monocul.us/de4dot-cex
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Support Confuser 1.9 r76101 proxy methods

Browse Source
This commit is contained in:
de4dot 2012-08-08 21:22:00 +02:00
parent 81e879e494
commit 4be2145cb6
1 changed files with 65 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

65
de4dot.code/deobfuscators/Confuser/ProxyCallFixer.cs
View File

@ -48,6 +48,8 @@ namespace de4dot.code.deobfuscators.Confuser {
v17_r74708_native,
v18_r75367_normal,
v18_r75367_native,
v19_r76101_normal,
v19_r76101_native,
}
enum ProxyCreatorType {
@ -212,10 +214,12 @@ namespace de4dot.code.deobfuscators.Confuser {
break;
case ConfuserVersion.v18_r75367_normal:
case ConfuserVersion.v19_r76101_normal:
getCallInfo_v18_r75367_normal(info, creatorInfo, out calledMethod, out callOpcode);
break;
case ConfuserVersion.v18_r75367_native:
case ConfuserVersion.v19_r76101_native:
getCallInfo_v18_r75367_native(info, creatorInfo, out calledMethod, out callOpcode);
break;
@ -500,6 +504,10 @@ namespace de4dot.code.deobfuscators.Confuser {
theVersion = ConfuserVersion.v18_r75367_native;
else if (findMagic_v18_r75367(method, out magic))
theVersion = ConfuserVersion.v18_r75367_normal;
else if (findMagic_v19_r76101(method, out magic))
theVersion = ConfuserVersion.v19_r76101_normal;
else if ((nativeMethod = findNativeMethod_v19_r76101(method)) != null)
theVersion = ConfuserVersion.v19_r76101_native;
else
continue;
}
@ -528,6 +536,63 @@ namespace de4dot.code.deobfuscators.Confuser {
}
}
static bool findMagic_v19_r76101(MethodDefinition method, out uint magic) {
var instrs = method.Body.Instructions;
for (int i = 0; i < instrs.Count - 7; i++) {
var ldci4_1 = instrs[i];
if (!DotNetUtils.isLdcI4(ldci4_1) || DotNetUtils.getLdcI4Value(ldci4_1) != 24)
continue;
if (instrs[i + 1].OpCode.Code != Code.Shl)
continue;
if (instrs[i + 2].OpCode.Code != Code.Or)
continue;
if (!DotNetUtils.isStloc(instrs[i + 3]))
continue;
if (!DotNetUtils.isLdloc(instrs[i + 4]))
continue;
if (!DotNetUtils.isLdloc(instrs[i + 5]))
continue;
var ldci4_2 = instrs[i + 6];
if (!DotNetUtils.isLdcI4(ldci4_2))
continue;
if (instrs[i + 7].OpCode.Code != Code.Xor)
continue;
magic = (uint)DotNetUtils.getLdcI4Value(ldci4_2);
return true;
}
magic = 0;
return false;
}
static MethodDefinition findNativeMethod_v19_r76101(MethodDefinition method) {
var instrs = method.Body.Instructions;
for (int i = 0; i < instrs.Count - 6; i++) {
var ldci4 = instrs[i];
if (!DotNetUtils.isLdcI4(ldci4) || DotNetUtils.getLdcI4Value(ldci4) != 24)
continue;
if (instrs[i + 1].OpCode.Code != Code.Shl)
continue;
if (instrs[i + 2].OpCode.Code != Code.Or)
continue;
if (!DotNetUtils.isStloc(instrs[i + 3]))
continue;
if (!DotNetUtils.isLdloc(instrs[i + 4]))
continue;
if (!DotNetUtils.isLdloc(instrs[i + 5]))
continue;
var call = instrs[i + 6];
if (call.OpCode.Code != Code.Call)
continue;
var calledMethod = call.Operand as MethodDefinition;
if (calledMethod == null || calledMethod.Body != null || !calledMethod.IsNative)
continue;
return calledMethod;
}
return null;
}
static bool findMagic_v18_r75367(MethodDefinition method, out uint magic) {
var instrs = method.Body.Instructions;
for (int i = 0; i < instrs.Count; i++) {