monocul.us/de4dot-cex
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix detection; 3.2 doesn't have those extra fields

Browse Source
This commit is contained in:
de4dot 2012-02-12 12:03:55 +01:00
parent d6327b401e
commit 42f66c3948
1 changed files with 1 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
de4dot.code/deobfuscators/CodeVeil/MethodsDecrypter.cs
View File

@ -246,8 +246,6 @@ namespace de4dot.code.deobfuscators.CodeVeil {
const int RVA_EXECUTIVE_OFFSET = 1 * 4;
const int ENC_CODE_OFFSET = 6 * 4;
const int MAGIC1_OFFSET = 7 * 4;
const int MAGIC2_OFFSET = 8 * 4;
int lastOffset = (int)(section.pointerToRawData + section.sizeOfRawData);
for (int offset = getStartOffset(peImage); offset < lastOffset; ) {
offset = findSig(fileData, offset, lastOffset, initializeMethodEnd);
@ -259,17 +257,13 @@ namespace de4dot.code.deobfuscators.CodeVeil {
if (retImm16 != 0x0C && retImm16 != 0x10)
continue;
offset += 2;
if (offset + MAGIC2_OFFSET + 4 > lastOffset)
if (offset + ENC_CODE_OFFSET + 4 > lastOffset)
return null;
// rva is 0 when the assembly has been embedded
int rva = BitConverter.ToInt32(fileData, offset + RVA_EXECUTIVE_OFFSET);
if (rva != 0 && mainType.Rvas.IndexOf(rva) < 0)
continue;
if (BitConverter.ToInt32(fileData, offset + MAGIC1_OFFSET) != -1)
continue;
if (BitConverter.ToInt32(fileData, offset + MAGIC2_OFFSET) != -1)
continue;
int relOffs = BitConverter.ToInt32(fileData, offset + ENC_CODE_OFFSET);
if (relOffs <= 0 || relOffs >= section.sizeOfRawData)