Detect CS type when strings are encrypted, but methods aren't
This commit is contained in:
parent
ab60692c2f
commit
5b97faf2dd
|
@ -80,6 +80,8 @@ namespace de4dot.code.deobfuscators.CliSecure {
|
|||
return;
|
||||
if (find2())
|
||||
return;
|
||||
if (find3())
|
||||
return;
|
||||
findNativeCode();
|
||||
}
|
||||
|
||||
|
@ -119,6 +121,28 @@ namespace de4dot.code.deobfuscators.CliSecure {
|
|||
return false;
|
||||
}
|
||||
|
||||
bool find3() {
|
||||
foreach (var type in module.Types) {
|
||||
if (type.Fields.Count != 1)
|
||||
continue;
|
||||
if (type.Fields[0].FieldType.FullName != "System.Byte[]")
|
||||
continue;
|
||||
if (type.Methods.Count != 2)
|
||||
continue;
|
||||
if (DotNetUtils.getMethod(type, ".cctor") == null)
|
||||
continue;
|
||||
var cs = DotNetUtils.getMethod(type, "cs");
|
||||
if (cs == null)
|
||||
continue;
|
||||
|
||||
stringDecrypterMethod = cs;
|
||||
cliSecureRtType = type;
|
||||
return true;
|
||||
}
|
||||
|
||||
return false;
|
||||
}
|
||||
|
||||
static MethodDefinition findStringDecrypterMethod(TypeDefinition type) {
|
||||
foreach (var method in type.Methods) {
|
||||
if (method.Body == null || !method.IsStatic)
|
||||
|
|
Loading…
Reference in New Issue
Block a user