monocul.us/de4dot-cex
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Update detection of string decrypter type

Browse Source
This commit is contained in:
de4dot 2012-03-08 19:21:54 +01:00
parent a41ea0969f
commit 4e997910e4
1 changed files with 17 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
de4dot.code/deobfuscators/Eazfuscator_NET/StringDecrypter.cs
View File

@ -118,7 +118,13 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
}
}
static string[] requiredFieldTypes = new string[] {
"System.Byte[]",
"System.Int16",
};
bool checkType(TypeDefinition type) {
if (!new FieldTypes(type).all(requiredFieldTypes))
return false;
if (type.NestedTypes.Count == 0) {
return DotNetUtils.findFieldType(type, "System.IO.BinaryReader", true) != null &&
DotNetUtils.findFieldType(type, "System.Collections.Generic.Dictionary`2<System.Int32,System.String>", true) != null;
@ -156,11 +162,22 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
return null;
}
static string[] requiredLocalTypes = new string[] {
"System.Boolean",
"System.Byte[]",
"System.Char[]",
"System.Int16",
"System.Int32",
"System.Reflection.Assembly",
"System.String",
};
static bool checkDecrypterMethod(MethodDefinition method) {
if (method == null || !method.IsStatic || method.Body == null)
return false;
if (!DotNetUtils.isMethod(method, "System.String", "(System.Int32)"))
return false;
if (!new LocalTypes(method).all(requiredLocalTypes))
return false;
foreach (var instr in method.Body.Instructions) {
if (instr.OpCode != OpCodes.Callvirt)