monocul.us/de4dot-cex
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Use a new class instead of the dict

Browse Source
This commit is contained in:
de4dot 2012-02-25 06:14:19 +01:00
parent d09938ca47
commit 48758be8f0
12 changed files with 20 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
cecil

@ -1 +1 @@
Subproject commit e71840599636807d69b0b39e164ab7292b10fe23
Subproject commit a9c9bd7f0cb8271c287e83d8a70678770ca0d078

2
de4dot.code/AssemblyModule.cs
View File

@ -62,7 +62,7 @@ namespace de4dot.code {
module.Write(newFilename, writerParams);
}
public ModuleDefinition reload(byte[] newModuleData, Dictionary<uint, DumpedMethod> dumpedMethods) {
public ModuleDefinition reload(byte[] newModuleData, DumpedMethods dumpedMethods) {
AssemblyResolver.Instance.removeModule(module);
DotNetUtils.typeCaches.invalidate(module);
return setModule(ModuleDefinition.ReadModule(new MemoryStream(newModuleData), getReaderParameters(), dumpedMethods));

4
de4dot.code/ObfuscatedFile.cs
View File

@ -363,7 +363,7 @@ namespace de4dot.code {
initAssemblyClient();
byte[] fileData = null;
Dictionary<uint, DumpedMethod> dumpedMethods = null;
DumpedMethods dumpedMethods = null;
if (deob.getDecryptedModule(ref fileData, ref dumpedMethods))
reloadModule(fileData, dumpedMethods);
@ -372,7 +372,7 @@ namespace de4dot.code {
deob.deobfuscateEnd();
}
void reloadModule(byte[] newModuleData, Dictionary<uint, DumpedMethod> dumpedMethods) {
void reloadModule(byte[] newModuleData, DumpedMethods dumpedMethods) {
Log.v("Reloading decrypted assembly (original filename: {0})", Filename);
simpleDeobfuscatorFlags.Clear();
module = assemblyModule.reload(newModuleData, dumpedMethods);

2
de4dot.code/deobfuscators/CliSecure/Deobfuscator.cs
View File

@ -135,7 +135,7 @@ namespace de4dot.code.deobfuscators.CliSecure {
}
}
public override bool getDecryptedModule(ref byte[] newFileData, ref Dictionary<uint, DumpedMethod> dumpedMethods) {
public override bool getDecryptedModule(ref byte[] newFileData, ref DumpedMethods dumpedMethods) {
if (!options.DecryptMethods)
return false;

6
de4dot.code/deobfuscators/CliSecure/MethodsDecrypter.cs
View File

@ -155,7 +155,7 @@ namespace de4dot.code.deobfuscators.CliSecure {
}
}
public bool decrypt(PeImage peImage, ref Dictionary<uint, DumpedMethod> dumpedMethods) {
public bool decrypt(PeImage peImage, ref DumpedMethods dumpedMethods) {
this.peImage = peImage;
uint offset = peImage.rvaToOffset(peImage.Cor20Header.metadataDirectory.virtualAddress + peImage.Cor20Header.metadataDirectory.size);
@ -179,7 +179,7 @@ namespace de4dot.code.deobfuscators.CliSecure {
peImage.writeUint32(rva + 8, methodInfo.localVarSigTok);
}
dumpedMethods = new Dictionary<uint, DumpedMethod>();
dumpedMethods = new DumpedMethods();
offset = methodDefTable.fileOffset;
for (int i = 0; i < methodInfos.Count; i++, offset += methodDefTable.totalSize) {
var methodInfo = methodInfos[i];
@ -211,7 +211,7 @@ namespace de4dot.code.deobfuscators.CliSecure {
dm.mhLocalVarSigTok = peImage.readUInt32(rva + 8);
}
dumpedMethods[dm.token] = dm;
dumpedMethods.add(dm);
}
return true;

2
de4dot.code/deobfuscators/CodeVeil/Deobfuscator.cs
View File

@ -151,7 +151,7 @@ namespace de4dot.code.deobfuscators.CodeVeil {
}
}
public override bool getDecryptedModule(ref byte[] newFileData, ref Dictionary<uint, DumpedMethod> dumpedMethods) {
public override bool getDecryptedModule(ref byte[] newFileData, ref DumpedMethods dumpedMethods) {
if (!methodsDecrypter.Detected)
return false;

8
de4dot.code/deobfuscators/CodeVeil/MethodsDecrypter.cs
View File

@ -160,7 +160,7 @@ namespace de4dot.code.deobfuscators.CodeVeil {
}
}
public bool decrypt(byte[] fileData, ref Dictionary<uint, DumpedMethod> dumpedMethods) {
public bool decrypt(byte[] fileData, ref DumpedMethods dumpedMethods) {
if (decrypter == null)
return false;
@ -181,8 +181,8 @@ namespace de4dot.code.deobfuscators.CodeVeil {
return true;
}
Dictionary<uint, DumpedMethod> createDumpedMethods(PeImage peImage, byte[] fileData, byte[] methodsData) {
var dumpedMethods = new Dictionary<uint, DumpedMethod>();
DumpedMethods createDumpedMethods(PeImage peImage, byte[] fileData, byte[] methodsData) {
var dumpedMethods = new DumpedMethods();
var methodsDataReader = new BinaryReader(new MemoryStream(methodsData));
var fileDataReader = new BinaryReader(new MemoryStream(fileData));
@ -229,7 +229,7 @@ namespace de4dot.code.deobfuscators.CodeVeil {
if (!decrypter.decrypt(fileDataReader, dm))
continue;
dumpedMethods[dm.token] = dm;
dumpedMethods.add(dm);
}
return dumpedMethods;

2
de4dot.code/deobfuscators/DeobfuscatorBase.cs
View File

@ -137,7 +137,7 @@ namespace de4dot.code.deobfuscators {
protected abstract void scanForObfuscator();
protected abstract int detectInternal();
public virtual bool getDecryptedModule(ref byte[] newFileData, ref Dictionary<uint, DumpedMethod> dumpedMethods) {
public virtual bool getDecryptedModule(ref byte[] newFileData, ref DumpedMethods dumpedMethods) {
return false;
}

2
de4dot.code/deobfuscators/IDeobfuscator.cs
View File

@ -82,7 +82,7 @@ namespace de4dot.code.deobfuscators {
// If the obfuscator has encrypted parts of the file, then this method should return the
// decrypted file. true is returned if args have been initialized, false otherwise.
bool getDecryptedModule(ref byte[] newFileData, ref Dictionary<uint, DumpedMethod> dumpedMethods);
bool getDecryptedModule(ref byte[] newFileData, ref DumpedMethods dumpedMethods);
// This is only called if getDecryptedModule() != null, and after the module has been
// reloaded. Should return a new IDeobfuscator with the same options and the new module.

2
de4dot.code/deobfuscators/dotNET_Reactor/v3/Deobfuscator.cs
View File

@ -141,7 +141,7 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v3 {
return decrypterType.LinkedResource != null || nativeLibSaver.Resource != null;
}
public override bool getDecryptedModule(ref byte[] newFileData, ref Dictionary<uint, DumpedMethod> dumpedMethods) {
public override bool getDecryptedModule(ref byte[] newFileData, ref DumpedMethods dumpedMethods) {
if (!needsPatching())
return false;

2
de4dot.code/deobfuscators/dotNET_Reactor/v4/Deobfuscator.cs
View File

@ -362,7 +362,7 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 {
return false;
}
public override bool getDecryptedModule(ref byte[] newFileData, ref Dictionary<uint, DumpedMethod> dumpedMethods) {
public override bool getDecryptedModule(ref byte[] newFileData, ref DumpedMethods dumpedMethods) {
fileData = ModuleBytes ?? DeobUtils.readModule(module);
peImage = new PeImage(fileData);

6
de4dot.code/deobfuscators/dotNET_Reactor/v4/MethodsDecrypter.cs
View File

@ -123,7 +123,7 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 {
static short[] nativeLdci4 = new short[] { 0x55, 0x8B, 0xEC, 0xB8, -1, -1, -1, -1, 0x5D, 0xC3 };
static short[] nativeLdci4_0 = new short[] { 0x55, 0x8B, 0xEC, 0x33, 0xC0, 0x5D, 0xC3 };
public bool decrypt(PeImage peImage, ISimpleDeobfuscator simpleDeobfuscator, ref Dictionary<uint, DumpedMethod> dumpedMethods, Dictionary<uint,byte[]> tokenToNativeCode) {
public bool decrypt(PeImage peImage, ISimpleDeobfuscator simpleDeobfuscator, ref DumpedMethods dumpedMethods, Dictionary<uint, byte[]> tokenToNativeCode) {
if (encryptedResource.Method == null)
return false;
@ -189,7 +189,7 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 {
patchDwords(peImage, methodsDataReader, patchCount);
int count = methodsDataReader.ReadInt32();
dumpedMethods = new Dictionary<uint, DumpedMethod>();
dumpedMethods = new DumpedMethods();
while (methodsDataReader.BaseStream.Position < methodsData.Length - 1) {
uint rva = methodsDataReader.ReadUInt32();
uint index = methodsDataReader.ReadUInt32();
@ -257,7 +257,7 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 {
dm.mhLocalVarSigTok = peImage.readUInt32(rva + 8);
}
dumpedMethods[dm.token] = dm;
dumpedMethods.add(dm);
}
}