monocul.us/de4dot-cex
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge branch 'master' into mc

Browse Source
This commit is contained in:
de4dot 2012-02-21 17:33:45 +01:00
commit 435d3303c3
12 changed files with 25 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
de4dot.code/deobfuscators/Babel_NET/Deobfuscator.cs
View File

@ -178,9 +178,6 @@ namespace de4dot.code.deobfuscators.Babel_NET {
stringDecrypter.initialize();
if (Operations.DecryptStrings != OpDecryptString.None) {
addResourceToBeRemoved(stringDecrypter.Resource, "Encrypted strings");
addTypeToBeRemoved(stringDecrypter.Type, "String decrypter type");
if (stringDecrypter.Resource != null)
Log.v("Adding string decrypter. Resource: {0}", Utils.toCsharpString(stringDecrypter.Resource.Name));
staticStringInliner.add(stringDecrypter.DecryptMethod, (method, args) => {
@ -252,6 +249,11 @@ namespace de4dot.code.deobfuscators.Babel_NET {
}
public override void deobfuscateEnd() {
if (CanRemoveStringDecrypterType) {
addResourceToBeRemoved(stringDecrypter.Resource, "Encrypted strings");
addTypeToBeRemoved(stringDecrypter.Type, "String decrypter type");
}
removeProxyDelegates(proxyDelegateFinder);
methodsDecrypter.Dispose();
base.deobfuscateEnd();

2
de4dot.code/deobfuscators/CliSecure/Deobfuscator.cs
View File

@ -212,7 +212,7 @@ namespace de4dot.code.deobfuscators.CliSecure {
if (stackFrameHelper.ExceptionLoggerRemover.NumRemovedExceptionLoggers > 0)
addTypeToBeRemoved(stackFrameHelper.Type, "StackFrameHelper type");
}
if (Operations.DecryptStrings != OpDecryptString.None) {
if (CanRemoveStringDecrypterType) {
addTypeToBeRemoved(stringDecrypter.Type, "String decrypter type");
if (options.DecryptMethods)
addTypeToBeRemoved(cliSecureRtType.Type, "Obfuscator type");

4
de4dot.code/deobfuscators/CodeVeil/Deobfuscator.cs
View File

@ -193,7 +193,6 @@ namespace de4dot.code.deobfuscators.CodeVeil {
DeobfuscatedFile.stringDecryptersAdded();
addModuleCctorInitCallToBeRemoved(stringDecrypter.InitMethod);
addCallToBeRemoved(mainType.getInitStringDecrypterMethod(stringDecrypter.InitMethod), stringDecrypter.InitMethod);
addTypeToBeRemoved(stringDecrypter.Type, "String decrypter type");
}
assemblyResolver = new AssemblyResolver(module);
@ -248,6 +247,9 @@ namespace de4dot.code.deobfuscators.CodeVeil {
public override void deobfuscateEnd() {
bool canRemoveProxyTypes = proxyDelegateFinder.CanRemoveTypes;
if (CanRemoveStringDecrypterType)
addTypeToBeRemoved(stringDecrypter.Type, "String decrypter type");
if (!mainType.Detected) {
}
else if (mainType.Version >= ObfuscatorVersion.V5_0) {

6
de4dot.code/deobfuscators/CryptoObfuscator/Deobfuscator.cs
View File

@ -171,7 +171,6 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
decryptResources();
stringDecrypter.init(resourceDecrypter);
if (stringDecrypter.Method != null) {
addResourceToBeRemoved(stringDecrypter.Resource, "Encrypted strings");
staticStringInliner.add(stringDecrypter.Method, (method, args) => {
return stringDecrypter.decrypt((int)args[0]);
});
@ -191,7 +190,6 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
addTypeToBeRemoved(assemblyResolver.Type, "Assembly resolver type");
addTypeToBeRemoved(tamperDetection.Type, "Tamper detection type");
addTypeToBeRemoved(antiDebugger.Type, "Anti-debugger type");
addTypeToBeRemoved(stringDecrypter.Type, "String decrypter type");
proxyDelegateFinder.find();
@ -205,6 +203,10 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
public override void deobfuscateEnd() {
removeProxyDelegates(proxyDelegateFinder);
if (CanRemoveStringDecrypterType) {
addResourceToBeRemoved(stringDecrypter.Resource, "Encrypted strings");
addTypeToBeRemoved(stringDecrypter.Type, "String decrypter type");
}
base.deobfuscateEnd();
}

2
de4dot.code/deobfuscators/DeepSea/Deobfuscator.cs
View File

@ -239,7 +239,7 @@ done:
if (options.RestoreFields)
addTypesToBeRemoved(fieldsRestorer.FieldStructs, "Type with moved fields");
if (Operations.DecryptStrings != OpDecryptString.None) {
if (CanRemoveStringDecrypterType) {
addMethodsToBeRemoved(stringDecrypter.DecrypterMethods, "String decrypter method");
stringDecrypter.cleanup();
}

4
de4dot.code/deobfuscators/DeobfuscatorBase.cs
View File

@ -90,6 +90,10 @@ namespace de4dot.code.deobfuscators {
get { return false; }
}
protected bool CanRemoveStringDecrypterType {
get { return Operations.DecryptStrings != OpDecryptString.None && staticStringInliner.InlinedAllCalls; }
}
public virtual IMethodCallInliner MethodCallInliner {
get {
if (CanInlineMethods)

2
de4dot.code/deobfuscators/Dotfuscator/Deobfuscator.cs
View File

@ -120,7 +120,7 @@ namespace de4dot.code.deobfuscators.Dotfuscator {
}
public override void deobfuscateEnd() {
if (Operations.DecryptStrings != OpDecryptString.None)
if (CanRemoveStringDecrypterType)
addMethodsToBeRemoved(stringDecrypter.StringDecrypters, "String decrypter method");
base.deobfuscateEnd();

2
de4dot.code/deobfuscators/Eazfuscator_NET/Deobfuscator.cs
View File

@ -536,7 +536,7 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
}
public override void deobfuscateEnd() {
if (Operations.DecryptStrings == OpDecryptString.Dynamic) {
if (Operations.DecryptStrings == OpDecryptString.Dynamic && CanRemoveStringDecrypterType) {
addTypeToBeRemoved(decryptStringType, "String decrypter type");
findPossibleNamesToRemove(decryptStringMethod);
addResources("Encrypted strings");

2
de4dot.code/deobfuscators/Goliath_NET/Deobfuscator.cs
View File

@ -242,7 +242,7 @@ namespace de4dot.code.deobfuscators.Goliath_NET {
removeInlinedMethods();
addTypesToBeRemoved(localsRestorer.Types, "Method locals obfuscation type");
if (Operations.DecryptStrings != OpDecryptString.None) {
if (CanRemoveStringDecrypterType) {
removeDecrypterStuff(stringDecrypter, "String", "strings");
addTypeToBeRemoved(stringDecrypter.StringStruct, "String struct");
}

2
de4dot.code/deobfuscators/Skater_NET/Deobfuscator.cs
View File

@ -104,7 +104,7 @@ namespace de4dot.code.deobfuscators.Skater_NET {
}
public override void deobfuscateMethodEnd(Blocks blocks) {
if (Operations.DecryptStrings != OpDecryptString.None)
if (CanRemoveStringDecrypterType)
stringDecrypter.deobfuscate(blocks);
enumClassFinder.deobfuscate(blocks);
base.deobfuscateMethodEnd(blocks);

10
de4dot.code/deobfuscators/SmartAssembly/Deobfuscator.cs
View File

@ -515,14 +515,8 @@ namespace de4dot.code.deobfuscators.SmartAssembly {
addMethodsToBeRemoved(tamperProtectionRemover.PinvokeMethods, "Tamper protection PInvoke method");
}
bool canRemoveStringDecrypterStuff() {
if (!staticStringInliner.InlinedAllCalls)
return false;
return Operations.DecryptStrings != OpDecryptString.None;
}
void removeStringDecryptionStuff() {
if (!canRemoveStringDecrypterStuff())
if (!CanRemoveStringDecrypterType)
return;
foreach (var decrypter in stringDecrypters) {
@ -539,7 +533,7 @@ namespace de4dot.code.deobfuscators.SmartAssembly {
}
void removeStringsInitCode(Blocks blocks) {
if (!canRemoveStringDecrypterStuff())
if (!CanRemoveStringDecrypterType)
return;
if (blocks.Method.Name == ".cctor") {

2
de4dot.code/deobfuscators/Xenocode/Deobfuscator.cs
View File

@ -104,7 +104,7 @@ namespace de4dot.code.deobfuscators.Xenocode {
}
public override void deobfuscateEnd() {
if (Operations.DecryptStrings != OpDecryptString.None)
if (CanRemoveStringDecrypterType)
addTypeToBeRemoved(stringDecrypter.Type, "String decrypter type");
base.deobfuscateEnd();
}