Initialize DumpedMethod.mdRVA
This commit is contained in:
parent
0f414d4d44
commit
4be7e4fe46
|
@ -550,6 +550,7 @@ namespace de4dot.code.deobfuscators.Agile_NET {
|
|||
if (rva == 0)
|
||||
continue;
|
||||
uint bodyOffset = peImage.rvaToOffset(rva);
|
||||
dm.mdRVA = peImage.offsetRead(offset + (uint)methodDefTable.fields[0].offset, methodDefTable.fields[0].size);
|
||||
dm.mdImplFlags = peImage.offsetReadUInt16(offset + (uint)methodDefTable.fields[1].offset);
|
||||
dm.mdFlags = peImage.offsetReadUInt16(offset + (uint)methodDefTable.fields[2].offset);
|
||||
dm.mdName = peImage.offsetRead(offset + (uint)methodDefTable.fields[3].offset, methodDefTable.fields[3].size);
|
||||
|
@ -581,6 +582,7 @@ namespace de4dot.code.deobfuscators.Agile_NET {
|
|||
var dm = new DumpedMethod();
|
||||
dm.token = 0x06000001 + (uint)i;
|
||||
|
||||
dm.mdRVA = peImage.offsetRead(offset + (uint)methodDefTable.fields[0].offset, methodDefTable.fields[0].size);
|
||||
dm.mdImplFlags = peImage.offsetReadUInt16(offset + (uint)methodDefTable.fields[1].offset);
|
||||
dm.mdFlags = peImage.offsetReadUInt16(offset + (uint)methodDefTable.fields[2].offset);
|
||||
dm.mdName = peImage.offsetRead(offset + (uint)methodDefTable.fields[3].offset, methodDefTable.fields[3].size);
|
||||
|
|
|
@ -162,6 +162,7 @@ namespace de4dot.code.deobfuscators.CodeVeil {
|
|||
|
||||
var dm = new DumpedMethod();
|
||||
dm.token = (uint)(0x06000001 + i);
|
||||
dm.mdRVA = peImage.offsetRead(methodDefOffset + (uint)methodDef.fields[0].offset, methodDef.fields[0].size);
|
||||
dm.mdImplFlags = peImage.offsetReadUInt16(methodDefOffset + (uint)methodDef.fields[1].offset);
|
||||
dm.mdFlags = peImage.offsetReadUInt16(methodDefOffset + (uint)methodDef.fields[2].offset);
|
||||
dm.mdName = peImage.offsetRead(methodDefOffset + (uint)methodDef.fields[3].offset, methodDef.fields[3].size);
|
||||
|
|
|
@ -105,6 +105,7 @@ namespace de4dot.code.deobfuscators.CodeWall {
|
|||
else
|
||||
decrypt(code, seed);
|
||||
|
||||
dm.mdRVA = peImage.offsetRead(methodDefOffset + (uint)methodDef.fields[0].offset, methodDef.fields[0].size);
|
||||
dm.mdImplFlags = peImage.offsetReadUInt16(methodDefOffset + (uint)methodDef.fields[1].offset);
|
||||
dm.mdFlags = peImage.offsetReadUInt16(methodDefOffset + (uint)methodDef.fields[2].offset);
|
||||
dm.mdName = peImage.offsetRead(methodDefOffset + (uint)methodDef.fields[3].offset, methodDef.fields[3].size);
|
||||
|
|
|
@ -482,6 +482,7 @@ namespace de4dot.code.deobfuscators.MaxtoCode {
|
|||
|
||||
var dm = new DumpedMethod();
|
||||
dm.token = (uint)(0x06000001 + i);
|
||||
dm.mdRVA = peImage.offsetRead(methodDefOffset + (uint)methodDef.fields[0].offset, methodDef.fields[0].size);
|
||||
dm.mdImplFlags = peImage.offsetReadUInt16(methodDefOffset + (uint)methodDef.fields[1].offset);
|
||||
dm.mdFlags = peImage.offsetReadUInt16(methodDefOffset + (uint)methodDef.fields[2].offset);
|
||||
dm.mdName = peImage.offsetRead(methodDefOffset + (uint)methodDef.fields[3].offset, methodDef.fields[3].size);
|
||||
|
|
|
@ -237,6 +237,7 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 {
|
|||
|
||||
offset = methodDef.fileOffset + (uint)(methodIndex * methodDef.totalSize);
|
||||
rva = peImage.offsetReadUInt32(offset);
|
||||
dm.mdRVA = peImage.offsetRead(offset + (uint)methodDef.fields[0].offset, methodDef.fields[0].size);
|
||||
dm.mdImplFlags = peImage.offsetReadUInt16(offset + (uint)methodDef.fields[1].offset);
|
||||
dm.mdFlags = peImage.offsetReadUInt16(offset + (uint)methodDef.fields[2].offset);
|
||||
dm.mdName = peImage.offsetRead(offset + (uint)methodDef.fields[3].offset, methodDef.fields[3].size);
|
||||
|
|
|
@ -424,6 +424,7 @@ namespace de4dot.mdecrypt {
|
|||
unsafe void updateFromMethodDefTableRow() {
|
||||
int methodIndex = (int)(ctx.dm.token - 0x06000001);
|
||||
byte* row = (byte*)methodDefTablePtr + methodIndex * methodDefTable.totalSize;
|
||||
ctx.dm.mdRVA = read(row, methodDefTable.fields[0]);
|
||||
ctx.dm.mdImplFlags = (ushort)read(row, methodDefTable.fields[1]);
|
||||
ctx.dm.mdFlags = (ushort)read(row, methodDefTable.fields[2]);
|
||||
ctx.dm.mdName = read(row, methodDefTable.fields[3]);
|
||||
|
|
Loading…
Reference in New Issue
Block a user