From 4393df31d906f15d4d0783ea52f4c92b23b66a62 Mon Sep 17 00:00:00 2001
From: de4dot <de4dot@gmail.com>
Date: Thu, 8 Nov 2012 07:07:02 +0100
Subject: [PATCH] Update detection of CSVM asm ref

---
 de4dot.code/deobfuscators/Agile_NET/vm/Csvm.cs | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/de4dot.code/deobfuscators/Agile_NET/vm/Csvm.cs b/de4dot.code/deobfuscators/Agile_NET/vm/Csvm.cs
index 5d22f5b4..2963eab3 100644
--- a/de4dot.code/deobfuscators/Agile_NET/vm/Csvm.cs
+++ b/de4dot.code/deobfuscators/Agile_NET/vm/Csvm.cs
@@ -63,7 +63,14 @@ namespace de4dot.code.deobfuscators.Agile_NET.vm {
 
 		AssemblyRef findVmAssemblyReference() {
 			foreach (var memberRef in module.GetMemberRefs()) {
-				if (!memberRef.IsMethodRef)
+				var sig = memberRef.MethodSig;
+				if (sig == null)
+					continue;
+				if (sig.RetType.GetElementType() != ElementType.Object)
+					continue;
+				if (sig.Params.Count != 2)
+					continue;
+				if (memberRef.Name != "RunMethod")
 					continue;
 				if (memberRef.FullName == "System.Object VMRuntime.Libraries.CSVMRuntime::RunMethod(System.String,System.Object[])")
 					return memberRef.DeclaringType.Scope as AssemblyRef;