs, 0); + case ConfuserVersion.v17_r73822_native: return DecryptConstant_v17_r73764_native(info, encrypted, offs, 0); + case ConfuserVersion.v17_r74021_dynamic: return DecryptConstant_v17_r73740_dynamic(info, encrypted, offs, 0); + case ConfuserVersion.v17_r74021_native: return DecryptConstant_v17_r73764_native(info, encrypted, offs, 0); default: throw new ApplicationException("Invalid version"); } } - byte[] decryptConstant_v15_r60785_normal(DecrypterInfo info, byte[] encrypted, uint offs) { + byte[] DecryptConstant_v15_r60785_normal(DecrypterInfo info, byte[] encrypted, uint offs) { var rand = new Random((int)(info.key0 ^ offs)); var decrypted = new byte[encrypted.Length]; rand.NextBytes(decrypted); @@ -204,30 +204,30 @@ namespace de4dot.code.deobfuscators.Confuser { return decrypted; } - byte[] decryptConstant_v15_r60785_dynamic(DecrypterInfo info, byte[] encrypted, uint offs) { + byte[] DecryptConstant_v15_r60785_dynamic(DecrypterInfo info, byte[] encrypted, uint offs) { var instrs = info.decryptMethod.Body.Instructions; - int startIndex = getDynamicStartIndex_v15_r60785(instrs); - int endIndex = getDynamicEndIndex_v15_r60785(instrs, startIndex); + int startIndex = GetDynamicStartIndex_v15_r60785(instrs); + int endIndex = GetDynamicEndIndex_v15_r60785(instrs, startIndex); if (endIndex < 0) throw new ApplicationException("Could not find start/endIndex"); var dataReader = MemoryImageStream.Create(encrypted); var decrypted = new byte[dataReader.ReadInt32()]; var constReader = new Arg64ConstantsReader(instrs, false); - ConfuserUtils.decryptCompressedInt32Data(constReader, startIndex, endIndex, dataReader, decrypted); + ConfuserUtils.DecryptCompressedInt32Data(constReader, startIndex, endIndex, dataReader, decrypted); return decrypted; } - static int getDynamicStartIndex_v15_r60785(IList instrs) { - int index = findInstruction(instrs, 0, Code.Conv_I8); + static int GetDynamicStartIndex_v15_r60785(IList instrs) { + int index = FindInstruction(instrs, 0, Code.Conv_I8); if (index < 0) return -1; - if (findInstruction(instrs, index + 1, Code.Conv_I8) >= 0) + if (FindInstruction(instrs, index + 1, Code.Conv_I8) >= 0) return -1; return index; } - static int getDynamicEndIndex_v15_r60785(IList instrs, int index) { + static int GetDynamicEndIndex_v15_r60785(IList instrs, int index) { if (index < 0) return -1; for (int i = index; i < instrs.Count; i++) { @@ -240,7 +240,7 @@ namespace de4dot.code.deobfuscators.Confuser { return -1; } - static int findInstruction(IList instrs, int index, Code code) { + static int FindInstruction(IList instrs, int index, Code code) { for (int i = index; i < instrs.Count; i++) { if (instrs[i].OpCode.Code == code) return i; @@ -248,11 +248,11 @@ namespace de4dot.code.deobfuscators.Confuser { return -1; } - byte[] decryptConstant_v17_r73404_normal(DecrypterInfo info, byte[] encrypted, uint offs) { - return ConfuserUtils.decrypt(info.key0 ^ offs, encrypted); + byte[] DecryptConstant_v17_r73404_normal(DecrypterInfo info, byte[] encrypted, uint offs) { + return ConfuserUtils.Decrypt(info.key0 ^ offs, encrypted); } - public override bool getRevisionRange(out int minRev, out int maxRev) { + public override bool GetRevisionRange(out int minRev, out int maxRev) { switch (version) { case ConfuserVersion.Unknown: minRev = maxRev = 0; diff --git a/de4dot.code/deobfuscators/Confuser/ConstantsDecrypterV17.cs b/de4dot.code/deobfuscators/Confuser/ConstantsDecrypterV17.cs index fddb3274..990eab9c 100644 --- a/de4dot.code/deobfuscators/Confuser/ConstantsDecrypterV17.cs +++ b/de4dot.code/deobfuscators/Confuser/ConstantsDecrypterV17.cs @@ -62,22 +62,22 @@ namespace de4dot.code.deobfuscators.Confuser { this.decryptMethod = decryptMethod; } - protected override bool initializeKeys() { - if (!findKey0(decryptMethod, out key0)) + protected override bool InitializeKeys() { + if (!FindKey0(decryptMethod, out key0)) return false; - if (!findKey1_v17(decryptMethod, out key1)) + if (!FindKey1_v17(decryptMethod, out key1)) return false; - if (!findKey2Key3(decryptMethod, out key2, out key3)) + if (!FindKey2Key3(decryptMethod, out key2, out key3)) return false; - if (!findKey4(decryptMethod, out key4)) + if (!FindKey4(decryptMethod, out key4)) return false; - if (!findKey5(decryptMethod, out key5)) + if (!FindKey5(decryptMethod, out key5)) return false; return true; } - static bool findKey1_v17(MethodDef method, out uint key) { + static bool FindKey1_v17(MethodDef method, out uint key) { var instrs = method.Body.Instructions; for (int i = 0; i < instrs.Count - 4; i++) { var stloc = instrs[i]; @@ -103,14 +103,14 @@ namespace de4dot.code.deobfuscators.Confuser { return false; } - bool findKey4(MethodDef method, out uint key) { + bool FindKey4(MethodDef method, out uint key) { switch (version) { case ConfuserVersion.v17_r74708_normal: case ConfuserVersion.v17_r74788_normal: case ConfuserVersion.v17_r74816_normal: case ConfuserVersion.v17_r75056_normal: case ConfuserVersion.v18_r75257_normal: - return findKey4_normal(method, out key); + return FindKey4_normal(method, out key); case ConfuserVersion.v17_r74708_dynamic: case ConfuserVersion.v17_r74708_native: case ConfuserVersion.v17_r74788_dynamic: @@ -121,13 +121,13 @@ namespace de4dot.code.deobfuscators.Confuser { case ConfuserVersion.v17_r75056_native: case ConfuserVersion.v18_r75257_dynamic: case ConfuserVersion.v18_r75257_native: - return findKey4_other(method, out key); + return FindKey4_other(method, out key); default: throw new ApplicationException("Invalid version"); } } - static bool findKey4_normal(MethodDef method, out uint key) { + static bool FindKey4_normal(MethodDef method, out uint key) { var instrs = method.Body.Instructions; for (int i = 0; i < instrs.Count - 5; i++) { if (!instrs[i].IsLdloc()) @@ -151,10 +151,10 @@ namespace de4dot.code.deobfuscators.Confuser { return false; } - static bool findKey4_other(MethodDef method, out uint key) { + static bool FindKey4_other(MethodDef method, out uint key) { var instrs = method.Body.Instructions; for (int i = 0; i < instrs.Count; i++) { - int index = ConfuserUtils.findCallMethod(instrs, i, Code.Callvirt, "System.Int32 System.IO.BinaryReader::ReadInt32()"); + int index = ConfuserUtils.FindCallMethod(instrs, i, Code.Callvirt, "System.Int32 System.IO.BinaryReader::ReadInt32()"); if (index < 0) break; if (index + 1 >= instrs.Count) @@ -170,7 +170,7 @@ namespace de4dot.code.deobfuscators.Confuser { return false; } - bool findKey5(MethodDef method, out uint key) { + bool FindKey5(MethodDef method, out uint key) { switch (version) { case ConfuserVersion.v17_r74788_normal: case ConfuserVersion.v17_r74788_dynamic: @@ -184,17 +184,17 @@ namespace de4dot.code.deobfuscators.Confuser { case ConfuserVersion.v18_r75257_normal: case ConfuserVersion.v18_r75257_dynamic: case ConfuserVersion.v18_r75257_native: - return findKey5_v17_r74788(method, out key); + return FindKey5_v17_r74788(method, out key); default: key = 0; return true; } } - static bool findKey5_v17_r74788(MethodDef method, out uint key) { + static bool FindKey5_v17_r74788(MethodDef method, out uint key) { var instrs = method.Body.Instructions; for (int i = 0; i < instrs.Count; i++) { - i = ConfuserUtils.findCallMethod(instrs, i, Code.Callvirt, "System.Reflection.Module System.Reflection.Assembly::GetModule(System.String)"); + i = ConfuserUtils.FindCallMethod(instrs, i, Code.Callvirt, "System.Reflection.Module System.Reflection.Assembly::GetModule(System.String)"); if (i < 0) break; if (i + 1 >= instrs.Count) @@ -225,64 +225,64 @@ namespace de4dot.code.deobfuscators.Confuser { "System.Byte[]", "System.Int32", }; - public void find() { - var cctor = DotNetUtils.getModuleTypeCctor(module); + public void Find() { + var cctor = DotNetUtils.GetModuleTypeCctor(module); if (cctor == null) return; - if (!new LocalTypes(cctor).all(requiredLocalsCctor)) + if (!new LocalTypes(cctor).All(requiredLocalsCctor)) return; - simpleDeobfuscator.deobfuscate(cctor, true); - if (!add(ConstantsDecrypterUtils.findDictField(cctor, cctor.DeclaringType))) + simpleDeobfuscator.Deobfuscate(cctor, true); + if (!Add(ConstantsDecrypterUtils.FindDictField(cctor, cctor.DeclaringType))) return; - if (!add(ConstantsDecrypterUtils.findStreamField(cctor, cctor.DeclaringType))) + if (!Add(ConstantsDecrypterUtils.FindStreamField(cctor, cctor.DeclaringType))) return; - var method = getDecryptMethod(); + var method = GetDecryptMethod(); if (method == null) return; - resourceName = getResourceName(cctor); + resourceName = GetResourceName(cctor); if (resourceName != null) { - simpleDeobfuscator.deobfuscate(method); - keyArraySize = getKeyArraySize(method); + simpleDeobfuscator.Deobfuscate(method); + keyArraySize = GetKeyArraySize(method); if (keyArraySize == 8) - initVersion(method, ConfuserVersion.v17_r75056_normal, ConfuserVersion.v17_r75056_dynamic, ConfuserVersion.v17_r75056_native); + InitVersion(method, ConfuserVersion.v17_r75056_normal, ConfuserVersion.v17_r75056_dynamic, ConfuserVersion.v17_r75056_native); else if (keyArraySize == 16) - initVersion(method, ConfuserVersion.v18_r75257_normal, ConfuserVersion.v18_r75257_dynamic, ConfuserVersion.v18_r75257_native); + InitVersion(method, ConfuserVersion.v18_r75257_normal, ConfuserVersion.v18_r75257_dynamic, ConfuserVersion.v18_r75257_native); else return; } - else if (DotNetUtils.callsMethod(method, "System.String System.Reflection.Module::get_ScopeName()")) - initVersion(method, ConfuserVersion.v17_r74816_normal, ConfuserVersion.v17_r74816_dynamic, ConfuserVersion.v17_r74816_native); - else if (DotNetUtils.callsMethod(method, "System.Reflection.Module System.Reflection.Assembly::GetModule(System.String)")) - initVersion(method, ConfuserVersion.v17_r74788_normal, ConfuserVersion.v17_r74788_dynamic, ConfuserVersion.v17_r74788_native); + else if (DotNetUtils.CallsMethod(method, "System.String System.Reflection.Module::get_ScopeName()")) + InitVersion(method, ConfuserVersion.v17_r74816_normal, ConfuserVersion.v17_r74816_dynamic, ConfuserVersion.v17_r74816_native); + else if (DotNetUtils.CallsMethod(method, "System.Reflection.Module System.Reflection.Assembly::GetModule(System.String)")) + InitVersion(method, ConfuserVersion.v17_r74788_normal, ConfuserVersion.v17_r74788_dynamic, ConfuserVersion.v17_r74788_native); else - initVersion(method, ConfuserVersion.v17_r74708_normal, ConfuserVersion.v17_r74708_dynamic, ConfuserVersion.v17_r74708_native); + InitVersion(method, ConfuserVersion.v17_r74708_normal, ConfuserVersion.v17_r74708_dynamic, ConfuserVersion.v17_r74708_native); initMethod = cctor; } - void initVersion(MethodDef method, ConfuserVersion normal, ConfuserVersion dynamic, ConfuserVersion native) { - if (DeobUtils.hasInteger(method, 0x100) && - DeobUtils.hasInteger(method, 0x10000) && - DeobUtils.hasInteger(method, 0xFFFF)) + void InitVersion(MethodDef method, ConfuserVersion normal, ConfuserVersion dynamic, ConfuserVersion native) { + if (DeobUtils.HasInteger(method, 0x100) && + DeobUtils.HasInteger(method, 0x10000) && + DeobUtils.HasInteger(method, 0xFFFF)) version = normal; - else if ((nativeMethod = findNativeMethod(method)) == null) + else if ((nativeMethod = FindNativeMethod(method)) == null) version = dynamic; else version = native; } - MethodDef getDecryptMethod() { + MethodDef GetDecryptMethod() { foreach (var type in module.Types) { if (type.Attributes != (TypeAttributes.Abstract | TypeAttributes.Sealed)) continue; - if (!checkMethods(type.Methods)) + if (!CheckMethods(type.Methods)) continue; foreach (var method in type.Methods) { - if (!DotNetUtils.isMethod(method, "System.Object", "(System.UInt32,System.UInt32)")) + if (!DotNetUtils.IsMethod(method, "System.Object", "(System.UInt32,System.UInt32)")) continue; return method; @@ -291,9 +291,9 @@ namespace de4dot.code.deobfuscators.Confuser { return null; } - protected override byte[] decryptData(DecrypterInfo info2, MethodDef caller, object[] args, out byte typeCode) { + protected override byte[] DecryptData(DecrypterInfo info2, MethodDef caller, object[] args, out byte typeCode) { var info = (DecrypterInfoV17)info2; - uint offs = info.calcHash(info2.decryptMethod.MDToken.ToUInt32() ^ (info2.decryptMethod.DeclaringType.MDToken.ToUInt32() * (uint)args[0])) ^ (uint)args[1]; + uint offs = info.CalcHash(info2.decryptMethod.MDToken.ToUInt32() ^ (info2.decryptMethod.DeclaringType.MDToken.ToUInt32() * (uint)args[0])) ^ (uint)args[1]; reader.Position = offs; typeCode = reader.ReadByte(); if (typeCode != info.int32Type && typeCode != info.int64Type && @@ -302,100 +302,100 @@ namespace de4dot.code.deobfuscators.Confuser { throw new ApplicationException("Invalid type code"); var encrypted = reader.ReadBytes(reader.ReadInt32()); - return decryptConstant(info, encrypted, offs, typeCode); + return DecryptConstant(info, encrypted, offs, typeCode); } - byte[] decryptConstant(DecrypterInfoV17 info, byte[] encrypted, uint offs, byte typeCode) { + byte[] DecryptConstant(DecrypterInfoV17 info, byte[] encrypted, uint offs, byte typeCode) { switch (info.version) { - case ConfuserVersion.v17_r74708_normal: return decryptConstant_v17_r74708_normal(info, encrypted, offs, typeCode); - case ConfuserVersion.v17_r74708_dynamic: return decryptConstant_v17_r74708_dynamic(info, encrypted, offs, typeCode); - case ConfuserVersion.v17_r74708_native: return decryptConstant_v17_r74708_native(info, encrypted, offs, typeCode); - case ConfuserVersion.v17_r74788_normal: return decryptConstant_v17_r74788_normal(info, encrypted, offs, typeCode); - case ConfuserVersion.v17_r74788_dynamic: return decryptConstant_v17_r74788_dynamic(info, encrypted, offs, typeCode); - case ConfuserVersion.v17_r74788_native: return decryptConstant_v17_r74788_native(info, encrypted, offs, typeCode); - case ConfuserVersion.v17_r74816_normal: return decryptConstant_v17_r74788_normal(info, encrypted, offs, typeCode); - case ConfuserVersion.v17_r74816_dynamic: return decryptConstant_v17_r74788_dynamic(info, encrypted, offs, typeCode); - case ConfuserVersion.v17_r74816_native: return decryptConstant_v17_r74788_native(info, encrypted, offs, typeCode); - case ConfuserVersion.v17_r75056_normal: return decryptConstant_v17_r74788_normal(info, encrypted, offs, typeCode); - case ConfuserVersion.v17_r75056_dynamic: return decryptConstant_v17_r74788_dynamic(info, encrypted, offs, typeCode); - case ConfuserVersion.v17_r75056_native: return decryptConstant_v17_r74788_native(info, encrypted, offs, typeCode); - case ConfuserVersion.v18_r75257_normal: return decryptConstant_v17_r74788_normal(info, encrypted, offs, typeCode); - case ConfuserVersion.v18_r75257_dynamic: return decryptConstant_v17_r74788_dynamic(info, encrypted, offs, typeCode); - case ConfuserVersion.v18_r75257_native: return decryptConstant_v17_r74788_native(info, encrypted, offs, typeCode); + case ConfuserVersion.v17_r74708_normal: return DecryptConstant_v17_r74708_normal(info, encrypted, offs, typeCode); + case ConfuserVersion.v17_r74708_dynamic: return DecryptConstant_v17_r74708_dynamic(info, encrypted, offs, typeCode); + case ConfuserVersion.v17_r74708_native: return DecryptConstant_v17_r74708_native(info, encrypted, offs, typeCode); + case ConfuserVersion.v17_r74788_normal: return DecryptConstant_v17_r74788_normal(info, encrypted, offs, typeCode); + case ConfuserVersion.v17_r74788_dynamic: return DecryptConstant_v17_r74788_dynamic(info, encrypted, offs, typeCode); + case ConfuserVersion.v17_r74788_native: return DecryptConstant_v17_r74788_native(info, encrypted, offs, typeCode); + case ConfuserVersion.v17_r74816_normal: return DecryptConstant_v17_r74788_normal(info, encrypted, offs, typeCode); + case ConfuserVersion.v17_r74816_dynamic: return DecryptConstant_v17_r74788_dynamic(info, encrypted, offs, typeCode); + case ConfuserVersion.v17_r74816_native: return DecryptConstant_v17_r74788_native(info, encrypted, offs, typeCode); + case ConfuserVersion.v17_r75056_normal: return DecryptConstant_v17_r74788_normal(info, encrypted, offs, typeCode); + case ConfuserVersion.v17_r75056_dynamic: return DecryptConstant_v17_r74788_dynamic(info, encrypted, offs, typeCode); + case ConfuserVersion.v17_r75056_native: return DecryptConstant_v17_r74788_native(info, encrypted, offs, typeCode); + case ConfuserVersion.v18_r75257_normal: return DecryptConstant_v17_r74788_normal(info, encrypted, offs, typeCode); + case ConfuserVersion.v18_r75257_dynamic: return DecryptConstant_v17_r74788_dynamic(info, encrypted, offs, typeCode); + case ConfuserVersion.v18_r75257_native: return DecryptConstant_v17_r74788_native(info, encrypted, offs, typeCode); default: throw new ApplicationException("Invalid version"); } } - byte[] decryptConstant_v17_r74708_normal(DecrypterInfoV17 info, byte[] encrypted, uint offs, byte typeCode) { - return ConfuserUtils.decrypt(info.key4 * (offs + typeCode), encrypted); + byte[] DecryptConstant_v17_r74708_normal(DecrypterInfoV17 info, byte[] encrypted, uint offs, byte typeCode) { + return ConfuserUtils.Decrypt(info.key4 * (offs + typeCode), encrypted); } - byte[] decryptConstant_v17_r74708_dynamic(DecrypterInfoV17 info, byte[] encrypted, uint offs, byte typeCode) { - return decryptConstant_v17_r73740_dynamic(info, encrypted, offs, info.key4); + byte[] DecryptConstant_v17_r74708_dynamic(DecrypterInfoV17 info, byte[] encrypted, uint offs, byte typeCode) { + return DecryptConstant_v17_r73740_dynamic(info, encrypted, offs, info.key4); } - byte[] decryptConstant_v17_r74708_native(DecrypterInfoV17 info, byte[] encrypted, uint offs, byte typeCode) { - return decryptConstant_v17_r73764_native(info, encrypted, offs, info.key4); + byte[] DecryptConstant_v17_r74708_native(DecrypterInfoV17 info, byte[] encrypted, uint offs, byte typeCode) { + return DecryptConstant_v17_r73764_native(info, encrypted, offs, info.key4); } - byte[] decryptConstant_v17_r74788_normal(DecrypterInfoV17 info, byte[] encrypted, uint offs, byte typeCode) { - return ConfuserUtils.decrypt(info.key4 * (offs + typeCode), encrypted, getKey_v17_r74788(info)); + byte[] DecryptConstant_v17_r74788_normal(DecrypterInfoV17 info, byte[] encrypted, uint offs, byte typeCode) { + return ConfuserUtils.Decrypt(info.key4 * (offs + typeCode), encrypted, GetKey_v17_r74788(info)); } - byte[] decryptConstant_v17_r74788_dynamic(DecrypterInfoV17 info, byte[] encrypted, uint offs, byte typeCode) { - return decryptConstant_v17_r73740_dynamic(info, encrypted, offs, info.key4, getKey_v17_r74788(info)); + byte[] DecryptConstant_v17_r74788_dynamic(DecrypterInfoV17 info, byte[] encrypted, uint offs, byte typeCode) { + return DecryptConstant_v17_r73740_dynamic(info, encrypted, offs, info.key4, GetKey_v17_r74788(info)); } - byte[] decryptConstant_v17_r74788_native(DecrypterInfoV17 info, byte[] encrypted, uint offs, byte typeCode) { - return decryptConstant_v17_r73764_native(info, encrypted, offs, info.key4, getKey_v17_r74788(info)); + byte[] DecryptConstant_v17_r74788_native(DecrypterInfoV17 info, byte[] encrypted, uint offs, byte typeCode) { + return DecryptConstant_v17_r73764_native(info, encrypted, offs, info.key4, GetKey_v17_r74788(info)); } - byte[] getKey_v17_r74788(DecrypterInfoV17 info) { + byte[] GetKey_v17_r74788(DecrypterInfoV17 info) { var key = module.ReadBlob(info.decryptMethod.MDToken.ToUInt32() ^ info.key5); if (key.Length != keyArraySize) throw new ApplicationException("Invalid key size"); return key; } - public override void initialize() { + public override void Initialize() { if (resourceName != null) - resource = DotNetUtils.getResource(module, resourceName) as EmbeddedResource; + resource = DotNetUtils.GetResource(module, resourceName) as EmbeddedResource; else - resource = findResource(initMethod); + resource = FindResource(initMethod); if (resource == null) throw new ApplicationException("Could not find encrypted consts resource"); - findDecrypterInfos(); - initializeDecrypterInfos(); + FindDecrypterInfos(); + InitializeDecrypterInfos(); - setConstantsData(DeobUtils.inflate(resource.GetResourceData(), true)); + SetConstantsData(DeobUtils.Inflate(resource.GetResourceData(), true)); } - void findDecrypterInfos() { + void FindDecrypterInfos() { foreach (var type in module.Types) { if (type.Attributes != (TypeAttributes.Abstract | TypeAttributes.Sealed)) continue; - if (!checkMethods(type.Methods)) + if (!CheckMethods(type.Methods)) continue; foreach (var method in type.Methods) { - if (!DotNetUtils.isMethod(method, "System.Object", "(System.UInt32,System.UInt32)")) + if (!DotNetUtils.IsMethod(method, "System.Object", "(System.UInt32,System.UInt32)")) continue; var info = new DecrypterInfoV17(version, method); - add(info); + Add(info); } } } - static bool checkMethods(IEnumerable methods) { + static bool CheckMethods(IEnumerable methods) { int numMethods = 0; foreach (var method in methods) { if (method.Name == ".ctor" || method.Name == ".cctor") return false; if (method.Attributes != (MethodAttributes.Static | MethodAttributes.HideBySig | MethodAttributes.CompilerControlled)) return false; - if (!DotNetUtils.isMethod(method, "System.Object", "(System.UInt32,System.UInt32)")) + if (!DotNetUtils.IsMethod(method, "System.Object", "(System.UInt32,System.UInt32)")) return false; numMethods++; @@ -403,10 +403,10 @@ namespace de4dot.code.deobfuscators.Confuser { return numMethods > 0; } - static string getResourceName(MethodDef method) { + static string GetResourceName(MethodDef method) { var instrs = method.Body.Instructions; for (int i = 0; i < instrs.Count; i++) { - i = ConfuserUtils.findCallMethod(instrs, i, Code.Call, "System.Byte[] System.BitConverter::GetBytes(System.Int32)"); + i = ConfuserUtils.FindCallMethod(instrs, i, Code.Call, "System.Byte[] System.BitConverter::GetBytes(System.Int32)"); if (i < 0) break; if (i == 0) @@ -419,7 +419,7 @@ namespace de4dot.code.deobfuscators.Confuser { return null; } - static int getKeyArraySize(MethodDef method) { + static int GetKeyArraySize(MethodDef method) { var instrs = method.Body.Instructions; for (int i = 0; i < instrs.Count - 4; i++) { if (!instrs[i].IsLdloc()) @@ -439,7 +439,7 @@ namespace de4dot.code.deobfuscators.Confuser { return -1; } - public override bool getRevisionRange(out int minRev, out int maxRev) { + public override bool GetRevisionRange(out int minRev, out int maxRev) { switch (version) { case ConfuserVersion.Unknown: minRev = maxRev = 0; diff --git a/de4dot.code/deobfuscators/Confuser/ConstantsDecrypterV18.cs b/de4dot.code/deobfuscators/Confuser/ConstantsDecrypterV18.cs index fe12a394..ccd6a61d 100644 --- a/de4dot.code/deobfuscators/Confuser/ConstantsDecrypterV18.cs +++ b/de4dot.code/deobfuscators/Confuser/ConstantsDecrypterV18.cs @@ -65,28 +65,28 @@ namespace de4dot.code.deobfuscators.Confuser { this.version = version; } - public string decryptString(uint magic1, ulong magic2) { - return Encoding.UTF8.GetString(decrypt(magic1, magic2)); + public string DecryptString(uint magic1, ulong magic2) { + return Encoding.UTF8.GetString(Decrypt(magic1, magic2)); } - public int decryptInt32(uint magic1, ulong magic2) { - return BitConverter.ToInt32(decrypt(magic1, magic2), 0); + public int DecryptInt32(uint magic1, ulong magic2) { + return BitConverter.ToInt32(Decrypt(magic1, magic2), 0); } - public long decryptInt64(uint magic1, ulong magic2) { - return BitConverter.ToInt64(decrypt(magic1, magic2), 0); + public long DecryptInt64(uint magic1, ulong magic2) { + return BitConverter.ToInt64(Decrypt(magic1, magic2), 0); } - public float decryptSingle(uint magic1, ulong magic2) { - return BitConverter.ToSingle(decrypt(magic1, magic2), 0); + public float DecryptSingle(uint magic1, ulong magic2) { + return BitConverter.ToSingle(Decrypt(magic1, magic2), 0); } - public double decryptDouble(uint magic1, ulong magic2) { - return BitConverter.ToDouble(decrypt(magic1, magic2), 0); + public double DecryptDouble(uint magic1, ulong magic2) { + return BitConverter.ToDouble(Decrypt(magic1, magic2), 0); } - byte[] decrypt(uint magic1, ulong magic2) { - ulong info = hash(method.DeclaringType.MDToken.ToUInt32() * magic1) ^ magic2; + byte[] Decrypt(uint magic1, ulong magic2) { + ulong info = Hash(method.DeclaringType.MDToken.ToUInt32() * magic1) ^ magic2; int offset = (int)(info >> 32); int len = (int)info; var decrypted = new byte[len]; @@ -96,22 +96,22 @@ namespace de4dot.code.deobfuscators.Confuser { return decrypted; } - ulong hash(uint magic) { + ulong Hash(uint magic) { switch (version) { case ConfuserVersion.v18_r75367_normal: case ConfuserVersion.v18_r75367_dynamic: case ConfuserVersion.v18_r75367_native: - return hash1(key0l ^ magic); + return Hash1(key0l ^ magic); case ConfuserVersion.v18_r75369_normal: case ConfuserVersion.v18_r75369_dynamic: case ConfuserVersion.v18_r75369_native: - return hash1(key0l * magic); + return Hash1(key0l * magic); default: throw new ApplicationException("Invalid version"); } } - ulong hash1(ulong h0) { + ulong Hash1(ulong h0) { ulong h1 = key1l; ulong h2 = key2l; h1 *= h0; @@ -132,7 +132,7 @@ namespace de4dot.code.deobfuscators.Confuser { public IEnumerable Types { get { var types = new List(); - foreach (var info in decrypters.getValues()) + foreach (var info in decrypters.GetValues()) types.Add(info.method.DeclaringType); return types; } @@ -156,7 +156,7 @@ namespace de4dot.code.deobfuscators.Confuser { } public IEnumerable Decrypters { - get { return decrypters.getValues(); } + get { return decrypters.GetValues(); } } public bool Detected { @@ -169,78 +169,78 @@ namespace de4dot.code.deobfuscators.Confuser { this.simpleDeobfuscator = simpleDeobfuscator; } - public void find() { - var cctor = DotNetUtils.getModuleTypeCctor(module); + public void Find() { + var cctor = DotNetUtils.GetModuleTypeCctor(module); if (cctor == null) return; - simpleDeobfuscator.deobfuscate(cctor, true); + simpleDeobfuscator.Deobfuscate(cctor, true); - if ((dictField = ConstantsDecrypterUtils.findDictField(cctor, cctor.DeclaringType)) == null) + if ((dictField = ConstantsDecrypterUtils.FindDictField(cctor, cctor.DeclaringType)) == null) return; - if ((dataField = ConstantsDecrypterUtils.findDataField(cctor, cctor.DeclaringType)) == null) + if ((dataField = ConstantsDecrypterUtils.FindDataField(cctor, cctor.DeclaringType)) == null) return; - nativeMethod = findNativeMethod(cctor, cctor.DeclaringType); + nativeMethod = FindNativeMethod(cctor, cctor.DeclaringType); - var method = getDecryptMethod(); + var method = GetDecryptMethod(); if (method == null) return; - simpleDeobfuscator.deobfuscate(method); + simpleDeobfuscator.Deobfuscate(method); var info = new DecrypterInfo(this, method, ConfuserVersion.Unknown); - if (findKeys_v18_r75367(info)) - initVersion(cctor, ConfuserVersion.v18_r75367_normal, ConfuserVersion.v18_r75367_dynamic, ConfuserVersion.v18_r75367_native); - else if (findKeys_v18_r75369(info)) - initVersion(cctor, ConfuserVersion.v18_r75369_normal, ConfuserVersion.v18_r75369_dynamic, ConfuserVersion.v18_r75369_native); + if (FindKeys_v18_r75367(info)) + InitVersion(cctor, ConfuserVersion.v18_r75367_normal, ConfuserVersion.v18_r75367_dynamic, ConfuserVersion.v18_r75367_native); + else if (FindKeys_v18_r75369(info)) + InitVersion(cctor, ConfuserVersion.v18_r75369_normal, ConfuserVersion.v18_r75369_dynamic, ConfuserVersion.v18_r75369_native); else return; installMethod = cctor; } - void initVersion(MethodDef installMethod, ConfuserVersion normal, ConfuserVersion dynamic, ConfuserVersion native) { + void InitVersion(MethodDef installMethod, ConfuserVersion normal, ConfuserVersion dynamic, ConfuserVersion native) { if (nativeMethod != null) version = native; - else if (DeobUtils.hasInteger(installMethod, 0x10000)) + else if (DeobUtils.HasInteger(installMethod, 0x10000)) version = normal; else version = dynamic; } - public void initialize() { + public void Initialize() { if (installMethod == null) return; - if (!findKeys()) + if (!FindKeys()) throw new ApplicationException("Could not find keys"); - if ((resource = findResource(key0)) == null) + if ((resource = FindResource(key0)) == null) throw new ApplicationException("Could not find resource"); - constants = decryptResource(resource.GetResourceData()); + constants = DecryptResource(resource.GetResourceData()); - findDecrypters(); + FindDecrypters(); } - EmbeddedResource findResource(uint magic) { + EmbeddedResource FindResource(uint magic) { var name = Encoding.UTF8.GetString(BitConverter.GetBytes(magic)); - return DotNetUtils.getResource(module, name) as EmbeddedResource; + return DotNetUtils.GetResource(module, name) as EmbeddedResource; } - bool findKeys() { - if (!findKey0(installMethod, out key0)) + bool FindKeys() { + if (!FindKey0(installMethod, out key0)) return false; - if (!findKey0d(installMethod, out key0d)) + if (!FindKey0d(installMethod, out key0d)) return false; return true; } - static bool findKey0(MethodDef method, out uint key) { + static bool FindKey0(MethodDef method, out uint key) { var instrs = method.Body.Instructions; for (int i = 0; i < instrs.Count; i++) { - int index = ConfuserUtils.findCallMethod(instrs, i, Code.Call, "System.Text.Encoding System.Text.Encoding::get_UTF8()"); + int index = ConfuserUtils.FindCallMethod(instrs, i, Code.Call, "System.Text.Encoding System.Text.Encoding::get_UTF8()"); if (index < 0) break; - int index2 = ConfuserUtils.findCallMethod(instrs, i, Code.Call, "System.Byte[] System.BitConverter::GetBytes(System.Int32)"); + int index2 = ConfuserUtils.FindCallMethod(instrs, i, Code.Call, "System.Byte[] System.BitConverter::GetBytes(System.Int32)"); if (index2 - index != 2) continue; var ldci4 = instrs[index + 1]; @@ -255,13 +255,13 @@ namespace de4dot.code.deobfuscators.Confuser { return false; } - static bool findKey0d(MethodDef method, out uint key) { + static bool FindKey0d(MethodDef method, out uint key) { var instrs = method.Body.Instructions; for (int i = 0; i < instrs.Count; i++) { - int index = ConfuserUtils.findCallMethod(instrs, i, Code.Callvirt, "System.Reflection.Module System.Reflection.MemberInfo::get_Module()"); + int index = ConfuserUtils.FindCallMethod(instrs, i, Code.Callvirt, "System.Reflection.Module System.Reflection.MemberInfo::get_Module()"); if (index < 0) break; - int index2 = ConfuserUtils.findCallMethod(instrs, i, Code.Callvirt, "System.Int32 System.Reflection.MemberInfo::get_MetadataToken()"); + int index2 = ConfuserUtils.FindCallMethod(instrs, i, Code.Callvirt, "System.Int32 System.Reflection.MemberInfo::get_MetadataToken()"); if (index2 - index != 3) continue; var ldci4 = instrs[index + 1]; @@ -278,7 +278,7 @@ namespace de4dot.code.deobfuscators.Confuser { return false; } - static MethodDef findNativeMethod(MethodDef method, TypeDef declaringType) { + static MethodDef FindNativeMethod(MethodDef method, TypeDef declaringType) { var instrs = method.Body.Instructions; for (int i = 0; i < instrs.Count; i++) { if (!instrs[i].IsLdloc()) @@ -289,7 +289,7 @@ namespace de4dot.code.deobfuscators.Confuser { var calledMethod = call.Operand as MethodDef; if (calledMethod == null || !calledMethod.IsStatic || !calledMethod.IsNative) continue; - if (!DotNetUtils.isMethod(calledMethod, "System.Int32", "(System.Int32)")) + if (!DotNetUtils.IsMethod(calledMethod, "System.Int32", "(System.Int32)")) continue; return calledMethod; @@ -297,26 +297,26 @@ namespace de4dot.code.deobfuscators.Confuser { return null; } - MethodDef getDecryptMethod() { + MethodDef GetDecryptMethod() { foreach (var type in module.Types) { if (type.Attributes != (TypeAttributes.Abstract | TypeAttributes.Sealed)) continue; - if (!checkMethods(type.Methods)) + if (!CheckMethods(type.Methods)) continue; foreach (var method in type.Methods) { - if (isDecryptMethodSignature(method)) + if (IsDecryptMethodSignature(method)) return method; } } return null; } - static bool checkMethods(IEnumerable methods) { + static bool CheckMethods(IEnumerable methods) { int numMethods = 0; foreach (var method in methods) { if (method.Name == ".ctor" || method.Name == ".cctor") return false; - if (!isDecryptMethodSignature(method)) + if (!IsDecryptMethodSignature(method)) return false; numMethods++; @@ -324,7 +324,7 @@ namespace de4dot.code.deobfuscators.Confuser { return numMethods > 0; } - static bool isDecryptMethodSignature(MethodDef method) { + static bool IsDecryptMethodSignature(MethodDef method) { if (method == null || method.Body == null) return false; if (method.Attributes != (MethodAttributes.Static | MethodAttributes.HideBySig | MethodAttributes.CompilerControlled)) @@ -345,68 +345,68 @@ namespace de4dot.code.deobfuscators.Confuser { return true; } - void findDecrypters() { + void FindDecrypters() { foreach (var type in module.Types) { if (type.Attributes != (TypeAttributes.Abstract | TypeAttributes.Sealed)) continue; - if (!checkMethods(type.Methods)) + if (!CheckMethods(type.Methods)) continue; foreach (var method in type.Methods) { - var info = createDecrypterInfo(method); + var info = CreateDecrypterInfo(method); if (info != null) - decrypters.add(info.method, info); + decrypters.Add(info.method, info); } } } - DecrypterInfo createDecrypterInfo(MethodDef method) { - if (!isDecryptMethodSignature(method)) + DecrypterInfo CreateDecrypterInfo(MethodDef method) { + if (!IsDecryptMethodSignature(method)) return null; - simpleDeobfuscator.deobfuscate(method); + simpleDeobfuscator.Deobfuscate(method); var info = new DecrypterInfo(this, method, version); - if (!findKeys(info)) + if (!FindKeys(info)) return null; return info; } - bool findKeys(DecrypterInfo info) { + bool FindKeys(DecrypterInfo info) { switch (version) { case ConfuserVersion.v18_r75367_normal: case ConfuserVersion.v18_r75367_dynamic: case ConfuserVersion.v18_r75367_native: - return findKeys_v18_r75367(info); + return FindKeys_v18_r75367(info); case ConfuserVersion.v18_r75369_normal: case ConfuserVersion.v18_r75369_dynamic: case ConfuserVersion.v18_r75369_native: - return findKeys_v18_r75369(info); + return FindKeys_v18_r75369(info); default: throw new ApplicationException("Invalid version"); } } - static bool findKeys_v18_r75367(DecrypterInfo info) { - if (!findLKeys_v18_r75367(info)) + static bool FindKeys_v18_r75367(DecrypterInfo info) { + if (!FindLKeys_v18_r75367(info)) return false; - if (!findKey0_v18_r75367(info)) + if (!FindKey0_v18_r75367(info)) return false; - if (!findKey0d_v18_r75367(info)) + if (!FindKey0d_v18_r75367(info)) return false; return true; } - static bool findKeys_v18_r75369(DecrypterInfo info) { - if (!findLKeys_v18_r75369(info)) + static bool FindKeys_v18_r75369(DecrypterInfo info) { + if (!FindLKeys_v18_r75369(info)) return false; - if (!findKey0_v18_r75369(info)) + if (!FindKey0_v18_r75369(info)) return false; - if (!findKey0d_v18_r75367(info)) + if (!FindKey0d_v18_r75367(info)) return false; return true; } - static bool findLKeys_v18_r75367(DecrypterInfo info) { + static bool FindLKeys_v18_r75367(DecrypterInfo info) { var instrs = info.method.Body.Instructions; for (int i = 0; i < instrs.Count - 10; i++) { var ldci4_1 = instrs[i]; @@ -443,7 +443,7 @@ namespace de4dot.code.deobfuscators.Confuser { return false; } - static bool findKey0_v18_r75367(DecrypterInfo info) { + static bool FindKey0_v18_r75367(DecrypterInfo info) { var instrs = info.method.Body.Instructions; for (int i = 0; i < instrs.Count - 4; i++) { if (instrs[i].OpCode.Code != Code.Xor) @@ -464,13 +464,13 @@ namespace de4dot.code.deobfuscators.Confuser { return false; } - static bool findKey0d_v18_r75367(DecrypterInfo info) { + static bool FindKey0d_v18_r75367(DecrypterInfo info) { var instrs = info.method.Body.Instructions; for (int i = 0; i < instrs.Count; i++) { - int index = ConfuserUtils.findCallMethod(instrs, i, Code.Callvirt, "System.Int32 System.Reflection.MemberInfo::get_MetadataToken()"); + int index = ConfuserUtils.FindCallMethod(instrs, i, Code.Callvirt, "System.Int32 System.Reflection.MemberInfo::get_MetadataToken()"); if (index < 0) break; - int index2 = ConfuserUtils.findCallMethod(instrs, index, Code.Call, "System.Byte[] System.BitConverter::GetBytes(System.Int32)"); + int index2 = ConfuserUtils.FindCallMethod(instrs, index, Code.Call, "System.Byte[] System.BitConverter::GetBytes(System.Int32)"); if (index2 < 0) break; if (index2 - index != 3) @@ -487,7 +487,7 @@ namespace de4dot.code.deobfuscators.Confuser { return false; } - static bool findLKeys_v18_r75369(DecrypterInfo info) { + static bool FindLKeys_v18_r75369(DecrypterInfo info) { var instrs = info.method.Body.Instructions; for (int i = 0; i < instrs.Count - 8; i++) { var ldci8_1 = instrs[i]; @@ -520,7 +520,7 @@ namespace de4dot.code.deobfuscators.Confuser { return false; } - static bool findKey0_v18_r75369(DecrypterInfo info) { + static bool FindKey0_v18_r75369(DecrypterInfo info) { var instrs = info.method.Body.Instructions; for (int i = 0; i < instrs.Count - 4; i++) { if (!instrs[i].IsLdloc()) @@ -541,36 +541,36 @@ namespace de4dot.code.deobfuscators.Confuser { return false; } - byte[] decryptResource(byte[] encrypted) { + byte[] DecryptResource(byte[] encrypted) { switch (version) { case ConfuserVersion.v18_r75367_normal: case ConfuserVersion.v18_r75369_normal: - return decryptResource_v18_r75367_normal(encrypted); + return DecryptResource_v18_r75367_normal(encrypted); case ConfuserVersion.v18_r75367_dynamic: case ConfuserVersion.v18_r75369_dynamic: - return decryptResource_v18_r75367_dynamic(encrypted); + return DecryptResource_v18_r75367_dynamic(encrypted); case ConfuserVersion.v18_r75367_native: case ConfuserVersion.v18_r75369_native: - return decryptResource_v18_r75367_native(encrypted); + return DecryptResource_v18_r75367_native(encrypted); default: throw new ApplicationException("Unknown version"); } } - byte[] getSigKey() { + byte[] GetSigKey() { return module.ReadBlob(key0d ^ installMethod.MDToken.ToUInt32()); } - byte[] decryptResource_v18_r75367_normal(byte[] encrypted) { - var key = getSigKey(); - var decrypted = ConfuserUtils.decrypt(BitConverter.ToUInt32(key, 12) * (uint)key0, encrypted); - return DeobUtils.inflate(DeobUtils.aesDecrypt(decrypted, key, DeobUtils.md5Sum(key)), true); + byte[] DecryptResource_v18_r75367_normal(byte[] encrypted) { + var key = GetSigKey(); + var decrypted = ConfuserUtils.Decrypt(BitConverter.ToUInt32(key, 12) * (uint)key0, encrypted); + return DeobUtils.Inflate(DeobUtils.AesDecrypt(decrypted, key, DeobUtils.Md5Sum(key)), true); } - static int getDynamicStartIndex(IList instrs, int ldlocIndex) { + static int GetDynamicStartIndex(IList instrs, int ldlocIndex) { for (int i = ldlocIndex - 1; i >= 0; i--) { if (instrs[i].OpCode.FlowControl != FlowControl.Next) return i + 1; @@ -578,7 +578,7 @@ namespace de4dot.code.deobfuscators.Confuser { return 0; } - int getDynamicEndIndex(int startIndex, Local local) { + int GetDynamicEndIndex(int startIndex, Local local) { if (startIndex < 0) return -1; var instrs = installMethod.Body.Instructions; @@ -590,10 +590,10 @@ namespace de4dot.code.deobfuscators.Confuser { return -1; } - Local getDynamicLocal(out int instrIndex) { + Local GetDynamicLocal(out int instrIndex) { var instrs = installMethod.Body.Instructions; for (int i = 0; i < instrs.Count; i++) { - i = ConfuserUtils.findCallMethod(instrs, i, Code.Callvirt, "System.Void System.IO.BinaryWriter::Write(System.Byte)"); + i = ConfuserUtils.FindCallMethod(instrs, i, Code.Callvirt, "System.Void System.IO.BinaryWriter::Write(System.Byte)"); if (i < 0) break; int index = i - 2; @@ -612,24 +612,24 @@ namespace de4dot.code.deobfuscators.Confuser { return null; } - byte[] decryptResource_v18_r75367_dynamic(byte[] encrypted) { + byte[] DecryptResource_v18_r75367_dynamic(byte[] encrypted) { int ldlocIndex; - var local = getDynamicLocal(out ldlocIndex); + var local = GetDynamicLocal(out ldlocIndex); if (local == null) throw new ApplicationException("Could not find local"); var instrs = installMethod.Body.Instructions; - int startIndex = getDynamicStartIndex(instrs, ldlocIndex); - int endIndex = getDynamicEndIndex(startIndex, local); + int startIndex = GetDynamicStartIndex(instrs, ldlocIndex); + int endIndex = GetDynamicEndIndex(startIndex, local); if (endIndex < 0) throw new ApplicationException("Could not find endIndex"); var constReader = new ConstantsReader(installMethod); - return decryptResource(encrypted, magic => { - constReader.setConstantInt32(local, magic); + return DecryptResource(encrypted, magic => { + constReader.SetConstantInt32(local, magic); int index = startIndex, result; - if (!constReader.getNextInt32(ref index, out result)) + if (!constReader.GetNextInt32(ref index, out result)) throw new ApplicationException("Could not get constant"); if (index != endIndex) throw new ApplicationException("Wrong constant"); @@ -637,16 +637,16 @@ namespace de4dot.code.deobfuscators.Confuser { }); } - byte[] decryptResource_v18_r75367_native(byte[] encrypted) { + byte[] DecryptResource_v18_r75367_native(byte[] encrypted) { using (var x86Emu = new x86Emulator(fileData)) - return decryptResource(encrypted, magic => (byte)x86Emu.emulate((uint)nativeMethod.RVA, magic)); + return DecryptResource(encrypted, magic => (byte)x86Emu.Emulate((uint)nativeMethod.RVA, magic)); } - byte[] decryptResource(byte[] encrypted, Func decryptFunc) { - var key = getSigKey(); + byte[] DecryptResource(byte[] encrypted, Func decryptFunc) { + var key = GetSigKey(); - var decrypted = DeobUtils.aesDecrypt(encrypted, key, DeobUtils.md5Sum(key)); - decrypted = DeobUtils.inflate(decrypted, true); + var decrypted = DeobUtils.AesDecrypt(encrypted, key, DeobUtils.Md5Sum(key)); + decrypted = DeobUtils.Inflate(decrypted, true); var reader = MemoryImageStream.Create(decrypted); var result = new MemoryStream(); @@ -659,7 +659,7 @@ namespace de4dot.code.deobfuscators.Confuser { return result.ToArray(); } - static bool verifyGenericArg(MethodSpec gim, ElementType etype) { + static bool VerifyGenericArg(MethodSpec gim, ElementType etype) { if (gim == null) return false; var gims = gim.GenericInstMethodSig; @@ -668,42 +668,42 @@ namespace de4dot.code.deobfuscators.Confuser { return gims.GenericArguments[0].GetElementType() == etype; } - public string decryptString(MethodDef method, MethodSpec gim, uint magic1, ulong magic2) { - if (!verifyGenericArg(gim, ElementType.String)) + public string DecryptString(MethodDef method, MethodSpec gim, uint magic1, ulong magic2) { + if (!VerifyGenericArg(gim, ElementType.String)) return null; - var info = decrypters.find(method); - return info.decryptString(magic1, magic2); + var info = decrypters.Find(method); + return info.DecryptString(magic1, magic2); } - public object decryptInt32(MethodDef method, MethodSpec gim, uint magic1, ulong magic2) { - if (!verifyGenericArg(gim, ElementType.I4)) + public object DecryptInt32(MethodDef method, MethodSpec gim, uint magic1, ulong magic2) { + if (!VerifyGenericArg(gim, ElementType.I4)) return null; - var info = decrypters.find(method); - return info.decryptInt32(magic1, magic2); + var info = decrypters.Find(method); + return info.DecryptInt32(magic1, magic2); } - public object decryptInt64(MethodDef method, MethodSpec gim, uint magic1, ulong magic2) { - if (!verifyGenericArg(gim, ElementType.I8)) + public object DecryptInt64(MethodDef method, MethodSpec gim, uint magic1, ulong magic2) { + if (!VerifyGenericArg(gim, ElementType.I8)) return null; - var info = decrypters.find(method); - return info.decryptInt64(magic1, magic2); + var info = decrypters.Find(method); + return info.DecryptInt64(magic1, magic2); } - public object decryptSingle(MethodDef method, MethodSpec gim, uint magic1, ulong magic2) { - if (!verifyGenericArg(gim, ElementType.R4)) + public object DecryptSingle(MethodDef method, MethodSpec gim, uint magic1, ulong magic2) { + if (!VerifyGenericArg(gim, ElementType.R4)) return null; - var info = decrypters.find(method); - return info.decryptSingle(magic1, magic2); + var info = decrypters.Find(method); + return info.DecryptSingle(magic1, magic2); } - public object decryptDouble(MethodDef method, MethodSpec gim, uint magic1, ulong magic2) { - if (!verifyGenericArg(gim, ElementType.R8)) + public object DecryptDouble(MethodDef method, MethodSpec gim, uint magic1, ulong magic2) { + if (!VerifyGenericArg(gim, ElementType.R8)) return null; - var info = decrypters.find(method); - return info.decryptDouble(magic1, magic2); + var info = decrypters.Find(method); + return info.DecryptDouble(magic1, magic2); } - public void cleanUp() { + public void CleanUp() { if (installMethod == null) return; @@ -712,7 +712,7 @@ namespace de4dot.code.deobfuscators.Confuser { installMethod.Body.Instructions.Add(Instruction.Create(OpCodes.Ret)); } - public bool getRevisionRange(out int minRev, out int maxRev) { + public bool GetRevisionRange(out int minRev, out int maxRev) { switch (version) { case ConfuserVersion.Unknown: minRev = maxRev = 0; diff --git a/de4dot.code/deobfuscators/Confuser/ConstantsFolder.cs b/de4dot.code/deobfuscators/Confuser/ConstantsFolder.cs index 851d27aa..74564bad 100644 --- a/de4dot.code/deobfuscators/Confuser/ConstantsFolder.cs +++ b/de4dot.code/deobfuscators/Confuser/ConstantsFolder.cs @@ -24,42 +24,42 @@ using de4dot.blocks.cflow; namespace de4dot.code.deobfuscators.Confuser { class ConstantsFolder : BlockDeobfuscator { - protected override bool deobfuscate(Block block) { + protected override bool Deobfuscate(Block block) { bool modified = false; var instrs = block.Instructions; - var constantsReader = createConstantsReader(instrs); + var constantsReader = CreateConstantsReader(instrs); for (int i = 0; i < instrs.Count; i++) { int index = 0; Instruction newInstr = null; var instr = instrs[i]; - if (constantsReader.isLoadConstantInt32(instr.Instruction)) { + if (constantsReader.IsLoadConstantInt32(instr.Instruction)) { index = i; int val; - if (!constantsReader.getInt32(ref index, out val)) + if (!constantsReader.GetInt32(ref index, out val)) continue; newInstr = Instruction.CreateLdcI4(val); } - else if (constantsReader.isLoadConstantInt64(instr.Instruction)) { + else if (constantsReader.IsLoadConstantInt64(instr.Instruction)) { index = i; long val; - if (!constantsReader.getInt64(ref index, out val)) + if (!constantsReader.GetInt64(ref index, out val)) continue; newInstr = Instruction.Create(OpCodes.Ldc_I8, val); } - else if (constantsReader.isLoadConstantDouble(instr.Instruction)) { + else if (constantsReader.IsLoadConstantDouble(instr.Instruction)) { index = i; double val; - if (!constantsReader.getDouble(ref index, out val)) + if (!constantsReader.GetDouble(ref index, out val)) continue; newInstr = Instruction.Create(OpCodes.Ldc_R8, val); } if (newInstr != null && index - i > 1) { - block.insert(index++, Instruction.Create(OpCodes.Pop)); - block.insert(index++, newInstr); + block.Insert(index++, Instruction.Create(OpCodes.Pop)); + block.Insert(index++, newInstr); i = index - 1; - constantsReader = createConstantsReader(instrs); + constantsReader = CreateConstantsReader(instrs); modified = true; continue; } @@ -101,8 +101,8 @@ namespace de4dot.code.deobfuscators.Confuser { break; } if (newInstr != null) { - block.replace(i, 2, newInstr); - constantsReader = createConstantsReader(instrs); + block.Replace(i, 2, newInstr); + constantsReader = CreateConstantsReader(instrs); modified = true; continue; } @@ -112,7 +112,7 @@ namespace de4dot.code.deobfuscators.Confuser { return modified; } - static ConstantsReader createConstantsReader(IList instrs) { + static ConstantsReader CreateConstantsReader(IList instrs) { return new ConstantsReader(instrs, false); } } diff --git a/de4dot.code/deobfuscators/Confuser/ConstantsInliner.cs b/de4dot.code/deobfuscators/Confuser/ConstantsInliner.cs index 33c27155..c061de35 100644 --- a/de4dot.code/deobfuscators/Confuser/ConstantsInliner.cs +++ b/de4dot.code/deobfuscators/Confuser/ConstantsInliner.cs @@ -38,17 +38,17 @@ namespace de4dot.code.deobfuscators.Confuser { this.doubleValueInliner = doubleValueInliner; } - public void deobfuscateBegin(Blocks blocks) { + public void DeobfuscateBegin(Blocks blocks) { this.blocks = blocks; } - public bool deobfuscate(List allBlocks) { + public bool Deobfuscate(List allBlocks) { bool modified = false; foreach (var block in allBlocks) { - modified |= int32ValueInliner.decrypt(blocks.Method, allBlocks) != 0; - modified |= int64ValueInliner.decrypt(blocks.Method, allBlocks) != 0; - modified |= singleValueInliner.decrypt(blocks.Method, allBlocks) != 0; - modified |= doubleValueInliner.decrypt(blocks.Method, allBlocks) != 0; + modified |= int32ValueInliner.Decrypt(blocks.Method, allBlocks) != 0; + modified |= int64ValueInliner.Decrypt(blocks.Method, allBlocks) != 0; + modified |= singleValueInliner.Decrypt(blocks.Method, allBlocks) != 0; + modified |= doubleValueInliner.Decrypt(blocks.Method, allBlocks) != 0; } return modified; } diff --git a/de4dot.code/deobfuscators/Confuser/Deobfuscator.cs b/de4dot.code/deobfuscators/Confuser/Deobfuscator.cs index bacaf7c3..f1809dad 100644 --- a/de4dot.code/deobfuscators/Confuser/Deobfuscator.cs +++ b/de4dot.code/deobfuscators/Confuser/Deobfuscator.cs @@ -34,9 +34,9 @@ namespace de4dot.code.deobfuscators.Confuser { public DeobfuscatorInfo() : base() { - removeAntiDebug = new BoolOption(null, makeArgName("antidb"), "Remove anti debug code", true); - removeAntiDump = new BoolOption(null, makeArgName("antidump"), "Remove anti dump code", true); - decryptMainAsm = new BoolOption(null, makeArgName("decrypt-main"), "Decrypt main embedded assembly", true); + removeAntiDebug = new BoolOption(null, MakeArgName("antidb"), "Remove anti debug code", true); + removeAntiDump = new BoolOption(null, MakeArgName("antidump"), "Remove anti dump code", true); + decryptMainAsm = new BoolOption(null, MakeArgName("decrypt-main"), "Decrypt main embedded assembly", true); } public override string Name { @@ -47,7 +47,7 @@ namespace de4dot.code.deobfuscators.Confuser { get { return THE_TYPE; } } - public override IDeobfuscator createDeobfuscator() { + public override IDeobfuscator CreateDeobfuscator() { return new Deobfuscator(new Deobfuscator.Options { ValidNameRegex = validNameRegex.get(), RemoveAntiDebug = removeAntiDebug.get(), @@ -56,7 +56,7 @@ namespace de4dot.code.deobfuscators.Confuser { }); } - protected override IEnumerable