monocul.us/de4dot-cex
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

getDecryptedModule() can now be called multiple times

Browse Source
This commit is contained in:
de4dot 2012-07-24 17:02:27 +02:00
parent c8477bdbce
commit 4374a08020
11 changed files with 26 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
de4dot.code/ObfuscatedFile.cs
View File

@ -372,10 +372,13 @@ namespace de4dot.code {
Log.n("Cleaning {0}", options.Filename);
initAssemblyClient();
byte[] fileData = null;
DumpedMethods dumpedMethods = null;
if (deob.getDecryptedModule(ref fileData, ref dumpedMethods))
for (int i = 0; ; i++) {
byte[] fileData = null;
DumpedMethods dumpedMethods = null;
if (!deob.getDecryptedModule(i, ref fileData, ref dumpedMethods))
break;
reloadModule(fileData, dumpedMethods);
}
deob.deobfuscateBegin();
deobfuscateMethods();

4
de4dot.code/deobfuscators/CliSecure/Deobfuscator.cs
View File

@ -205,8 +205,8 @@ namespace de4dot.code.deobfuscators.CliSecure {
}
}
public override bool getDecryptedModule(ref byte[] newFileData, ref DumpedMethods dumpedMethods) {
if (!options.DecryptMethods)
public override bool getDecryptedModule(int count, ref byte[] newFileData, ref DumpedMethods dumpedMethods) {
if (count != 0 || !options.DecryptMethods)
return false;
byte[] fileData = ModuleBytes ?? DeobUtils.readModule(module);

4
de4dot.code/deobfuscators/CodeFort/Deobfuscator.cs
View File

@ -107,8 +107,8 @@ namespace de4dot.code.deobfuscators.CodeFort {
assemblyDecrypter.find();
}
public override bool getDecryptedModule(ref byte[] newFileData, ref DumpedMethods dumpedMethods) {
if (!assemblyDecrypter.EncryptedDetected)
public override bool getDecryptedModule(int count, ref byte[] newFileData, ref DumpedMethods dumpedMethods) {
if (count != 0 || !assemblyDecrypter.EncryptedDetected)
return false;
newFileData = assemblyDecrypter.decrypt();

4
de4dot.code/deobfuscators/CodeVeil/Deobfuscator.cs
View File

@ -149,8 +149,8 @@ namespace de4dot.code.deobfuscators.CodeVeil {
}
}
public override bool getDecryptedModule(ref byte[] newFileData, ref DumpedMethods dumpedMethods) {
if (!methodsDecrypter.Detected)
public override bool getDecryptedModule(int count, ref byte[] newFileData, ref DumpedMethods dumpedMethods) {
if (count != 0 || !methodsDecrypter.Detected)
return false;
var fileData = DeobUtils.readModule(module);

4
de4dot.code/deobfuscators/CodeWall/Deobfuscator.cs
View File

@ -126,7 +126,9 @@ namespace de4dot.code.deobfuscators.CodeWall {
return null;
}
public override bool getDecryptedModule(ref byte[] newFileData, ref DumpedMethods dumpedMethods) {
public override bool getDecryptedModule(int count, ref byte[] newFileData, ref DumpedMethods dumpedMethods) {
if (count != 0)
return false;
if (!methodsDecrypter.Detected)
return false;

2
de4dot.code/deobfuscators/DeobfuscatorBase.cs
View File

@ -139,7 +139,7 @@ namespace de4dot.code.deobfuscators {
protected abstract void scanForObfuscator();
protected abstract int detectInternal();
public virtual bool getDecryptedModule(ref byte[] newFileData, ref DumpedMethods dumpedMethods) {
public virtual bool getDecryptedModule(int count, ref byte[] newFileData, ref DumpedMethods dumpedMethods) {
return false;
}

2
de4dot.code/deobfuscators/IDeobfuscator.cs
View File

@ -83,7 +83,7 @@ namespace de4dot.code.deobfuscators {
// If the obfuscator has encrypted parts of the file, then this method should return the
// decrypted file. true is returned if args have been initialized, false otherwise.
bool getDecryptedModule(ref byte[] newFileData, ref DumpedMethods dumpedMethods);
bool getDecryptedModule(int count, ref byte[] newFileData, ref DumpedMethods dumpedMethods);
// This is only called if getDecryptedModule() != null, and after the module has been
// reloaded. Should return a new IDeobfuscator with the same options and the new module.

4
de4dot.code/deobfuscators/MPRESS/Deobfuscator.cs
View File

@ -190,8 +190,8 @@ namespace de4dot.code.deobfuscators.MPRESS {
return false;
}
public override bool getDecryptedModule(ref byte[] newFileData, ref DumpedMethods dumpedMethods) {
if (version == Version.Unknown)
public override bool getDecryptedModule(int count, ref byte[] newFileData, ref DumpedMethods dumpedMethods) {
if (count != 0 || version == Version.Unknown)
return false;
byte[] fileData = ModuleBytes ?? DeobUtils.readModule(module);

4
de4dot.code/deobfuscators/MaxtoCode/Deobfuscator.cs
View File

@ -100,8 +100,8 @@ namespace de4dot.code.deobfuscators.MaxtoCode {
mainType.find();
}
public override bool getDecryptedModule(ref byte[] newFileData, ref DumpedMethods dumpedMethods) {
if (!mainType.Detected)
public override bool getDecryptedModule(int count, ref byte[] newFileData, ref DumpedMethods dumpedMethods) {
if (count != 0 || !mainType.Detected)
return false;
var fileData = DeobUtils.readModule(module);

4
de4dot.code/deobfuscators/dotNET_Reactor/v3/Deobfuscator.cs
View File

@ -141,8 +141,8 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v3 {
return decrypterType.LinkedResource != null || nativeLibSaver.Resource != null;
}
public override bool getDecryptedModule(ref byte[] newFileData, ref DumpedMethods dumpedMethods) {
if (!needsPatching())
public override bool getDecryptedModule(int count, ref byte[] newFileData, ref DumpedMethods dumpedMethods) {
if (count != 0 || !needsPatching())
return false;
var fileData = ModuleBytes ?? DeobUtils.readModule(module);

4
de4dot.code/deobfuscators/dotNET_Reactor/v4/Deobfuscator.cs
View File

@ -367,7 +367,9 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 {
return false;
}
public override bool getDecryptedModule(ref byte[] newFileData, ref DumpedMethods dumpedMethods) {
public override bool getDecryptedModule(int count, ref byte[] newFileData, ref DumpedMethods dumpedMethods) {
if (count != 0)
return false;
fileData = ModuleBytes ?? DeobUtils.readModule(module);
peImage = new PeImage(fileData);