Merge branch 'master' into mc
This commit is contained in:
commit
435d3303c3
|
@ -178,9 +178,6 @@ namespace de4dot.code.deobfuscators.Babel_NET {
|
||||||
stringDecrypter.initialize();
|
stringDecrypter.initialize();
|
||||||
|
|
||||||
if (Operations.DecryptStrings != OpDecryptString.None) {
|
if (Operations.DecryptStrings != OpDecryptString.None) {
|
||||||
addResourceToBeRemoved(stringDecrypter.Resource, "Encrypted strings");
|
|
||||||
addTypeToBeRemoved(stringDecrypter.Type, "String decrypter type");
|
|
||||||
|
|
||||||
if (stringDecrypter.Resource != null)
|
if (stringDecrypter.Resource != null)
|
||||||
Log.v("Adding string decrypter. Resource: {0}", Utils.toCsharpString(stringDecrypter.Resource.Name));
|
Log.v("Adding string decrypter. Resource: {0}", Utils.toCsharpString(stringDecrypter.Resource.Name));
|
||||||
staticStringInliner.add(stringDecrypter.DecryptMethod, (method, args) => {
|
staticStringInliner.add(stringDecrypter.DecryptMethod, (method, args) => {
|
||||||
|
@ -252,6 +249,11 @@ namespace de4dot.code.deobfuscators.Babel_NET {
|
||||||
}
|
}
|
||||||
|
|
||||||
public override void deobfuscateEnd() {
|
public override void deobfuscateEnd() {
|
||||||
|
if (CanRemoveStringDecrypterType) {
|
||||||
|
addResourceToBeRemoved(stringDecrypter.Resource, "Encrypted strings");
|
||||||
|
addTypeToBeRemoved(stringDecrypter.Type, "String decrypter type");
|
||||||
|
}
|
||||||
|
|
||||||
removeProxyDelegates(proxyDelegateFinder);
|
removeProxyDelegates(proxyDelegateFinder);
|
||||||
methodsDecrypter.Dispose();
|
methodsDecrypter.Dispose();
|
||||||
base.deobfuscateEnd();
|
base.deobfuscateEnd();
|
||||||
|
|
|
@ -212,7 +212,7 @@ namespace de4dot.code.deobfuscators.CliSecure {
|
||||||
if (stackFrameHelper.ExceptionLoggerRemover.NumRemovedExceptionLoggers > 0)
|
if (stackFrameHelper.ExceptionLoggerRemover.NumRemovedExceptionLoggers > 0)
|
||||||
addTypeToBeRemoved(stackFrameHelper.Type, "StackFrameHelper type");
|
addTypeToBeRemoved(stackFrameHelper.Type, "StackFrameHelper type");
|
||||||
}
|
}
|
||||||
if (Operations.DecryptStrings != OpDecryptString.None) {
|
if (CanRemoveStringDecrypterType) {
|
||||||
addTypeToBeRemoved(stringDecrypter.Type, "String decrypter type");
|
addTypeToBeRemoved(stringDecrypter.Type, "String decrypter type");
|
||||||
if (options.DecryptMethods)
|
if (options.DecryptMethods)
|
||||||
addTypeToBeRemoved(cliSecureRtType.Type, "Obfuscator type");
|
addTypeToBeRemoved(cliSecureRtType.Type, "Obfuscator type");
|
||||||
|
|
|
@ -193,7 +193,6 @@ namespace de4dot.code.deobfuscators.CodeVeil {
|
||||||
DeobfuscatedFile.stringDecryptersAdded();
|
DeobfuscatedFile.stringDecryptersAdded();
|
||||||
addModuleCctorInitCallToBeRemoved(stringDecrypter.InitMethod);
|
addModuleCctorInitCallToBeRemoved(stringDecrypter.InitMethod);
|
||||||
addCallToBeRemoved(mainType.getInitStringDecrypterMethod(stringDecrypter.InitMethod), stringDecrypter.InitMethod);
|
addCallToBeRemoved(mainType.getInitStringDecrypterMethod(stringDecrypter.InitMethod), stringDecrypter.InitMethod);
|
||||||
addTypeToBeRemoved(stringDecrypter.Type, "String decrypter type");
|
|
||||||
}
|
}
|
||||||
|
|
||||||
assemblyResolver = new AssemblyResolver(module);
|
assemblyResolver = new AssemblyResolver(module);
|
||||||
|
@ -248,6 +247,9 @@ namespace de4dot.code.deobfuscators.CodeVeil {
|
||||||
public override void deobfuscateEnd() {
|
public override void deobfuscateEnd() {
|
||||||
bool canRemoveProxyTypes = proxyDelegateFinder.CanRemoveTypes;
|
bool canRemoveProxyTypes = proxyDelegateFinder.CanRemoveTypes;
|
||||||
|
|
||||||
|
if (CanRemoveStringDecrypterType)
|
||||||
|
addTypeToBeRemoved(stringDecrypter.Type, "String decrypter type");
|
||||||
|
|
||||||
if (!mainType.Detected) {
|
if (!mainType.Detected) {
|
||||||
}
|
}
|
||||||
else if (mainType.Version >= ObfuscatorVersion.V5_0) {
|
else if (mainType.Version >= ObfuscatorVersion.V5_0) {
|
||||||
|
|
|
@ -171,7 +171,6 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
|
||||||
decryptResources();
|
decryptResources();
|
||||||
stringDecrypter.init(resourceDecrypter);
|
stringDecrypter.init(resourceDecrypter);
|
||||||
if (stringDecrypter.Method != null) {
|
if (stringDecrypter.Method != null) {
|
||||||
addResourceToBeRemoved(stringDecrypter.Resource, "Encrypted strings");
|
|
||||||
staticStringInliner.add(stringDecrypter.Method, (method, args) => {
|
staticStringInliner.add(stringDecrypter.Method, (method, args) => {
|
||||||
return stringDecrypter.decrypt((int)args[0]);
|
return stringDecrypter.decrypt((int)args[0]);
|
||||||
});
|
});
|
||||||
|
@ -191,7 +190,6 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
|
||||||
addTypeToBeRemoved(assemblyResolver.Type, "Assembly resolver type");
|
addTypeToBeRemoved(assemblyResolver.Type, "Assembly resolver type");
|
||||||
addTypeToBeRemoved(tamperDetection.Type, "Tamper detection type");
|
addTypeToBeRemoved(tamperDetection.Type, "Tamper detection type");
|
||||||
addTypeToBeRemoved(antiDebugger.Type, "Anti-debugger type");
|
addTypeToBeRemoved(antiDebugger.Type, "Anti-debugger type");
|
||||||
addTypeToBeRemoved(stringDecrypter.Type, "String decrypter type");
|
|
||||||
|
|
||||||
proxyDelegateFinder.find();
|
proxyDelegateFinder.find();
|
||||||
|
|
||||||
|
@ -205,6 +203,10 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
|
||||||
|
|
||||||
public override void deobfuscateEnd() {
|
public override void deobfuscateEnd() {
|
||||||
removeProxyDelegates(proxyDelegateFinder);
|
removeProxyDelegates(proxyDelegateFinder);
|
||||||
|
if (CanRemoveStringDecrypterType) {
|
||||||
|
addResourceToBeRemoved(stringDecrypter.Resource, "Encrypted strings");
|
||||||
|
addTypeToBeRemoved(stringDecrypter.Type, "String decrypter type");
|
||||||
|
}
|
||||||
base.deobfuscateEnd();
|
base.deobfuscateEnd();
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
@ -239,7 +239,7 @@ done:
|
||||||
if (options.RestoreFields)
|
if (options.RestoreFields)
|
||||||
addTypesToBeRemoved(fieldsRestorer.FieldStructs, "Type with moved fields");
|
addTypesToBeRemoved(fieldsRestorer.FieldStructs, "Type with moved fields");
|
||||||
|
|
||||||
if (Operations.DecryptStrings != OpDecryptString.None) {
|
if (CanRemoveStringDecrypterType) {
|
||||||
addMethodsToBeRemoved(stringDecrypter.DecrypterMethods, "String decrypter method");
|
addMethodsToBeRemoved(stringDecrypter.DecrypterMethods, "String decrypter method");
|
||||||
stringDecrypter.cleanup();
|
stringDecrypter.cleanup();
|
||||||
}
|
}
|
||||||
|
|
|
@ -90,6 +90,10 @@ namespace de4dot.code.deobfuscators {
|
||||||
get { return false; }
|
get { return false; }
|
||||||
}
|
}
|
||||||
|
|
||||||
|
protected bool CanRemoveStringDecrypterType {
|
||||||
|
get { return Operations.DecryptStrings != OpDecryptString.None && staticStringInliner.InlinedAllCalls; }
|
||||||
|
}
|
||||||
|
|
||||||
public virtual IMethodCallInliner MethodCallInliner {
|
public virtual IMethodCallInliner MethodCallInliner {
|
||||||
get {
|
get {
|
||||||
if (CanInlineMethods)
|
if (CanInlineMethods)
|
||||||
|
|
|
@ -120,7 +120,7 @@ namespace de4dot.code.deobfuscators.Dotfuscator {
|
||||||
}
|
}
|
||||||
|
|
||||||
public override void deobfuscateEnd() {
|
public override void deobfuscateEnd() {
|
||||||
if (Operations.DecryptStrings != OpDecryptString.None)
|
if (CanRemoveStringDecrypterType)
|
||||||
addMethodsToBeRemoved(stringDecrypter.StringDecrypters, "String decrypter method");
|
addMethodsToBeRemoved(stringDecrypter.StringDecrypters, "String decrypter method");
|
||||||
|
|
||||||
base.deobfuscateEnd();
|
base.deobfuscateEnd();
|
||||||
|
|
|
@ -536,7 +536,7 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
|
||||||
}
|
}
|
||||||
|
|
||||||
public override void deobfuscateEnd() {
|
public override void deobfuscateEnd() {
|
||||||
if (Operations.DecryptStrings == OpDecryptString.Dynamic) {
|
if (Operations.DecryptStrings == OpDecryptString.Dynamic && CanRemoveStringDecrypterType) {
|
||||||
addTypeToBeRemoved(decryptStringType, "String decrypter type");
|
addTypeToBeRemoved(decryptStringType, "String decrypter type");
|
||||||
findPossibleNamesToRemove(decryptStringMethod);
|
findPossibleNamesToRemove(decryptStringMethod);
|
||||||
addResources("Encrypted strings");
|
addResources("Encrypted strings");
|
||||||
|
|
|
@ -242,7 +242,7 @@ namespace de4dot.code.deobfuscators.Goliath_NET {
|
||||||
removeInlinedMethods();
|
removeInlinedMethods();
|
||||||
addTypesToBeRemoved(localsRestorer.Types, "Method locals obfuscation type");
|
addTypesToBeRemoved(localsRestorer.Types, "Method locals obfuscation type");
|
||||||
|
|
||||||
if (Operations.DecryptStrings != OpDecryptString.None) {
|
if (CanRemoveStringDecrypterType) {
|
||||||
removeDecrypterStuff(stringDecrypter, "String", "strings");
|
removeDecrypterStuff(stringDecrypter, "String", "strings");
|
||||||
addTypeToBeRemoved(stringDecrypter.StringStruct, "String struct");
|
addTypeToBeRemoved(stringDecrypter.StringStruct, "String struct");
|
||||||
}
|
}
|
||||||
|
|
|
@ -104,7 +104,7 @@ namespace de4dot.code.deobfuscators.Skater_NET {
|
||||||
}
|
}
|
||||||
|
|
||||||
public override void deobfuscateMethodEnd(Blocks blocks) {
|
public override void deobfuscateMethodEnd(Blocks blocks) {
|
||||||
if (Operations.DecryptStrings != OpDecryptString.None)
|
if (CanRemoveStringDecrypterType)
|
||||||
stringDecrypter.deobfuscate(blocks);
|
stringDecrypter.deobfuscate(blocks);
|
||||||
enumClassFinder.deobfuscate(blocks);
|
enumClassFinder.deobfuscate(blocks);
|
||||||
base.deobfuscateMethodEnd(blocks);
|
base.deobfuscateMethodEnd(blocks);
|
||||||
|
|
|
@ -515,14 +515,8 @@ namespace de4dot.code.deobfuscators.SmartAssembly {
|
||||||
addMethodsToBeRemoved(tamperProtectionRemover.PinvokeMethods, "Tamper protection PInvoke method");
|
addMethodsToBeRemoved(tamperProtectionRemover.PinvokeMethods, "Tamper protection PInvoke method");
|
||||||
}
|
}
|
||||||
|
|
||||||
bool canRemoveStringDecrypterStuff() {
|
|
||||||
if (!staticStringInliner.InlinedAllCalls)
|
|
||||||
return false;
|
|
||||||
return Operations.DecryptStrings != OpDecryptString.None;
|
|
||||||
}
|
|
||||||
|
|
||||||
void removeStringDecryptionStuff() {
|
void removeStringDecryptionStuff() {
|
||||||
if (!canRemoveStringDecrypterStuff())
|
if (!CanRemoveStringDecrypterType)
|
||||||
return;
|
return;
|
||||||
|
|
||||||
foreach (var decrypter in stringDecrypters) {
|
foreach (var decrypter in stringDecrypters) {
|
||||||
|
@ -539,7 +533,7 @@ namespace de4dot.code.deobfuscators.SmartAssembly {
|
||||||
}
|
}
|
||||||
|
|
||||||
void removeStringsInitCode(Blocks blocks) {
|
void removeStringsInitCode(Blocks blocks) {
|
||||||
if (!canRemoveStringDecrypterStuff())
|
if (!CanRemoveStringDecrypterType)
|
||||||
return;
|
return;
|
||||||
|
|
||||||
if (blocks.Method.Name == ".cctor") {
|
if (blocks.Method.Name == ".cctor") {
|
||||||
|
|
|
@ -104,7 +104,7 @@ namespace de4dot.code.deobfuscators.Xenocode {
|
||||||
}
|
}
|
||||||
|
|
||||||
public override void deobfuscateEnd() {
|
public override void deobfuscateEnd() {
|
||||||
if (Operations.DecryptStrings != OpDecryptString.None)
|
if (CanRemoveStringDecrypterType)
|
||||||
addTypeToBeRemoved(stringDecrypter.Type, "String decrypter type");
|
addTypeToBeRemoved(stringDecrypter.Type, "String decrypter type");
|
||||||
base.deobfuscateEnd();
|
base.deobfuscateEnd();
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in New Issue
Block a user