monocul.us/de4dot-cex
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Update version numbers

Browse Source
This commit is contained in:
de4dot 2012-08-08 18:04:57 +02:00
parent 876c13c08a
commit 5e2572a201
1 changed files with 12 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
de4dot.code/deobfuscators/Confuser/MemoryMethodsDecrypter.cs
View File

@ -34,10 +34,10 @@ namespace de4dot.code.deobfuscators.Confuser {
v14_r57884,
v14_r58004,
v14_r58564,
v15a_r59014,
v15_r59014,
v16_r71742,
// Removed in Confuser 1.7 r73404 and restored in Confuser 1.7 r73605
vXX,
v17_r73605,
}
public MemoryMethodsDecrypter(ModuleDefinition module, ISimpleDeobfuscator simpleDeobfuscator)
@ -70,7 +70,7 @@ namespace de4dot.code.deobfuscators.Confuser {
if (calls <= 2)
version = ConfuserVersion.v14_r58564;
else if (calls == 4)
version = ConfuserVersion.v15a_r59014;
version = ConfuserVersion.v15_r59014;
else
return false;
}
@ -79,7 +79,7 @@ namespace de4dot.code.deobfuscators.Confuser {
else if (DotNetUtils.callsMethod(initMethod, "System.Int32 System.Object::GetHashCode()"))
version = ConfuserVersion.v16_r71742;
else
version = ConfuserVersion.vXX;
version = ConfuserVersion.v17_r73605;
return true;
}
@ -113,14 +113,14 @@ namespace de4dot.code.deobfuscators.Confuser {
return true;
case ConfuserVersion.v14_r58564:
case ConfuserVersion.v15a_r59014:
case ConfuserVersion.v15_r59014:
return initializeKeys_v14_r58564();
case ConfuserVersion.v16_r71742:
return initializeKeys_v16_r71742();
case ConfuserVersion.vXX:
return initializeKeys_vXX();
case ConfuserVersion.v17_r73605:
return initializeKeys_v17_r73605();
default:
throw new ApplicationException("Unknown version");
@ -167,7 +167,7 @@ namespace de4dot.code.deobfuscators.Confuser {
return true;
}
bool initializeKeys_vXX() {
bool initializeKeys_v17_r73605() {
simpleDeobfuscator.deobfuscate(initMethod);
if (!findLKey0(initMethod, out lkey0))
return false;
@ -268,9 +268,9 @@ namespace de4dot.code.deobfuscators.Confuser {
case ConfuserVersion.v14_r57884: return decrypt_v14_r57884(peImage, fileData);
case ConfuserVersion.v14_r58004: return decrypt_v14_r58004(peImage, fileData);
case ConfuserVersion.v14_r58564: return decrypt_v14_r58004(peImage, fileData);
case ConfuserVersion.v15a_r59014:return decrypt_v15a_r59014(peImage, fileData);
case ConfuserVersion.v15_r59014:return decrypt_v15_r59014(peImage, fileData);
case ConfuserVersion.v16_r71742: return decrypt_v16_r71742(peImage, fileData);
case ConfuserVersion.vXX: return decrypt_vXX(peImage, fileData);
case ConfuserVersion.v17_r73605: return decrypt_v17_r73605(peImage, fileData);
default: throw new ApplicationException("Unknown version");
}
}
@ -346,7 +346,7 @@ namespace de4dot.code.deobfuscators.Confuser {
return true;
}
bool decrypt_v15a_r59014(PeImage peImage, byte[] fileData) {
bool decrypt_v15_r59014(PeImage peImage, byte[] fileData) {
methodsData = decryptMethodsData_v14_r57884(peImage, true);
return decryptImage_v14_r58004(peImage, fileData);
}
@ -356,7 +356,7 @@ namespace de4dot.code.deobfuscators.Confuser {
return decryptImage_v16_r71742(peImage, fileData);
}
bool decrypt_vXX(PeImage peImage, byte[] fileData) {
bool decrypt_v17_r73605(PeImage peImage, byte[] fileData) {
if (peImage.OptionalHeader.checkSum == 0)
return false;