Update code to handle 4.1 obfuscated assemblies
This commit is contained in:
parent
93d4ac1c9d
commit
5357b4f73c
|
@ -74,6 +74,8 @@ namespace de4dot.deobfuscators.dotNET_Reactor {
|
||||||
var key = new MethodReferenceAndDeclaringTypeKey(method);
|
var key = new MethodReferenceAndDeclaringTypeKey(method);
|
||||||
if (!checkedMethods.ContainsKey(key)) {
|
if (!checkedMethods.ContainsKey(key)) {
|
||||||
checkedMethods[key] = true;
|
checkedMethods[key] = true;
|
||||||
|
if (info.Item1.BaseType == null || info.Item1.BaseType.FullName != "System.Object")
|
||||||
|
continue;
|
||||||
if (!DotNetUtils.isMethod(method, "System.Void", "()"))
|
if (!DotNetUtils.isMethod(method, "System.Void", "()"))
|
||||||
continue;
|
continue;
|
||||||
if (!encryptedResource.couldBeResourceDecrypter(method, additionalTypes))
|
if (!encryptedResource.couldBeResourceDecrypter(method, additionalTypes))
|
||||||
|
@ -111,6 +113,7 @@ namespace de4dot.deobfuscators.dotNET_Reactor {
|
||||||
int patchCount = methodsDataReader.ReadInt32();
|
int patchCount = methodsDataReader.ReadInt32();
|
||||||
int mode = methodsDataReader.ReadInt32();
|
int mode = methodsDataReader.ReadInt32();
|
||||||
if (!useXorKey || mode == 1) {
|
if (!useXorKey || mode == 1) {
|
||||||
|
// Here if DNR 4.0, 4.1
|
||||||
for (int i = 0; i < patchCount; i++) {
|
for (int i = 0; i < patchCount; i++) {
|
||||||
uint rva = methodsDataReader.ReadUInt32();
|
uint rva = methodsDataReader.ReadUInt32();
|
||||||
uint data = methodsDataReader.ReadUInt32();
|
uint data = methodsDataReader.ReadUInt32();
|
||||||
|
|
|
@ -107,8 +107,10 @@ namespace de4dot.deobfuscators.dotNET_Reactor {
|
||||||
return;
|
return;
|
||||||
this.peImage = peImage;
|
this.peImage = peImage;
|
||||||
|
|
||||||
foreach (var info in decrypterInfos)
|
foreach (var info in decrypterInfos) {
|
||||||
|
simpleDeobfuscator.deobfuscate(info.method);
|
||||||
findKeyIv(info.method, out info.key, out info.iv);
|
findKeyIv(info.method, out info.key, out info.iv);
|
||||||
|
}
|
||||||
|
|
||||||
encryptedResource.init(simpleDeobfuscator);
|
encryptedResource.init(simpleDeobfuscator);
|
||||||
decryptedData = encryptedResource.decrypt();
|
decryptedData = encryptedResource.decrypt();
|
||||||
|
@ -128,6 +130,8 @@ namespace de4dot.deobfuscators.dotNET_Reactor {
|
||||||
var calledMethod = info.Item2;
|
var calledMethod = info.Item2;
|
||||||
if (calledMethod.DeclaringType != method.DeclaringType)
|
if (calledMethod.DeclaringType != method.DeclaringType)
|
||||||
continue;
|
continue;
|
||||||
|
if (calledMethod.MethodReturnType.ReturnType.FullName != "System.Byte[]")
|
||||||
|
continue;
|
||||||
var localTypes = new LocalTypes(calledMethod);
|
var localTypes = new LocalTypes(calledMethod);
|
||||||
if (!localTypes.all(requiredTypes))
|
if (!localTypes.all(requiredTypes))
|
||||||
continue;
|
continue;
|
||||||
|
|
Loading…
Reference in New Issue
Block a user