monocul.us/de4dot-cex
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Initialize DumpedMethod.mdRVA

Browse Source
This commit is contained in:
de4dot 2012-11-07 00:26:36 +01:00
parent 0f414d4d44
commit 4be7e4fe46
6 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
de4dot.code/deobfuscators/Agile_NET/MethodsDecrypter.cs
View File

@ -550,6 +550,7 @@ namespace de4dot.code.deobfuscators.Agile_NET {
if (rva == 0)
continue;
uint bodyOffset = peImage.rvaToOffset(rva);
dm.mdRVA = peImage.offsetRead(offset + (uint)methodDefTable.fields[0].offset, methodDefTable.fields[0].size);
dm.mdImplFlags = peImage.offsetReadUInt16(offset + (uint)methodDefTable.fields[1].offset);
dm.mdFlags = peImage.offsetReadUInt16(offset + (uint)methodDefTable.fields[2].offset);
dm.mdName = peImage.offsetRead(offset + (uint)methodDefTable.fields[3].offset, methodDefTable.fields[3].size);
@ -581,6 +582,7 @@ namespace de4dot.code.deobfuscators.Agile_NET {
var dm = new DumpedMethod();
dm.token = 0x06000001 + (uint)i;
dm.mdRVA = peImage.offsetRead(offset + (uint)methodDefTable.fields[0].offset, methodDefTable.fields[0].size);
dm.mdImplFlags = peImage.offsetReadUInt16(offset + (uint)methodDefTable.fields[1].offset);
dm.mdFlags = peImage.offsetReadUInt16(offset + (uint)methodDefTable.fields[2].offset);
dm.mdName = peImage.offsetRead(offset + (uint)methodDefTable.fields[3].offset, methodDefTable.fields[3].size);

1
de4dot.code/deobfuscators/CodeVeil/MethodsDecrypter.cs
View File

@ -162,6 +162,7 @@ namespace de4dot.code.deobfuscators.CodeVeil {
var dm = new DumpedMethod();
dm.token = (uint)(0x06000001 + i);
dm.mdRVA = peImage.offsetRead(methodDefOffset + (uint)methodDef.fields[0].offset, methodDef.fields[0].size);
dm.mdImplFlags = peImage.offsetReadUInt16(methodDefOffset + (uint)methodDef.fields[1].offset);
dm.mdFlags = peImage.offsetReadUInt16(methodDefOffset + (uint)methodDef.fields[2].offset);
dm.mdName = peImage.offsetRead(methodDefOffset + (uint)methodDef.fields[3].offset, methodDef.fields[3].size);

1
de4dot.code/deobfuscators/CodeWall/MethodsDecrypter.cs
View File

@ -105,6 +105,7 @@ namespace de4dot.code.deobfuscators.CodeWall {
else
decrypt(code, seed);
dm.mdRVA = peImage.offsetRead(methodDefOffset + (uint)methodDef.fields[0].offset, methodDef.fields[0].size);
dm.mdImplFlags = peImage.offsetReadUInt16(methodDefOffset + (uint)methodDef.fields[1].offset);
dm.mdFlags = peImage.offsetReadUInt16(methodDefOffset + (uint)methodDef.fields[2].offset);
dm.mdName = peImage.offsetRead(methodDefOffset + (uint)methodDef.fields[3].offset, methodDef.fields[3].size);

1
de4dot.code/deobfuscators/MaxtoCode/MethodsDecrypter.cs
View File

@ -482,6 +482,7 @@ namespace de4dot.code.deobfuscators.MaxtoCode {
var dm = new DumpedMethod();
dm.token = (uint)(0x06000001 + i);
dm.mdRVA = peImage.offsetRead(methodDefOffset + (uint)methodDef.fields[0].offset, methodDef.fields[0].size);
dm.mdImplFlags = peImage.offsetReadUInt16(methodDefOffset + (uint)methodDef.fields[1].offset);
dm.mdFlags = peImage.offsetReadUInt16(methodDefOffset + (uint)methodDef.fields[2].offset);
dm.mdName = peImage.offsetRead(methodDefOffset + (uint)methodDef.fields[3].offset, methodDef.fields[3].size);

1
de4dot.code/deobfuscators/dotNET_Reactor/v4/MethodsDecrypter.cs
View File

@ -237,6 +237,7 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 {
offset = methodDef.fileOffset + (uint)(methodIndex * methodDef.totalSize);
rva = peImage.offsetReadUInt32(offset);
dm.mdRVA = peImage.offsetRead(offset + (uint)methodDef.fields[0].offset, methodDef.fields[0].size);
dm.mdImplFlags = peImage.offsetReadUInt16(offset + (uint)methodDef.fields[1].offset);
dm.mdFlags = peImage.offsetReadUInt16(offset + (uint)methodDef.fields[2].offset);
dm.mdName = peImage.offsetRead(offset + (uint)methodDef.fields[3].offset, methodDef.fields[3].size);

1
de4dot.mdecrypt/DynamicMethodsDecrypter.cs
View File

@ -424,6 +424,7 @@ namespace de4dot.mdecrypt {
unsafe void updateFromMethodDefTableRow() {
int methodIndex = (int)(ctx.dm.token - 0x06000001);
byte* row = (byte*)methodDefTablePtr + methodIndex * methodDefTable.totalSize;
ctx.dm.mdRVA = read(row, methodDefTable.fields[0]);
ctx.dm.mdImplFlags = (ushort)read(row, methodDefTable.fields[1]);
ctx.dm.mdFlags = (ushort)read(row, methodDefTable.fields[2]);
ctx.dm.mdName = read(row, methodDefTable.fields[3]);