From 48758be8f0efb7248346655dc9e8ea37b6b8a456 Mon Sep 17 00:00:00 2001 From: de4dot Date: Sat, 25 Feb 2012 06:14:19 +0100 Subject: [PATCH] Use a new class instead of the dict --- cecil | 2 +- de4dot.code/AssemblyModule.cs | 2 +- de4dot.code/ObfuscatedFile.cs | 4 ++-- de4dot.code/deobfuscators/CliSecure/Deobfuscator.cs | 2 +- de4dot.code/deobfuscators/CliSecure/MethodsDecrypter.cs | 6 +++--- de4dot.code/deobfuscators/CodeVeil/Deobfuscator.cs | 2 +- de4dot.code/deobfuscators/CodeVeil/MethodsDecrypter.cs | 8 ++++---- de4dot.code/deobfuscators/DeobfuscatorBase.cs | 2 +- de4dot.code/deobfuscators/IDeobfuscator.cs | 2 +- .../deobfuscators/dotNET_Reactor/v3/Deobfuscator.cs | 2 +- .../deobfuscators/dotNET_Reactor/v4/Deobfuscator.cs | 2 +- .../deobfuscators/dotNET_Reactor/v4/MethodsDecrypter.cs | 6 +++--- 12 files changed, 20 insertions(+), 20 deletions(-) diff --git a/cecil b/cecil index e7184059..a9c9bd7f 160000 --- a/cecil +++ b/cecil @@ -1 +1 @@ -Subproject commit e71840599636807d69b0b39e164ab7292b10fe23 +Subproject commit a9c9bd7f0cb8271c287e83d8a70678770ca0d078 diff --git a/de4dot.code/AssemblyModule.cs b/de4dot.code/AssemblyModule.cs index 6bc7856e..457f5aa7 100644 --- a/de4dot.code/AssemblyModule.cs +++ b/de4dot.code/AssemblyModule.cs @@ -62,7 +62,7 @@ namespace de4dot.code { module.Write(newFilename, writerParams); } - public ModuleDefinition reload(byte[] newModuleData, Dictionary dumpedMethods) { + public ModuleDefinition reload(byte[] newModuleData, DumpedMethods dumpedMethods) { AssemblyResolver.Instance.removeModule(module); DotNetUtils.typeCaches.invalidate(module); return setModule(ModuleDefinition.ReadModule(new MemoryStream(newModuleData), getReaderParameters(), dumpedMethods)); diff --git a/de4dot.code/ObfuscatedFile.cs b/de4dot.code/ObfuscatedFile.cs index 650ddf5a..3f79577d 100644 --- a/de4dot.code/ObfuscatedFile.cs +++ b/de4dot.code/ObfuscatedFile.cs @@ -363,7 +363,7 @@ namespace de4dot.code { initAssemblyClient(); byte[] fileData = null; - Dictionary dumpedMethods = null; + DumpedMethods dumpedMethods = null; if (deob.getDecryptedModule(ref fileData, ref dumpedMethods)) reloadModule(fileData, dumpedMethods); @@ -372,7 +372,7 @@ namespace de4dot.code { deob.deobfuscateEnd(); } - void reloadModule(byte[] newModuleData, Dictionary dumpedMethods) { + void reloadModule(byte[] newModuleData, DumpedMethods dumpedMethods) { Log.v("Reloading decrypted assembly (original filename: {0})", Filename); simpleDeobfuscatorFlags.Clear(); module = assemblyModule.reload(newModuleData, dumpedMethods); diff --git a/de4dot.code/deobfuscators/CliSecure/Deobfuscator.cs b/de4dot.code/deobfuscators/CliSecure/Deobfuscator.cs index 018cce9a..539cba8a 100644 --- a/de4dot.code/deobfuscators/CliSecure/Deobfuscator.cs +++ b/de4dot.code/deobfuscators/CliSecure/Deobfuscator.cs @@ -135,7 +135,7 @@ namespace de4dot.code.deobfuscators.CliSecure { } } - public override bool getDecryptedModule(ref byte[] newFileData, ref Dictionary dumpedMethods) { + public override bool getDecryptedModule(ref byte[] newFileData, ref DumpedMethods dumpedMethods) { if (!options.DecryptMethods) return false; diff --git a/de4dot.code/deobfuscators/CliSecure/MethodsDecrypter.cs b/de4dot.code/deobfuscators/CliSecure/MethodsDecrypter.cs index 5eee8586..0cf3974f 100644 --- a/de4dot.code/deobfuscators/CliSecure/MethodsDecrypter.cs +++ b/de4dot.code/deobfuscators/CliSecure/MethodsDecrypter.cs @@ -155,7 +155,7 @@ namespace de4dot.code.deobfuscators.CliSecure { } } - public bool decrypt(PeImage peImage, ref Dictionary dumpedMethods) { + public bool decrypt(PeImage peImage, ref DumpedMethods dumpedMethods) { this.peImage = peImage; uint offset = peImage.rvaToOffset(peImage.Cor20Header.metadataDirectory.virtualAddress + peImage.Cor20Header.metadataDirectory.size); @@ -179,7 +179,7 @@ namespace de4dot.code.deobfuscators.CliSecure { peImage.writeUint32(rva + 8, methodInfo.localVarSigTok); } - dumpedMethods = new Dictionary(); + dumpedMethods = new DumpedMethods(); offset = methodDefTable.fileOffset; for (int i = 0; i < methodInfos.Count; i++, offset += methodDefTable.totalSize) { var methodInfo = methodInfos[i]; @@ -211,7 +211,7 @@ namespace de4dot.code.deobfuscators.CliSecure { dm.mhLocalVarSigTok = peImage.readUInt32(rva + 8); } - dumpedMethods[dm.token] = dm; + dumpedMethods.add(dm); } return true; diff --git a/de4dot.code/deobfuscators/CodeVeil/Deobfuscator.cs b/de4dot.code/deobfuscators/CodeVeil/Deobfuscator.cs index 51219236..6f98e9ae 100644 --- a/de4dot.code/deobfuscators/CodeVeil/Deobfuscator.cs +++ b/de4dot.code/deobfuscators/CodeVeil/Deobfuscator.cs @@ -151,7 +151,7 @@ namespace de4dot.code.deobfuscators.CodeVeil { } } - public override bool getDecryptedModule(ref byte[] newFileData, ref Dictionary dumpedMethods) { + public override bool getDecryptedModule(ref byte[] newFileData, ref DumpedMethods dumpedMethods) { if (!methodsDecrypter.Detected) return false; diff --git a/de4dot.code/deobfuscators/CodeVeil/MethodsDecrypter.cs b/de4dot.code/deobfuscators/CodeVeil/MethodsDecrypter.cs index c1249b54..a8ffccfb 100644 --- a/de4dot.code/deobfuscators/CodeVeil/MethodsDecrypter.cs +++ b/de4dot.code/deobfuscators/CodeVeil/MethodsDecrypter.cs @@ -160,7 +160,7 @@ namespace de4dot.code.deobfuscators.CodeVeil { } } - public bool decrypt(byte[] fileData, ref Dictionary dumpedMethods) { + public bool decrypt(byte[] fileData, ref DumpedMethods dumpedMethods) { if (decrypter == null) return false; @@ -181,8 +181,8 @@ namespace de4dot.code.deobfuscators.CodeVeil { return true; } - Dictionary createDumpedMethods(PeImage peImage, byte[] fileData, byte[] methodsData) { - var dumpedMethods = new Dictionary(); + DumpedMethods createDumpedMethods(PeImage peImage, byte[] fileData, byte[] methodsData) { + var dumpedMethods = new DumpedMethods(); var methodsDataReader = new BinaryReader(new MemoryStream(methodsData)); var fileDataReader = new BinaryReader(new MemoryStream(fileData)); @@ -229,7 +229,7 @@ namespace de4dot.code.deobfuscators.CodeVeil { if (!decrypter.decrypt(fileDataReader, dm)) continue; - dumpedMethods[dm.token] = dm; + dumpedMethods.add(dm); } return dumpedMethods; diff --git a/de4dot.code/deobfuscators/DeobfuscatorBase.cs b/de4dot.code/deobfuscators/DeobfuscatorBase.cs index 38a2f391..8352a56a 100644 --- a/de4dot.code/deobfuscators/DeobfuscatorBase.cs +++ b/de4dot.code/deobfuscators/DeobfuscatorBase.cs @@ -137,7 +137,7 @@ namespace de4dot.code.deobfuscators { protected abstract void scanForObfuscator(); protected abstract int detectInternal(); - public virtual bool getDecryptedModule(ref byte[] newFileData, ref Dictionary dumpedMethods) { + public virtual bool getDecryptedModule(ref byte[] newFileData, ref DumpedMethods dumpedMethods) { return false; } diff --git a/de4dot.code/deobfuscators/IDeobfuscator.cs b/de4dot.code/deobfuscators/IDeobfuscator.cs index 6786cf1e..873394de 100644 --- a/de4dot.code/deobfuscators/IDeobfuscator.cs +++ b/de4dot.code/deobfuscators/IDeobfuscator.cs @@ -82,7 +82,7 @@ namespace de4dot.code.deobfuscators { // If the obfuscator has encrypted parts of the file, then this method should return the // decrypted file. true is returned if args have been initialized, false otherwise. - bool getDecryptedModule(ref byte[] newFileData, ref Dictionary dumpedMethods); + bool getDecryptedModule(ref byte[] newFileData, ref DumpedMethods dumpedMethods); // This is only called if getDecryptedModule() != null, and after the module has been // reloaded. Should return a new IDeobfuscator with the same options and the new module. diff --git a/de4dot.code/deobfuscators/dotNET_Reactor/v3/Deobfuscator.cs b/de4dot.code/deobfuscators/dotNET_Reactor/v3/Deobfuscator.cs index 1089cbd6..f4f880c4 100644 --- a/de4dot.code/deobfuscators/dotNET_Reactor/v3/Deobfuscator.cs +++ b/de4dot.code/deobfuscators/dotNET_Reactor/v3/Deobfuscator.cs @@ -141,7 +141,7 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v3 { return decrypterType.LinkedResource != null || nativeLibSaver.Resource != null; } - public override bool getDecryptedModule(ref byte[] newFileData, ref Dictionary dumpedMethods) { + public override bool getDecryptedModule(ref byte[] newFileData, ref DumpedMethods dumpedMethods) { if (!needsPatching()) return false; diff --git a/de4dot.code/deobfuscators/dotNET_Reactor/v4/Deobfuscator.cs b/de4dot.code/deobfuscators/dotNET_Reactor/v4/Deobfuscator.cs index 637602a4..353c1a83 100644 --- a/de4dot.code/deobfuscators/dotNET_Reactor/v4/Deobfuscator.cs +++ b/de4dot.code/deobfuscators/dotNET_Reactor/v4/Deobfuscator.cs @@ -362,7 +362,7 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 { return false; } - public override bool getDecryptedModule(ref byte[] newFileData, ref Dictionary dumpedMethods) { + public override bool getDecryptedModule(ref byte[] newFileData, ref DumpedMethods dumpedMethods) { fileData = ModuleBytes ?? DeobUtils.readModule(module); peImage = new PeImage(fileData); diff --git a/de4dot.code/deobfuscators/dotNET_Reactor/v4/MethodsDecrypter.cs b/de4dot.code/deobfuscators/dotNET_Reactor/v4/MethodsDecrypter.cs index 81848e98..e7c1ae8b 100644 --- a/de4dot.code/deobfuscators/dotNET_Reactor/v4/MethodsDecrypter.cs +++ b/de4dot.code/deobfuscators/dotNET_Reactor/v4/MethodsDecrypter.cs @@ -123,7 +123,7 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 { static short[] nativeLdci4 = new short[] { 0x55, 0x8B, 0xEC, 0xB8, -1, -1, -1, -1, 0x5D, 0xC3 }; static short[] nativeLdci4_0 = new short[] { 0x55, 0x8B, 0xEC, 0x33, 0xC0, 0x5D, 0xC3 }; - public bool decrypt(PeImage peImage, ISimpleDeobfuscator simpleDeobfuscator, ref Dictionary dumpedMethods, Dictionary tokenToNativeCode) { + public bool decrypt(PeImage peImage, ISimpleDeobfuscator simpleDeobfuscator, ref DumpedMethods dumpedMethods, Dictionary tokenToNativeCode) { if (encryptedResource.Method == null) return false; @@ -189,7 +189,7 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 { patchDwords(peImage, methodsDataReader, patchCount); int count = methodsDataReader.ReadInt32(); - dumpedMethods = new Dictionary(); + dumpedMethods = new DumpedMethods(); while (methodsDataReader.BaseStream.Position < methodsData.Length - 1) { uint rva = methodsDataReader.ReadUInt32(); uint index = methodsDataReader.ReadUInt32(); @@ -257,7 +257,7 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 { dm.mhLocalVarSigTok = peImage.readUInt32(rva + 8); } - dumpedMethods[dm.token] = dm; + dumpedMethods.add(dm); } }