monocul.us/de4dot-cex
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Update code to handle 4.1 obfuscated assemblies

Browse Source
This commit is contained in:
de4dot 2011-10-27 02:08:30 +02:00
parent 93d4ac1c9d
commit 5357b4f73c
2 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
de4dot.code/deobfuscators/dotNET_Reactor/MethodsDecrypter.cs
View File

@ -74,6 +74,8 @@ namespace de4dot.deobfuscators.dotNET_Reactor {
var key = new MethodReferenceAndDeclaringTypeKey(method);
if (!checkedMethods.ContainsKey(key)) {
checkedMethods[key] = true;
if (info.Item1.BaseType == null || info.Item1.BaseType.FullName != "System.Object")
continue;
if (!DotNetUtils.isMethod(method, "System.Void", "()"))
continue;
if (!encryptedResource.couldBeResourceDecrypter(method, additionalTypes))
@ -111,6 +113,7 @@ namespace de4dot.deobfuscators.dotNET_Reactor {
int patchCount = methodsDataReader.ReadInt32();
int mode = methodsDataReader.ReadInt32();
if (!useXorKey || mode == 1) {
// Here if DNR 4.0, 4.1
for (int i = 0; i < patchCount; i++) {
uint rva = methodsDataReader.ReadUInt32();
uint data = methodsDataReader.ReadUInt32();

6
de4dot.code/deobfuscators/dotNET_Reactor/StringDecrypter.cs
View File

@ -107,8 +107,10 @@ namespace de4dot.deobfuscators.dotNET_Reactor {
return;
this.peImage = peImage;
foreach (var info in decrypterInfos)
foreach (var info in decrypterInfos) {
simpleDeobfuscator.deobfuscate(info.method);
findKeyIv(info.method, out info.key, out info.iv);
}
encryptedResource.init(simpleDeobfuscator);
decryptedData = encryptedResource.decrypt();
@ -128,6 +130,8 @@ namespace de4dot.deobfuscators.dotNET_Reactor {
var calledMethod = info.Item2;
if (calledMethod.DeclaringType != method.DeclaringType)
continue;
if (calledMethod.MethodReturnType.ReturnType.FullName != "System.Byte[]")
continue;
var localTypes = new LocalTypes(calledMethod);
if (!localTypes.all(requiredTypes))
continue;