Detect CS type when strings are encrypted, but methods aren't
This commit is contained in:
parent
ab60692c2f
commit
5b97faf2dd
|
@ -80,6 +80,8 @@ namespace de4dot.code.deobfuscators.CliSecure {
|
||||||
return;
|
return;
|
||||||
if (find2())
|
if (find2())
|
||||||
return;
|
return;
|
||||||
|
if (find3())
|
||||||
|
return;
|
||||||
findNativeCode();
|
findNativeCode();
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -119,6 +121,28 @@ namespace de4dot.code.deobfuscators.CliSecure {
|
||||||
return false;
|
return false;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
bool find3() {
|
||||||
|
foreach (var type in module.Types) {
|
||||||
|
if (type.Fields.Count != 1)
|
||||||
|
continue;
|
||||||
|
if (type.Fields[0].FieldType.FullName != "System.Byte[]")
|
||||||
|
continue;
|
||||||
|
if (type.Methods.Count != 2)
|
||||||
|
continue;
|
||||||
|
if (DotNetUtils.getMethod(type, ".cctor") == null)
|
||||||
|
continue;
|
||||||
|
var cs = DotNetUtils.getMethod(type, "cs");
|
||||||
|
if (cs == null)
|
||||||
|
continue;
|
||||||
|
|
||||||
|
stringDecrypterMethod = cs;
|
||||||
|
cliSecureRtType = type;
|
||||||
|
return true;
|
||||||
|
}
|
||||||
|
|
||||||
|
return false;
|
||||||
|
}
|
||||||
|
|
||||||
static MethodDefinition findStringDecrypterMethod(TypeDefinition type) {
|
static MethodDefinition findStringDecrypterMethod(TypeDefinition type) {
|
||||||
foreach (var method in type.Methods) {
|
foreach (var method in type.Methods) {
|
||||||
if (method.Body == null || !method.IsStatic)
|
if (method.Body == null || !method.IsStatic)
|
||||||
|
|
Loading…
Reference in New Issue
Block a user