From 5b97faf2dda25b27823bebf35915140eccce0f92 Mon Sep 17 00:00:00 2001
From: de4dot <de4dot@gmail.com>
Date: Thu, 26 Apr 2012 01:56:59 +0200
Subject: [PATCH] Detect CS type when strings are encrypted, but methods aren't

---
 .../CliSecure/CliSecureRtType.cs              | 24 +++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/de4dot.code/deobfuscators/CliSecure/CliSecureRtType.cs b/de4dot.code/deobfuscators/CliSecure/CliSecureRtType.cs
index 9e636974..3842e9ae 100644
--- a/de4dot.code/deobfuscators/CliSecure/CliSecureRtType.cs
+++ b/de4dot.code/deobfuscators/CliSecure/CliSecureRtType.cs
@@ -80,6 +80,8 @@ namespace de4dot.code.deobfuscators.CliSecure {
 				return;
 			if (find2())
 				return;
+			if (find3())
+				return;
 			findNativeCode();
 		}
 
@@ -119,6 +121,28 @@ namespace de4dot.code.deobfuscators.CliSecure {
 			return false;
 		}
 
+		bool find3() {
+			foreach (var type in module.Types) {
+				if (type.Fields.Count != 1)
+					continue;
+				if (type.Fields[0].FieldType.FullName != "System.Byte[]")
+					continue;
+				if (type.Methods.Count != 2)
+					continue;
+				if (DotNetUtils.getMethod(type, ".cctor") == null)
+					continue;
+				var cs = DotNetUtils.getMethod(type, "cs");
+				if (cs == null)
+					continue;
+
+				stringDecrypterMethod = cs;
+				cliSecureRtType = type;
+				return true;
+			}
+
+			return false;
+		}
+
 		static MethodDefinition findStringDecrypterMethod(TypeDefinition type) {
 			foreach (var method in type.Methods) {
 				if (method.Body == null || !method.IsStatic)