monocul.us/de4dot-cex
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix string decryption for Eazfuscator.NET 5.1

Browse Source 
v5.1 changes a few instructions in , other than it's almost the same
This commit is contained in:
PythEch 2016-01-23 17:09:01 +02:00
parent 4c684bb67e
commit 63607a6678
1 changed files with 4 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
de4dot.code/deobfuscators/Eazfuscator_NET/StringDecrypter.cs
View File

@ -47,6 +47,7 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
EfConstantsReader stringMethodConsts; EfConstantsReader stringMethodConsts;
bool isV32OrLater; bool isV32OrLater;
bool isV50OrLater; bool isV50OrLater;
bool isV51OrLater;
int? validStringDecrypterValue; int? validStringDecrypterValue;
DynamicDynocodeIterator dynocode; DynamicDynocodeIterator dynocode;
MethodDef realMethod; MethodDef realMethod;
@ -429,11 +430,7 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
return null; return null;
if (instrs[index++].OpCode.Code != Code.Ldc_I4_0) if (instrs[index++].OpCode.Code != Code.Ldc_I4_0)
return null; return null;
if (instrs[index++].OpCode.Code != Code.Ceq) if (instrs[index++].OpCode.Code != Code.Cgt_Un)
return null;
if (instrs[index++].OpCode.Code != Code.Ldc_I4_0)
return null;
if (instrs[index++].OpCode.Code != Code.Ceq)
return null; return null;
var stloc = instrs[index++]; var stloc = instrs[index++];
if (!stloc.IsStloc()) if (!stloc.IsStloc())
@ -720,8 +717,8 @@ done: ;
if (index + 4 >= instrs.Count) if (index + 4 >= instrs.Count)
return false; return false;
var ldloc = instrs[index + 3]; var ldloc = instrs[index + 2];
var stfld = instrs[index + 4]; var stfld = instrs[index + 3];
if (!ldloc.IsLdloc() || stfld.OpCode.Code != Code.Stfld) if (!ldloc.IsLdloc() || stfld.OpCode.Code != Code.Stfld)
return false; return false;
var enumerableField = stfld.Operand as FieldDef; var enumerableField = stfld.Operand as FieldDef;