diff --git a/de4dot.code/ObfuscatedFile.cs b/de4dot.code/ObfuscatedFile.cs index e120a1ef..f20e39b8 100644 --- a/de4dot.code/ObfuscatedFile.cs +++ b/de4dot.code/ObfuscatedFile.cs @@ -372,10 +372,13 @@ namespace de4dot.code { Log.n("Cleaning {0}", options.Filename); initAssemblyClient(); - byte[] fileData = null; - DumpedMethods dumpedMethods = null; - if (deob.getDecryptedModule(ref fileData, ref dumpedMethods)) + for (int i = 0; ; i++) { + byte[] fileData = null; + DumpedMethods dumpedMethods = null; + if (!deob.getDecryptedModule(i, ref fileData, ref dumpedMethods)) + break; reloadModule(fileData, dumpedMethods); + } deob.deobfuscateBegin(); deobfuscateMethods(); diff --git a/de4dot.code/deobfuscators/CliSecure/Deobfuscator.cs b/de4dot.code/deobfuscators/CliSecure/Deobfuscator.cs index 05c96375..bf820c97 100644 --- a/de4dot.code/deobfuscators/CliSecure/Deobfuscator.cs +++ b/de4dot.code/deobfuscators/CliSecure/Deobfuscator.cs @@ -205,8 +205,8 @@ namespace de4dot.code.deobfuscators.CliSecure { } } - public override bool getDecryptedModule(ref byte[] newFileData, ref DumpedMethods dumpedMethods) { - if (!options.DecryptMethods) + public override bool getDecryptedModule(int count, ref byte[] newFileData, ref DumpedMethods dumpedMethods) { + if (count != 0 || !options.DecryptMethods) return false; byte[] fileData = ModuleBytes ?? DeobUtils.readModule(module); diff --git a/de4dot.code/deobfuscators/CodeFort/Deobfuscator.cs b/de4dot.code/deobfuscators/CodeFort/Deobfuscator.cs index 796d0e5e..05d83a8b 100644 --- a/de4dot.code/deobfuscators/CodeFort/Deobfuscator.cs +++ b/de4dot.code/deobfuscators/CodeFort/Deobfuscator.cs @@ -107,8 +107,8 @@ namespace de4dot.code.deobfuscators.CodeFort { assemblyDecrypter.find(); } - public override bool getDecryptedModule(ref byte[] newFileData, ref DumpedMethods dumpedMethods) { - if (!assemblyDecrypter.EncryptedDetected) + public override bool getDecryptedModule(int count, ref byte[] newFileData, ref DumpedMethods dumpedMethods) { + if (count != 0 || !assemblyDecrypter.EncryptedDetected) return false; newFileData = assemblyDecrypter.decrypt(); diff --git a/de4dot.code/deobfuscators/CodeVeil/Deobfuscator.cs b/de4dot.code/deobfuscators/CodeVeil/Deobfuscator.cs index 56f26a1d..9d251ea1 100644 --- a/de4dot.code/deobfuscators/CodeVeil/Deobfuscator.cs +++ b/de4dot.code/deobfuscators/CodeVeil/Deobfuscator.cs @@ -149,8 +149,8 @@ namespace de4dot.code.deobfuscators.CodeVeil { } } - public override bool getDecryptedModule(ref byte[] newFileData, ref DumpedMethods dumpedMethods) { - if (!methodsDecrypter.Detected) + public override bool getDecryptedModule(int count, ref byte[] newFileData, ref DumpedMethods dumpedMethods) { + if (count != 0 || !methodsDecrypter.Detected) return false; var fileData = DeobUtils.readModule(module); diff --git a/de4dot.code/deobfuscators/CodeWall/Deobfuscator.cs b/de4dot.code/deobfuscators/CodeWall/Deobfuscator.cs index 43499342..da90bab5 100644 --- a/de4dot.code/deobfuscators/CodeWall/Deobfuscator.cs +++ b/de4dot.code/deobfuscators/CodeWall/Deobfuscator.cs @@ -126,7 +126,9 @@ namespace de4dot.code.deobfuscators.CodeWall { return null; } - public override bool getDecryptedModule(ref byte[] newFileData, ref DumpedMethods dumpedMethods) { + public override bool getDecryptedModule(int count, ref byte[] newFileData, ref DumpedMethods dumpedMethods) { + if (count != 0) + return false; if (!methodsDecrypter.Detected) return false; diff --git a/de4dot.code/deobfuscators/DeobfuscatorBase.cs b/de4dot.code/deobfuscators/DeobfuscatorBase.cs index 888b92ce..7a67add7 100644 --- a/de4dot.code/deobfuscators/DeobfuscatorBase.cs +++ b/de4dot.code/deobfuscators/DeobfuscatorBase.cs @@ -139,7 +139,7 @@ namespace de4dot.code.deobfuscators { protected abstract void scanForObfuscator(); protected abstract int detectInternal(); - public virtual bool getDecryptedModule(ref byte[] newFileData, ref DumpedMethods dumpedMethods) { + public virtual bool getDecryptedModule(int count, ref byte[] newFileData, ref DumpedMethods dumpedMethods) { return false; } diff --git a/de4dot.code/deobfuscators/IDeobfuscator.cs b/de4dot.code/deobfuscators/IDeobfuscator.cs index 50f8a7e0..dd852c71 100644 --- a/de4dot.code/deobfuscators/IDeobfuscator.cs +++ b/de4dot.code/deobfuscators/IDeobfuscator.cs @@ -83,7 +83,7 @@ namespace de4dot.code.deobfuscators { // If the obfuscator has encrypted parts of the file, then this method should return the // decrypted file. true is returned if args have been initialized, false otherwise. - bool getDecryptedModule(ref byte[] newFileData, ref DumpedMethods dumpedMethods); + bool getDecryptedModule(int count, ref byte[] newFileData, ref DumpedMethods dumpedMethods); // This is only called if getDecryptedModule() != null, and after the module has been // reloaded. Should return a new IDeobfuscator with the same options and the new module. diff --git a/de4dot.code/deobfuscators/MPRESS/Deobfuscator.cs b/de4dot.code/deobfuscators/MPRESS/Deobfuscator.cs index 3cb18f7c..3dd063b5 100644 --- a/de4dot.code/deobfuscators/MPRESS/Deobfuscator.cs +++ b/de4dot.code/deobfuscators/MPRESS/Deobfuscator.cs @@ -190,8 +190,8 @@ namespace de4dot.code.deobfuscators.MPRESS { return false; } - public override bool getDecryptedModule(ref byte[] newFileData, ref DumpedMethods dumpedMethods) { - if (version == Version.Unknown) + public override bool getDecryptedModule(int count, ref byte[] newFileData, ref DumpedMethods dumpedMethods) { + if (count != 0 || version == Version.Unknown) return false; byte[] fileData = ModuleBytes ?? DeobUtils.readModule(module); diff --git a/de4dot.code/deobfuscators/MaxtoCode/Deobfuscator.cs b/de4dot.code/deobfuscators/MaxtoCode/Deobfuscator.cs index 4546c849..fd6d799a 100644 --- a/de4dot.code/deobfuscators/MaxtoCode/Deobfuscator.cs +++ b/de4dot.code/deobfuscators/MaxtoCode/Deobfuscator.cs @@ -100,8 +100,8 @@ namespace de4dot.code.deobfuscators.MaxtoCode { mainType.find(); } - public override bool getDecryptedModule(ref byte[] newFileData, ref DumpedMethods dumpedMethods) { - if (!mainType.Detected) + public override bool getDecryptedModule(int count, ref byte[] newFileData, ref DumpedMethods dumpedMethods) { + if (count != 0 || !mainType.Detected) return false; var fileData = DeobUtils.readModule(module); diff --git a/de4dot.code/deobfuscators/dotNET_Reactor/v3/Deobfuscator.cs b/de4dot.code/deobfuscators/dotNET_Reactor/v3/Deobfuscator.cs index 150c96be..21259a55 100644 --- a/de4dot.code/deobfuscators/dotNET_Reactor/v3/Deobfuscator.cs +++ b/de4dot.code/deobfuscators/dotNET_Reactor/v3/Deobfuscator.cs @@ -141,8 +141,8 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v3 { return decrypterType.LinkedResource != null || nativeLibSaver.Resource != null; } - public override bool getDecryptedModule(ref byte[] newFileData, ref DumpedMethods dumpedMethods) { - if (!needsPatching()) + public override bool getDecryptedModule(int count, ref byte[] newFileData, ref DumpedMethods dumpedMethods) { + if (count != 0 || !needsPatching()) return false; var fileData = ModuleBytes ?? DeobUtils.readModule(module); diff --git a/de4dot.code/deobfuscators/dotNET_Reactor/v4/Deobfuscator.cs b/de4dot.code/deobfuscators/dotNET_Reactor/v4/Deobfuscator.cs index a12a0154..9650b71f 100644 --- a/de4dot.code/deobfuscators/dotNET_Reactor/v4/Deobfuscator.cs +++ b/de4dot.code/deobfuscators/dotNET_Reactor/v4/Deobfuscator.cs @@ -367,7 +367,9 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 { return false; } - public override bool getDecryptedModule(ref byte[] newFileData, ref DumpedMethods dumpedMethods) { + public override bool getDecryptedModule(int count, ref byte[] newFileData, ref DumpedMethods dumpedMethods) { + if (count != 0) + return false; fileData = ModuleBytes ?? DeobUtils.readModule(module); peImage = new PeImage(fileData);