monocul.us/de4dot-cex
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Update detection of compressor modulus

Browse Source
This commit is contained in:
de4dot 2012-08-08 14:31:13 +02:00
parent 09e20597f8
commit 536062ae39
1 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
de4dot.code/deobfuscators/Confuser/Unpacker.cs
View File

@ -213,11 +213,20 @@ namespace de4dot.code.deobfuscators.Confuser {
static bool findMod(MethodDefinition method, out ulong mod) {
var instrs = method.Body.Instructions;
for (int i = 0; i < instrs.Count; i++) {
for (int i = 0; i < instrs.Count - 1; i++) {
var ldci8 = instrs[i];
if (ldci8.OpCode.Code != Code.Ldc_I8)
continue;
var call = instrs[i + 1];
if (call.OpCode.Code != Code.Call)
continue;
var calledMethod = call.Operand as MethodReference;
if (calledMethod == null)
continue;
if (!DotNetUtils.isMethod(calledMethod, "System.UInt64", "(System.UInt64,System.UInt64,System.UInt64)"))
continue;
mod = (ulong)(long)ldci8.Operand;
return true;
}