monocul.us/de4dot-cex
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Update ldelema type, and add unbox.any and ldobj

Browse Source
This commit is contained in:
de4dot 2012-04-06 15:38:44 +02:00
parent 2949862614
commit 5511ab833b
2 changed files with 27 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
de4dot.code/deobfuscators/CliSecure/vm/CilOperandInstructionRestorer.cs
View File

@ -53,13 +53,13 @@ namespace de4dot.code.deobfuscators.CliSecure.vm {
break; break;
case Code.Ldobj: case Code.Ldobj:
operandType = MethodStack.getLoadedType(method, instrs, i, 0); operandType = getPtrElementType(MethodStack.getLoadedType(method, instrs, i, 0));
break; break;
case Code.Stobj: case Code.Stobj:
operandType = MethodStack.getLoadedType(method, instrs, i, 1); operandType = MethodStack.getLoadedType(method, instrs, i, 0);
if (operandType == null) if (!isValidType(operandType))
operandType = MethodStack.getLoadedType(method, instrs, i, 0); operandType = getPtrElementType(MethodStack.getLoadedType(method, instrs, i, 1));
break; break;
default: default:
@ -76,6 +76,18 @@ namespace de4dot.code.deobfuscators.CliSecure.vm {
return atLeastOneFailed; return atLeastOneFailed;
} }
static TypeReference getPtrElementType(TypeReference type) {
if (type == null)
return null;
var pt = type as PointerType;
if (pt != null)
return pt.ElementType;
var bt = type as ByReferenceType;
if (bt != null)
return bt.ElementType;
return null;
}
bool isValidType(TypeReference type) { bool isValidType(TypeReference type) {
if (type == null) if (type == null)
return false; return false;

11
de4dot.code/deobfuscators/MethodStack.cs
View File

@ -192,6 +192,7 @@ namespace de4dot.code.deobfuscators {
case Code.Castclass: case Code.Castclass:
case Code.Isinst: case Code.Isinst:
case Code.Unbox_Any:
fieldType = pushInstr.Operand as TypeReference; fieldType = pushInstr.Operand as TypeReference;
break; break;
@ -225,6 +226,10 @@ namespace de4dot.code.deobfuscators {
break; break;
case Code.Ldelema: case Code.Ldelema:
fieldType = createByReferenceType(pushInstr.Operand as TypeReference);
break;
case Code.Ldobj:
fieldType = pushInstr.Operand as TypeReference; fieldType = pushInstr.Operand as TypeReference;
break; break;
@ -235,6 +240,12 @@ namespace de4dot.code.deobfuscators {
return fieldType; return fieldType;
} }
static ByReferenceType createByReferenceType(TypeReference elementType) {
if (elementType == null)
return null;
return new ByReferenceType(elementType);
}
static Instruction getPreviousInstruction(IList<Instruction> instructions, ref int instrIndex) { static Instruction getPreviousInstruction(IList<Instruction> instructions, ref int instrIndex) {
while (true) { while (true) {
instrIndex--; instrIndex--;