monocul.us/de4dot-cex
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Cflow deob methods

Browse Source
This commit is contained in:
de4dot 2012-05-02 13:51:07 +02:00
parent 83e8fac8ea
commit 597fcb0210
2 changed files with 11 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
de4dot.code/deobfuscators/DeepSea/Deobfuscator.cs
View File

@ -110,9 +110,10 @@ namespace de4dot.code.deobfuscators.DeepSea {
get {
var list = new List<IBlocksDeobfuscator>();
if (CanInlineMethods) {
list.Add(new DsMethodCallInliner());
if (arrayBlockDeobfuscator.Detected)
list.Add(arrayBlockDeobfuscator);
list.Add(new DsMethodCallInliner(new CachedCflowDeobfuscator(list)));
}
return list;
}

10
de4dot.code/deobfuscators/DeepSea/DsMethodCallInliner.cs
View File

@ -31,6 +31,11 @@ namespace de4dot.code.deobfuscators.DeepSea {
ParameterDefinition arg1, arg2;
Value returnValue;
MethodDefinition methodToInline;
CachedCflowDeobfuscator cflowDeobfuscator;
public DsMethodCallInliner(CachedCflowDeobfuscator cflowDeobfuscator) {
this.cflowDeobfuscator = cflowDeobfuscator;
}
protected override bool deobfuscateInternal() {
bool changed = false;
@ -66,6 +71,8 @@ namespace de4dot.code.deobfuscators.DeepSea {
}
bool inlineMethod(MethodDefinition methodToInline, int instrIndex, int const1, int const2) {
if (hasSecuritySafeCriticalAttribute(methodToInline))
methodToInline = cflowDeobfuscator.deobfuscate(methodToInline);
this.methodToInline = methodToInline;
parameters = DotNetUtils.getParameters(methodToInline);
@ -224,7 +231,8 @@ done:
return false;
if (!foundOpCodes.ContainsKey(Code.Rem))
return false;
if (!foundOpCodes.ContainsKey(Code.Brtrue) && !foundOpCodes.ContainsKey(Code.Brtrue_S))
if (!foundOpCodes.ContainsKey(Code.Brtrue) && !foundOpCodes.ContainsKey(Code.Brtrue_S) &&
!foundOpCodes.ContainsKey(Code.Brfalse) && !foundOpCodes.ContainsKey(Code.Brfalse_S))
return false;
}
return true;