diff --git a/de4dot.code/deobfuscators/Agile_NET/MethodsDecrypter.cs b/de4dot.code/deobfuscators/Agile_NET/MethodsDecrypter.cs index abe05d3c..9a05b472 100644 --- a/de4dot.code/deobfuscators/Agile_NET/MethodsDecrypter.cs +++ b/de4dot.code/deobfuscators/Agile_NET/MethodsDecrypter.cs @@ -550,6 +550,7 @@ namespace de4dot.code.deobfuscators.Agile_NET { if (rva == 0) continue; uint bodyOffset = peImage.rvaToOffset(rva); + dm.mdRVA = peImage.offsetRead(offset + (uint)methodDefTable.fields[0].offset, methodDefTable.fields[0].size); dm.mdImplFlags = peImage.offsetReadUInt16(offset + (uint)methodDefTable.fields[1].offset); dm.mdFlags = peImage.offsetReadUInt16(offset + (uint)methodDefTable.fields[2].offset); dm.mdName = peImage.offsetRead(offset + (uint)methodDefTable.fields[3].offset, methodDefTable.fields[3].size); @@ -581,6 +582,7 @@ namespace de4dot.code.deobfuscators.Agile_NET { var dm = new DumpedMethod(); dm.token = 0x06000001 + (uint)i; + dm.mdRVA = peImage.offsetRead(offset + (uint)methodDefTable.fields[0].offset, methodDefTable.fields[0].size); dm.mdImplFlags = peImage.offsetReadUInt16(offset + (uint)methodDefTable.fields[1].offset); dm.mdFlags = peImage.offsetReadUInt16(offset + (uint)methodDefTable.fields[2].offset); dm.mdName = peImage.offsetRead(offset + (uint)methodDefTable.fields[3].offset, methodDefTable.fields[3].size); diff --git a/de4dot.code/deobfuscators/CodeVeil/MethodsDecrypter.cs b/de4dot.code/deobfuscators/CodeVeil/MethodsDecrypter.cs index 61bf1364..d9888304 100644 --- a/de4dot.code/deobfuscators/CodeVeil/MethodsDecrypter.cs +++ b/de4dot.code/deobfuscators/CodeVeil/MethodsDecrypter.cs @@ -162,6 +162,7 @@ namespace de4dot.code.deobfuscators.CodeVeil { var dm = new DumpedMethod(); dm.token = (uint)(0x06000001 + i); + dm.mdRVA = peImage.offsetRead(methodDefOffset + (uint)methodDef.fields[0].offset, methodDef.fields[0].size); dm.mdImplFlags = peImage.offsetReadUInt16(methodDefOffset + (uint)methodDef.fields[1].offset); dm.mdFlags = peImage.offsetReadUInt16(methodDefOffset + (uint)methodDef.fields[2].offset); dm.mdName = peImage.offsetRead(methodDefOffset + (uint)methodDef.fields[3].offset, methodDef.fields[3].size); diff --git a/de4dot.code/deobfuscators/CodeWall/MethodsDecrypter.cs b/de4dot.code/deobfuscators/CodeWall/MethodsDecrypter.cs index fd0c3fb6..c1507ba4 100644 --- a/de4dot.code/deobfuscators/CodeWall/MethodsDecrypter.cs +++ b/de4dot.code/deobfuscators/CodeWall/MethodsDecrypter.cs @@ -105,6 +105,7 @@ namespace de4dot.code.deobfuscators.CodeWall { else decrypt(code, seed); + dm.mdRVA = peImage.offsetRead(methodDefOffset + (uint)methodDef.fields[0].offset, methodDef.fields[0].size); dm.mdImplFlags = peImage.offsetReadUInt16(methodDefOffset + (uint)methodDef.fields[1].offset); dm.mdFlags = peImage.offsetReadUInt16(methodDefOffset + (uint)methodDef.fields[2].offset); dm.mdName = peImage.offsetRead(methodDefOffset + (uint)methodDef.fields[3].offset, methodDef.fields[3].size); diff --git a/de4dot.code/deobfuscators/MaxtoCode/MethodsDecrypter.cs b/de4dot.code/deobfuscators/MaxtoCode/MethodsDecrypter.cs index e7d67b35..9309c314 100644 --- a/de4dot.code/deobfuscators/MaxtoCode/MethodsDecrypter.cs +++ b/de4dot.code/deobfuscators/MaxtoCode/MethodsDecrypter.cs @@ -482,6 +482,7 @@ namespace de4dot.code.deobfuscators.MaxtoCode { var dm = new DumpedMethod(); dm.token = (uint)(0x06000001 + i); + dm.mdRVA = peImage.offsetRead(methodDefOffset + (uint)methodDef.fields[0].offset, methodDef.fields[0].size); dm.mdImplFlags = peImage.offsetReadUInt16(methodDefOffset + (uint)methodDef.fields[1].offset); dm.mdFlags = peImage.offsetReadUInt16(methodDefOffset + (uint)methodDef.fields[2].offset); dm.mdName = peImage.offsetRead(methodDefOffset + (uint)methodDef.fields[3].offset, methodDef.fields[3].size); diff --git a/de4dot.code/deobfuscators/dotNET_Reactor/v4/MethodsDecrypter.cs b/de4dot.code/deobfuscators/dotNET_Reactor/v4/MethodsDecrypter.cs index 0200540e..511dc4ae 100644 --- a/de4dot.code/deobfuscators/dotNET_Reactor/v4/MethodsDecrypter.cs +++ b/de4dot.code/deobfuscators/dotNET_Reactor/v4/MethodsDecrypter.cs @@ -237,6 +237,7 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 { offset = methodDef.fileOffset + (uint)(methodIndex * methodDef.totalSize); rva = peImage.offsetReadUInt32(offset); + dm.mdRVA = peImage.offsetRead(offset + (uint)methodDef.fields[0].offset, methodDef.fields[0].size); dm.mdImplFlags = peImage.offsetReadUInt16(offset + (uint)methodDef.fields[1].offset); dm.mdFlags = peImage.offsetReadUInt16(offset + (uint)methodDef.fields[2].offset); dm.mdName = peImage.offsetRead(offset + (uint)methodDef.fields[3].offset, methodDef.fields[3].size); diff --git a/de4dot.mdecrypt/DynamicMethodsDecrypter.cs b/de4dot.mdecrypt/DynamicMethodsDecrypter.cs index f92e11e4..5b2855af 100644 --- a/de4dot.mdecrypt/DynamicMethodsDecrypter.cs +++ b/de4dot.mdecrypt/DynamicMethodsDecrypter.cs @@ -424,6 +424,7 @@ namespace de4dot.mdecrypt { unsafe void updateFromMethodDefTableRow() { int methodIndex = (int)(ctx.dm.token - 0x06000001); byte* row = (byte*)methodDefTablePtr + methodIndex * methodDefTable.totalSize; + ctx.dm.mdRVA = read(row, methodDefTable.fields[0]); ctx.dm.mdImplFlags = (ushort)read(row, methodDefTable.fields[1]); ctx.dm.mdFlags = (ushort)read(row, methodDefTable.fields[2]); ctx.dm.mdName = read(row, methodDefTable.fields[3]);