From 4e89d707dc5087baddc7b32b6d03a62a9efd639a Mon Sep 17 00:00:00 2001 From: de4dot Date: Wed, 25 Apr 2012 13:21:53 +0200 Subject: [PATCH] Move code to DeobUtils --- de4dot.code/deobfuscators/DeobUtils.cs | 25 +++++++++++++++++++ .../deobfuscators/MaxtoCode/MainType.cs | 16 ++---------- 2 files changed, 27 insertions(+), 14 deletions(-) diff --git a/de4dot.code/deobfuscators/DeobUtils.cs b/de4dot.code/deobfuscators/DeobUtils.cs index f9e8f4fc..94f4e378 100644 --- a/de4dot.code/deobfuscators/DeobUtils.cs +++ b/de4dot.code/deobfuscators/DeobUtils.cs @@ -18,6 +18,7 @@ */ using System; +using System.Collections.Generic; using System.IO; using System.Security.Cryptography; using Mono.Cecil; @@ -206,5 +207,29 @@ namespace de4dot.code.deobfuscators { } return -1; } + + public static IEnumerable getInitCctors(ModuleDefinition module, int maxCctors) { + var cctor = DotNetUtils.getModuleTypeCctor(module); + if (cctor != null) + yield return cctor; + + var entryPoint = module.EntryPoint; + if (entryPoint != null) { + cctor = DotNetUtils.getMethod(entryPoint.DeclaringType, ".cctor"); + if (cctor != null) + yield return cctor; + } + + foreach (var type in module.GetTypes()) { + if (type == DotNetUtils.getModuleType(module)) + continue; + cctor = DotNetUtils.getMethod(type, ".cctor"); + if (cctor == null) + continue; + yield return cctor; + if (!type.IsEnum && --maxCctors <= 0) + break; + } + } } } diff --git a/de4dot.code/deobfuscators/MaxtoCode/MainType.cs b/de4dot.code/deobfuscators/MaxtoCode/MainType.cs index 6209cc3d..8326503f 100644 --- a/de4dot.code/deobfuscators/MaxtoCode/MainType.cs +++ b/de4dot.code/deobfuscators/MaxtoCode/MainType.cs @@ -81,20 +81,8 @@ namespace de4dot.code.deobfuscators.MaxtoCode { } public void find() { - if (checkCctor(DotNetUtils.getModuleTypeCctor(module))) - return; - - var entryPoint = module.EntryPoint; - if (entryPoint != null && checkCctor(DotNetUtils.getMethod(entryPoint.DeclaringType, ".cctor"))) - return; - - int checksLeft = 3; - foreach (var type in module.GetTypes()) { - if (type == DotNetUtils.getModuleType(module)) - continue; - if (checkCctor(DotNetUtils.getMethod(type, ".cctor"))) - return; - if (!type.IsEnum && --checksLeft <= 0) + foreach (var cctor in DeobUtils.getInitCctors(module, 3)) { + if (checkCctor(cctor)) break; } }