monocul.us/de4dot-cex
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Update DNR resource resolver detector

Browse Source
This commit is contained in:
de4dot 2014-04-18 19:02:42 +02:00
parent 16c5153b00
commit 6278ef1d4b
1 changed files with 20 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
de4dot.code/deobfuscators/dotNET_Reactor/v4/ResourceResolver.cs
View File

@ -70,21 +70,37 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 {
if (!DotNetUtils.IsMethod(method, "System.Reflection.Assembly", "(System.Object,System.ResolveEventArgs)") &&
!DotNetUtils.IsMethod(method, "System.Reflection.Assembly", "(System.Object,System.Object)"))
continue;
if (!encryptedResource.CouldBeResourceDecrypter(method, additionalTypes, false))
var initMethod = GetResourceDecrypterInitMethod(method, additionalTypes, false);
if (initMethod == null)
continue;
encryptedResource.Method = method;
encryptedResource.Method = initMethod;
return;
}
}
}
MethodDef GetResourceDecrypterInitMethod(MethodDef method, string[] additionalTypes, bool checkResource) {
if (encryptedResource.CouldBeResourceDecrypter(method, additionalTypes, checkResource))
return method;
foreach (var calledMethod in DotNetUtils.GetCalledMethods(module, method)) {
if (!DotNetUtils.IsMethod(calledMethod, "System.Void", "()"))
continue;
if (encryptedResource.CouldBeResourceDecrypter(calledMethod, additionalTypes, checkResource))
return calledMethod;
}
return null;
}
bool CheckFields(IList<FieldDef> fields) {
if (fields.Count != 3)
if (fields.Count != 3 && fields.Count != 4)
return false;
int numBools = fields.Count == 3 ? 1 : 2;
var fieldTypes = new FieldTypes(fields);
if (fieldTypes.Count("System.Boolean") != 1)
if (fieldTypes.Count("System.Boolean") != numBools)
return false;
if (fieldTypes.Count("System.Object") == 2)
return true;