diff --git a/de4dot.code/ObfuscatedFile.cs b/de4dot.code/ObfuscatedFile.cs
index 40905d98..0d722141 100644
--- a/de4dot.code/ObfuscatedFile.cs
+++ b/de4dot.code/ObfuscatedFile.cs
@@ -198,7 +198,7 @@ namespace de4dot.code {
module = assemblyModule.load(unpackedData);
}
catch {
- Logger.w("Could not load unpacked data. Deobfuscator: {0}", deob.TypeLong);
+ Logger.w("Could not load unpacked data. File: {0}, deobfuscator: {0}", peImage.FileName ?? "(unknown filename)", deob.TypeLong);
continue;
}
this.deob = deob;
diff --git a/de4dot.code/de4dot.code.csproj b/de4dot.code/de4dot.code.csproj
index ddd2ba13..5a0cf2dc 100644
--- a/de4dot.code/de4dot.code.csproj
+++ b/de4dot.code/de4dot.code.csproj
@@ -153,16 +153,16 @@
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
diff --git a/de4dot.code/deobfuscators/TypesRestorer.cs b/de4dot.code/deobfuscators/TypesRestorer.cs
index f000d23b..6f2be1cc 100644
--- a/de4dot.code/deobfuscators/TypesRestorer.cs
+++ b/de4dot.code/deobfuscators/TypesRestorer.cs
@@ -633,6 +633,10 @@ namespace de4dot.code.deobfuscators {
if (field != null)
return field.FieldSig.GetFieldType().GetElementType() == ElementType.Object;
+ var sig = o as TypeSig;
+ if (sig != null)
+ return sig.ElementType == ElementType.Object;
+
throw new ApplicationException(string.Format("Unknown type: {0}", o.GetType()));
}
}
diff --git a/de4dot.code/deobfuscators/dotNET_Reactor/v3/AntiStrongName.cs b/de4dot.code/deobfuscators/dotNET_Reactor/v3/AntiStrongName.cs
index 3eb4ed72..2f9408a1 100644
--- a/de4dot.code/deobfuscators/dotNET_Reactor/v3/AntiStrongName.cs
+++ b/de4dot.code/deobfuscators/dotNET_Reactor/v3/AntiStrongName.cs
@@ -120,7 +120,7 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v3 {
static bool checkCall(Instr instr, string methodFullname) {
if (instr.OpCode.Code != Code.Call && instr.OpCode.Code != Code.Callvirt)
return false;
- var calledMethod = instr.Operand as MethodReference;
+ var calledMethod = instr.Operand as IMethod;
if (calledMethod == null)
return false;
return calledMethod.ToString() == methodFullname;
@@ -129,13 +129,13 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v3 {
static bool checkCall(Instr instr, string returnType, string parameters) {
if (instr.OpCode.Code != Code.Call && instr.OpCode.Code != Code.Callvirt)
return false;
- var calledMethod = instr.Operand as MethodReference;
+ var calledMethod = instr.Operand as IMethod;
if (calledMethod == null)
return false;
return DotNetUtils.isMethod(calledMethod, returnType, parameters);
}
- static bool checkLdloc(IList locals, Instr instr, VariableDefinition local) {
+ static bool checkLdloc(IList locals, Instr instr, Local local) {
if (!instr.isLdloc())
return false;
if (Instr.getLocalVar(locals, instr) != local)
@@ -143,7 +143,7 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v3 {
return true;
}
- static bool checkStloc(IList locals, Instr instr, VariableDefinition local) {
+ static bool checkStloc(IList locals, Instr instr, Local local) {
if (!instr.isStloc())
return false;
if (Instr.getLocalVar(locals, instr) != local)
diff --git a/de4dot.code/deobfuscators/dotNET_Reactor/v3/ApplicationModeDecrypter.cs b/de4dot.code/deobfuscators/dotNET_Reactor/v3/ApplicationModeDecrypter.cs
index 70dc4c0b..b8faf232 100644
--- a/de4dot.code/deobfuscators/dotNET_Reactor/v3/ApplicationModeDecrypter.cs
+++ b/de4dot.code/deobfuscators/dotNET_Reactor/v3/ApplicationModeDecrypter.cs
@@ -23,7 +23,7 @@ using de4dot.blocks.cflow;
namespace de4dot.code.deobfuscators.dotNET_Reactor.v3 {
class ApplicationModeDecrypter {
- ModuleDefinition module;
+ ModuleDefMD module;
AssemblyResolver assemblyResolver;
MemoryPatcher memoryPatcher;
@@ -43,7 +43,7 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v3 {
get { return assemblyResolver != null; }
}
- public ApplicationModeDecrypter(ModuleDefinition module) {
+ public ApplicationModeDecrypter(ModuleDefMD module) {
this.module = module;
find();
}
diff --git a/de4dot.code/deobfuscators/dotNET_Reactor/v3/ApplicationModeUnpacker.cs b/de4dot.code/deobfuscators/dotNET_Reactor/v3/ApplicationModeUnpacker.cs
index 9ce3ed1b..a06aeb94 100644
--- a/de4dot.code/deobfuscators/dotNET_Reactor/v3/ApplicationModeUnpacker.cs
+++ b/de4dot.code/deobfuscators/dotNET_Reactor/v3/ApplicationModeUnpacker.cs
@@ -22,10 +22,137 @@ using System.Collections.Generic;
using System.IO;
using System.Text;
using System.Text.RegularExpressions;
+using dot10.IO;
+using dot10.PE;
using dot10.DotNet;
-using de4dot.PE;
+using dot10.DotNet.MD;
namespace de4dot.code.deobfuscators.dotNET_Reactor.v3 {
+ sealed class MyPEImage : IDisposable {
+ IPEImage peImage;
+ byte[] peImageData;
+ IImageStream peStream;
+ DotNetFile dnFile;
+ ImageSectionHeader dotNetSection;
+ bool ownPeImage;
+
+ public IPEImage PEImage {
+ get { return peImage; }
+ }
+
+ public uint Length {
+ get { return (uint)peStream.Length; }
+ }
+
+ public MyPEImage(IPEImage peImage) {
+ initialize(peImage);
+ }
+
+ public MyPEImage(byte[] peImageData) {
+ this.ownPeImage = true;
+ this.peImageData = peImageData;
+ initialize(new PEImage(peImageData));
+ }
+
+ void initialize(IPEImage peImage) {
+ this.peImage = peImage;
+ this.peStream = peImage.CreateFullStream();
+
+ //TODO: Only init this if they use the .NET MD
+ var dotNetDir = peImage.ImageNTHeaders.OptionalHeader.DataDirectories[14];
+ if (dotNetDir.VirtualAddress != 0 && dotNetDir.Size >= 0x48) {
+ dnFile = DotNetFile.Load(peImage, false);
+ dotNetSection = findSection(dotNetDir.VirtualAddress);
+ }
+ }
+
+ ImageSectionHeader findSection(RVA rva) {
+ foreach (var section in peImage.ImageSectionHeaders) {
+ if (section.VirtualAddress <= rva && rva < section.VirtualAddress + Math.Max(section.VirtualSize, section.SizeOfRawData))
+ return section;
+ }
+ return null;
+ }
+
+ static bool isInside(ImageSectionHeader section, uint offset, uint length) {
+ return offset >= section.PointerToRawData && offset + length <= section.PointerToRawData + section.SizeOfRawData;
+ }
+
+ public void offsetWriteUInt32(uint offset, uint val) {
+ peImageData[offset + 0] = (byte)val;
+ peImageData[offset + 1] = (byte)(val >> 8);
+ peImageData[offset + 2] = (byte)(val >> 16);
+ peImageData[offset + 3] = (byte)(val >> 24);
+ }
+
+ public void offsetWriteUInt16(uint offset, ushort val) {
+ peImageData[offset + 0] = (byte)val;
+ peImageData[offset + 1] = (byte)(val >> 8);
+ }
+
+ public uint offsetReadUInt32(uint offset) {
+ peStream.Position = offset;
+ return peStream.ReadUInt32();
+ }
+
+ public ushort offsetReadUInt16(uint offset) {
+ peStream.Position = offset;
+ return peStream.ReadUInt16();
+ }
+
+ public byte[] offsetReadBytes(uint offset, int size) {
+ peStream.Position = offset;
+ return peStream.ReadBytes(size);
+ }
+
+ public void offsetWrite(uint offset, byte[] data) {
+ Array.Copy(data, 0, peImageData, offset, data.Length);
+ }
+
+ bool intersect(uint offset1, uint length1, uint offset2, uint length2) {
+ return !(offset1 + length1 <= offset2 || offset2 + length2 <= offset1);
+ }
+
+ bool intersect(uint offset, uint length, IFileSection location) {
+ return intersect(offset, length, (uint)location.StartOffset, (uint)(location.EndOffset - location.StartOffset));
+ }
+
+ public bool dotNetSafeWriteOffset(uint offset, byte[] data) {
+ if (dnFile != null) {
+ uint length = (uint)data.Length;
+
+ if (!isInside(dotNetSection, offset, length))
+ return false;
+ if (intersect(offset, length, dnFile.MetaData.ImageCor20Header))
+ return false;
+ if (intersect(offset, length, (uint)dnFile.MetaData.TablesStream.FileOffset, dnFile.MetaData.TablesStream.HeaderLength))
+ return false;
+ }
+
+ offsetWrite(offset, data);
+ return true;
+ }
+
+ public bool dotNetSafeWrite(uint rva, byte[] data) {
+ return dotNetSafeWriteOffset((uint)peImage.ToFileOffset((RVA)rva), data);
+ }
+
+ public void Dispose() {
+ if (ownPeImage) {
+ if (dnFile != null)
+ dnFile.Dispose();
+ if (peImage != null)
+ peImage.Dispose();
+ }
+ if (peStream != null)
+ peStream.Dispose();
+
+ dnFile = null;
+ peImage = null;
+ peStream = null;
+ }
+ }
+
class IniFile {
Dictionary nameToValue = new Dictionary(StringComparer.OrdinalIgnoreCase);
@@ -77,7 +204,7 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v3 {
0x73, 0x33, 0x6E, 0x6D, 0x34, 0x32, 0x64, 0x35,
};
- PeImage peImage;
+ IPEImage peImage;
List satelliteAssemblies = new List();
uint[] sizes;
string[] filenames;
@@ -87,29 +214,35 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v3 {
get { return satelliteAssemblies; }
}
- public ApplicationModeUnpacker(PeImage peImage) {
+ public ApplicationModeUnpacker(IPEImage peImage) {
this.peImage = peImage;
}
public byte[] unpack() {
byte[] data = null;
+ MyPEImage myPeImage = null;
try {
- data = unpack2();
+ myPeImage = new MyPEImage(peImage);
+ data = unpack2(myPeImage);
}
catch {
}
+ finally {
+ if (myPeImage != null)
+ myPeImage.Dispose();
+ }
if (data != null)
return data;
if (shouldUnpack)
- Logger.w("Could not unpack the file");
+ Logger.w("Could not unpack file: {0}", peImage.FileName ?? "(unknown filename)");
return null;
}
- byte[] unpack2() {
+ byte[] unpack2(MyPEImage peImage) {
shouldUnpack = false;
- uint headerOffset = peImage.ImageLength - 12;
- uint offsetEncryptedAssembly = checkOffset(peImage.offsetReadUInt32(headerOffset));
+ uint headerOffset = (uint)peImage.Length - 12;
+ uint offsetEncryptedAssembly = checkOffset(peImage, peImage.offsetReadUInt32(headerOffset));
uint ezencryptionLibLength = peImage.offsetReadUInt32(headerOffset + 4);
uint iniFileLength = peImage.offsetReadUInt32(headerOffset + 8);
@@ -135,30 +268,31 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v3 {
return null;
byte[] ezencryptionLibData = decompress1(peImage.offsetReadBytes(ezencryptionLibOffset, (int)ezencryptionLibLength));
- var ezencryptionLibModule = ModuleDefinition.ReadModule(new MemoryStream(ezencryptionLibData));
+ var ezencryptionLibModule = ModuleDefMD.Load(ezencryptionLibData);
var decrypter = new ApplicationModeDecrypter(ezencryptionLibModule);
if (!decrypter.Detected)
return null;
- var mainAssembly = unpackEmbeddedFile(0, decrypter);
+ var mainAssembly = unpackEmbeddedFile(peImage, 0, decrypter);
decrypter.MemoryPatcher.patch(mainAssembly.data);
for (int i = 1; i < filenames.Length; i++)
- satelliteAssemblies.Add(unpackEmbeddedFile(i, decrypter));
+ satelliteAssemblies.Add(unpackEmbeddedFile(peImage, i, decrypter));
clearDllBit(mainAssembly.data);
return mainAssembly.data;
}
static void clearDllBit(byte[] peImageData) {
- var mainPeImage = new PeImage(peImageData);
- uint characteristicsOffset = mainPeImage.FileHeaderOffset + 18;
- ushort characteristics = mainPeImage.offsetReadUInt16(characteristicsOffset);
- characteristics &= 0xDFFF;
- characteristics |= 2;
- mainPeImage.offsetWriteUInt16(characteristicsOffset, characteristics);
+ using (var mainPeImage = new MyPEImage(peImageData)) {
+ uint characteristicsOffset = (uint)mainPeImage.PEImage.ImageNTHeaders.FileHeader.StartOffset + 18;
+ ushort characteristics = mainPeImage.offsetReadUInt16(characteristicsOffset);
+ characteristics &= 0xDFFF;
+ characteristics |= 2;
+ mainPeImage.offsetWriteUInt16(characteristicsOffset, characteristics);
+ }
}
- UnpackedFile unpackEmbeddedFile(int index, ApplicationModeDecrypter decrypter) {
+ UnpackedFile unpackEmbeddedFile(MyPEImage peImage, int index, ApplicationModeDecrypter decrypter) {
uint offset = 0;
for (int i = 0; i < index + 1; i++)
offset += sizes[i];
@@ -178,8 +312,8 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v3 {
return list.ToArray();
}
- uint checkOffset(uint offset) {
- if (offset >= peImage.ImageLength)
+ uint checkOffset(MyPEImage peImage, uint offset) {
+ if (offset >= peImage.Length)
throw new Exception();
return offset;
}
diff --git a/de4dot.code/deobfuscators/dotNET_Reactor/v3/DecrypterType.cs b/de4dot.code/deobfuscators/dotNET_Reactor/v3/DecrypterType.cs
index 28032863..c0732649 100644
--- a/de4dot.code/deobfuscators/dotNET_Reactor/v3/DecrypterType.cs
+++ b/de4dot.code/deobfuscators/dotNET_Reactor/v3/DecrypterType.cs
@@ -27,12 +27,12 @@ using de4dot.PE;
namespace de4dot.code.deobfuscators.dotNET_Reactor.v3 {
// Find the type that decrypts strings and calls the native lib
class DecrypterType {
- ModuleDefinition module;
+ ModuleDefMD module;
TypeDef decrypterType;
MethodDef stringDecrypter1;
MethodDef stringDecrypter2;
List initMethods = new List();
- List moduleReferences = new List();
+ List moduleReferences = new List();
Resource linkedResource;
public bool Detected {
@@ -59,10 +59,6 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v3 {
get { return initMethods; }
}
- public List ModuleReferences {
- get { return moduleReferences; }
- }
-
public IEnumerable StringDecrypters {
get {
return new List {
@@ -72,11 +68,11 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v3 {
}
}
- public DecrypterType(ModuleDefinition module) {
+ public DecrypterType(ModuleDefMD module) {
this.module = module;
}
- public DecrypterType(ModuleDefinition module, DecrypterType oldOne) {
+ public DecrypterType(ModuleDefMD module, DecrypterType oldOne) {
this.module = module;
this.decrypterType = lookup(oldOne.decrypterType, "Could not find decrypterType");
this.stringDecrypter1 = lookup(oldOne.stringDecrypter1, "Could not find stringDecrypter1");
@@ -109,11 +105,11 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v3 {
void updateModuleReferences() {
foreach (var method in decrypterType.Methods) {
- if (method.PInvokeInfo != null) {
- switch (method.PInvokeInfo.EntryPoint) {
+ if (method.ImplMap != null) {
+ switch (method.ImplMap.Name.String) {
case "nr_nli":
case "nr_startup":
- moduleReferences.Add(method.PInvokeInfo.Module);
+ moduleReferences.Add(method.ImplMap.Module);
break;
}
}
@@ -123,7 +119,7 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v3 {
void updateLinkedResource() {
foreach (var modref in moduleReferences) {
- var resource = DotNetUtils.getResource(module, modref.Name) as LinkedResource;
+ var resource = DotNetUtils.getResource(module, modref.Name.String) as LinkedResource;
if (resource == null)
continue;
@@ -133,7 +129,7 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v3 {
}
MethodDef getStringDecrypter(TypeDef type, string name) {
- var method = DotNetUtils.getMethod(type, name);
+ var method = type.FindMethod(name);
if (method == null)
return null;
if (!DotNetUtils.isMethod(method, "System.String", "(System.String)"))
@@ -152,9 +148,10 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v3 {
return Encoding.Unicode.GetString(Convert.FromBase64String(s));
}
- public bool patch(PeImage peImage) {
+ public bool patch(byte[] peData) {
try {
- return patch2(peImage);
+ using (var peImage = new MyPEImage(peData))
+ return patch2(peImage);
}
catch {
Logger.w("Could not patch the file");
@@ -162,9 +159,9 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v3 {
}
}
- bool patch2(PeImage peImage) {
- uint numPatches = peImage.offsetReadUInt32(peImage.ImageLength - 4);
- uint offset = checked(peImage.ImageLength - 4 - numPatches * 8);
+ bool patch2(MyPEImage peImage) {
+ uint numPatches = peImage.offsetReadUInt32(peImage.Length - 4);
+ uint offset = checked(peImage.Length - 4 - numPatches * 8);
bool startedPatchingBadData = false;
for (uint i = 0; i < numPatches; i++, offset += 8) {
diff --git a/de4dot.code/deobfuscators/dotNET_Reactor/v3/Deobfuscator.cs b/de4dot.code/deobfuscators/dotNET_Reactor/v3/Deobfuscator.cs
index e8641ca1..a31010e8 100644
--- a/de4dot.code/deobfuscators/dotNET_Reactor/v3/Deobfuscator.cs
+++ b/de4dot.code/deobfuscators/dotNET_Reactor/v3/Deobfuscator.cs
@@ -21,11 +21,11 @@ using System;
using System.Collections.Generic;
using System.IO;
using System.Text.RegularExpressions;
+using dot10.IO;
+using dot10.PE;
using dot10.DotNet;
using dot10.DotNet.Emit;
-using Mono.MyStuff;
using de4dot.blocks;
-using de4dot.PE;
namespace de4dot.code.deobfuscators.dotNET_Reactor.v3 {
public class DeobfuscatorInfo : DeobfuscatorInfoBase {
@@ -125,7 +125,7 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v3 {
this.RenamingOptions &= ~RenamingOptions.RemoveNamespaceIfOneType;
}
- public override byte[] unpackNativeFile(PeImage peImage) {
+ public override byte[] unpackNativeFile(IPEImage peImage) {
var unpacker = new ApplicationModeUnpacker(peImage);
var data = unpacker.unpack();
if (data == null)
@@ -146,15 +146,14 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v3 {
return false;
var fileData = ModuleBytes ?? DeobUtils.readModule(module);
- var peImage = new PeImage(fileData);
- if (!decrypterType.patch(peImage))
+ if (!decrypterType.patch(fileData))
return false;
newFileData = fileData;
return true;
}
- public override IDeobfuscator moduleReloaded(ModuleDefinition module) {
+ public override IDeobfuscator moduleReloaded(ModuleDefMD module) {
var newOne = new Deobfuscator(options);
newOne.setModule(module);
newOne.decrypterType = new DecrypterType(module, decrypterType);
@@ -162,7 +161,7 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v3 {
return newOne;
}
- public override void init(ModuleDefinition module) {
+ public override void init(ModuleDefMD module) {
base.init(module);
}
@@ -298,7 +297,7 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v3 {
void dumpResourceFiles() {
foreach (var resource in libAssemblyResolver.Resources) {
- var mod = ModuleDefinition.ReadModule(resource.GetResourceStream());
+ var mod = ModuleDefMD.Load(resource.Data.ReadAllBytes());
addResourceToBeRemoved(resource, string.Format("Embedded assembly: {0}", mod.Assembly.FullName));
DeobfuscatedFile.createAssemblyFile(resource.GetResourceData(),
Utils.getAssemblySimpleName(mod.Assembly.FullName),
@@ -324,7 +323,6 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v3 {
if (canRemoveDecrypterType && !isTypeCalled(decrypterType.Type)) {
addTypeToBeRemoved(decrypterType.Type, "Decrypter type");
- addModuleReferencesToBeRemoved(decrypterType.ModuleReferences, "Native lib module reference");
addResourceToBeRemoved(decrypterType.LinkedResource, "Native lib linked resource");
}
diff --git a/de4dot.code/deobfuscators/dotNET_Reactor/v3/LibAssemblyResolver.cs b/de4dot.code/deobfuscators/dotNET_Reactor/v3/LibAssemblyResolver.cs
index b3183fee..72b9c4c0 100644
--- a/de4dot.code/deobfuscators/dotNET_Reactor/v3/LibAssemblyResolver.cs
+++ b/de4dot.code/deobfuscators/dotNET_Reactor/v3/LibAssemblyResolver.cs
@@ -25,7 +25,7 @@ using de4dot.blocks;
namespace de4dot.code.deobfuscators.dotNET_Reactor.v3 {
// Find the assembly resolver that's used in lib mode (3.8+)
class LibAssemblyResolver {
- ModuleDefinition module;
+ ModuleDefMD module;
MethodDef initMethod;
List resources = new List();
@@ -41,7 +41,7 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v3 {
get { return resources; }
}
- public LibAssemblyResolver(ModuleDefinition module) {
+ public LibAssemblyResolver(ModuleDefMD module) {
this.module = module;
}
@@ -69,7 +69,7 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v3 {
var type = method.DeclaringType;
if (!new FieldTypes(type).exactly(requiredFields))
continue;
- var ctor = DotNetUtils.getMethod(type, ".ctor");
+ var ctor = type.FindMethod(".ctor");
if (ctor == null)
continue;
var handler = DeobUtils.getResolveMethod(ctor);
diff --git a/de4dot.code/deobfuscators/dotNET_Reactor/v3/MemoryPatcher.cs b/de4dot.code/deobfuscators/dotNET_Reactor/v3/MemoryPatcher.cs
index 03f83713..aa21ab0a 100644
--- a/de4dot.code/deobfuscators/dotNET_Reactor/v3/MemoryPatcher.cs
+++ b/de4dot.code/deobfuscators/dotNET_Reactor/v3/MemoryPatcher.cs
@@ -135,10 +135,11 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v3 {
}
public void patch(byte[] peImageData) {
- var peImage = new PeImage(peImageData);
- foreach (var info in patchInfos) {
- for (int i = 0; i < info.offsets.Length; i++)
- peImage.dotNetSafeWriteOffset((uint)info.offsets[i], BitConverter.GetBytes(info.values[i]));
+ using (var peImage = new MyPEImage(peImageData)) {
+ foreach (var info in patchInfos) {
+ for (int i = 0; i < info.offsets.Length; i++)
+ peImage.dotNetSafeWriteOffset((uint)info.offsets[i], BitConverter.GetBytes(info.values[i]));
+ }
}
}
}
diff --git a/de4dot.code/deobfuscators/dotNET_Reactor/v3/NativeLibSaver.cs b/de4dot.code/deobfuscators/dotNET_Reactor/v3/NativeLibSaver.cs
index e96ea153..45faf868 100644
--- a/de4dot.code/deobfuscators/dotNET_Reactor/v3/NativeLibSaver.cs
+++ b/de4dot.code/deobfuscators/dotNET_Reactor/v3/NativeLibSaver.cs
@@ -24,7 +24,7 @@ using de4dot.blocks;
namespace de4dot.code.deobfuscators.dotNET_Reactor.v3 {
// Finds the type that saves the native lib (if in resources) to disk
class NativeLibSaver {
- ModuleDefinition module;
+ ModuleDefMD module;
TypeDef nativeLibCallerType;
MethodDef initMethod;
Resource nativeFileResource;
@@ -45,16 +45,16 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v3 {
get { return nativeLibCallerType != null; }
}
- public NativeLibSaver(ModuleDefinition module) {
+ public NativeLibSaver(ModuleDefMD module) {
this.module = module;
}
- public NativeLibSaver(ModuleDefinition module, NativeLibSaver oldOne) {
+ public NativeLibSaver(ModuleDefMD module, NativeLibSaver oldOne) {
this.module = module;
this.nativeLibCallerType = lookup(oldOne.nativeLibCallerType, "Could not find nativeLibCallerType");
this.initMethod = lookup(oldOne.initMethod, "Could not find initMethod");
if (oldOne.nativeFileResource != null) {
- this.nativeFileResource = DotNetUtils.getResource(module, oldOne.nativeFileResource.Name);
+ this.nativeFileResource = DotNetUtils.getResource(module, oldOne.nativeFileResource.Name.String);
if (this.nativeFileResource == null)
throw new ApplicationException("Could not find nativeFileResource");
}
diff --git a/de4dot.cui/Program.cs b/de4dot.cui/Program.cs
index afbf3ea0..f5078fe3 100644
--- a/de4dot.cui/Program.cs
+++ b/de4dot.cui/Program.cs
@@ -46,8 +46,8 @@ namespace de4dot.cui {
new de4dot.code.deobfuscators.CryptoObfuscator.DeobfuscatorInfo(),
new de4dot.code.deobfuscators.DeepSea.DeobfuscatorInfo(),
new de4dot.code.deobfuscators.Dotfuscator.DeobfuscatorInfo(),
-#if PORT
new de4dot.code.deobfuscators.dotNET_Reactor.v3.DeobfuscatorInfo(),
+#if PORT
new de4dot.code.deobfuscators.dotNET_Reactor.v4.DeobfuscatorInfo(),
new de4dot.code.deobfuscators.Eazfuscator_NET.DeobfuscatorInfo(),
new de4dot.code.deobfuscators.Goliath_NET.DeobfuscatorInfo(),