monocul.us/de4dot-cex
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Detect CS type when strings are encrypted, but methods aren't

Browse Source
This commit is contained in:
de4dot 2012-04-26 01:56:59 +02:00
parent ab60692c2f
commit 5b97faf2dd
1 changed files with 24 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
de4dot.code/deobfuscators/CliSecure/CliSecureRtType.cs
View File

@ -80,6 +80,8 @@ namespace de4dot.code.deobfuscators.CliSecure {
return;
if (find2())
return;
if (find3())
return;
findNativeCode();
}
@ -119,6 +121,28 @@ namespace de4dot.code.deobfuscators.CliSecure {
return false;
}
bool find3() {
foreach (var type in module.Types) {
if (type.Fields.Count != 1)
continue;
if (type.Fields[0].FieldType.FullName != "System.Byte[]")
continue;
if (type.Methods.Count != 2)
continue;
if (DotNetUtils.getMethod(type, ".cctor") == null)
continue;
var cs = DotNetUtils.getMethod(type, "cs");
if (cs == null)
continue;
stringDecrypterMethod = cs;
cliSecureRtType = type;
return true;
}
return false;
}
static MethodDefinition findStringDecrypterMethod(TypeDefinition type) {
foreach (var method in type.Methods) {
if (method.Body == null || !method.IsStatic)