monocul.us/de4dot-cex
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Don't decrypt already decrypted resources

Browse Source
This commit is contained in:
de4dot 2013-11-14 22:48:44 +01:00
parent 239bfbfc2b
commit 5d6db10ba4
1 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
de4dot.code/deobfuscators/MaxtoCode/MethodsDecrypter.cs
View File

@ -765,9 +765,14 @@ namespace de4dot.code.deobfuscators.MaxtoCode {
var peImage = decrypterInfo.peImage;
var fileData = decrypterInfo.fileData;
uint decryptedResources = peHeader.ReadUInt32(0xFE8) ^ mcKey.ReadUInt32(0);
uint resourceRva = peHeader.GetRva(0x0E10, mcKey.ReadUInt32(0x00A0));
uint resourceSize = peHeader.ReadUInt32(0x0E14) ^ mcKey.ReadUInt32(0x00AA);
if (resourceRva == 0 || resourceSize == 0)
int resourceSize = (int)(peHeader.ReadUInt32(0x0E14) ^ mcKey.ReadUInt32(0x00AA));
if (decryptedResources == 1) {
Logger.v("Resources have already been decrypted");
return;
}
if (resourceRva == 0 || resourceSize <= 0)
return;
if (resourceRva != (uint)peImage.Cor20Header.Resources.VirtualAddress ||
resourceSize != peImage.Cor20Header.Resources.Size) {