From 536062ae39f3b3e0c1e3f61e028502715d7819b0 Mon Sep 17 00:00:00 2001 From: de4dot Date: Wed, 8 Aug 2012 14:31:13 +0200 Subject: [PATCH] Update detection of compressor modulus --- de4dot.code/deobfuscators/Confuser/Unpacker.cs | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/de4dot.code/deobfuscators/Confuser/Unpacker.cs b/de4dot.code/deobfuscators/Confuser/Unpacker.cs index a7182d36..c49a66a3 100644 --- a/de4dot.code/deobfuscators/Confuser/Unpacker.cs +++ b/de4dot.code/deobfuscators/Confuser/Unpacker.cs @@ -213,11 +213,20 @@ namespace de4dot.code.deobfuscators.Confuser { static bool findMod(MethodDefinition method, out ulong mod) { var instrs = method.Body.Instructions; - for (int i = 0; i < instrs.Count; i++) { + for (int i = 0; i < instrs.Count - 1; i++) { var ldci8 = instrs[i]; if (ldci8.OpCode.Code != Code.Ldc_I8) continue; + var call = instrs[i + 1]; + if (call.OpCode.Code != Code.Call) + continue; + var calledMethod = call.Operand as MethodReference; + if (calledMethod == null) + continue; + if (!DotNetUtils.isMethod(calledMethod, "System.UInt64", "(System.UInt64,System.UInt64,System.UInt64)")) + continue; + mod = (ulong)(long)ldci8.Operand; return true; }