Fix string decryption for Eazfuscator.NET 5.1
v5.1 changes a few instructions in , other than it's almost the same
This commit is contained in:
parent
4c684bb67e
commit
63607a6678
|
@ -47,6 +47,7 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
|
||||||
EfConstantsReader stringMethodConsts;
|
EfConstantsReader stringMethodConsts;
|
||||||
bool isV32OrLater;
|
bool isV32OrLater;
|
||||||
bool isV50OrLater;
|
bool isV50OrLater;
|
||||||
|
bool isV51OrLater;
|
||||||
int? validStringDecrypterValue;
|
int? validStringDecrypterValue;
|
||||||
DynamicDynocodeIterator dynocode;
|
DynamicDynocodeIterator dynocode;
|
||||||
MethodDef realMethod;
|
MethodDef realMethod;
|
||||||
|
@ -429,11 +430,7 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
|
||||||
return null;
|
return null;
|
||||||
if (instrs[index++].OpCode.Code != Code.Ldc_I4_0)
|
if (instrs[index++].OpCode.Code != Code.Ldc_I4_0)
|
||||||
return null;
|
return null;
|
||||||
if (instrs[index++].OpCode.Code != Code.Ceq)
|
if (instrs[index++].OpCode.Code != Code.Cgt_Un)
|
||||||
return null;
|
|
||||||
if (instrs[index++].OpCode.Code != Code.Ldc_I4_0)
|
|
||||||
return null;
|
|
||||||
if (instrs[index++].OpCode.Code != Code.Ceq)
|
|
||||||
return null;
|
return null;
|
||||||
var stloc = instrs[index++];
|
var stloc = instrs[index++];
|
||||||
if (!stloc.IsStloc())
|
if (!stloc.IsStloc())
|
||||||
|
@ -720,8 +717,8 @@ done: ;
|
||||||
|
|
||||||
if (index + 4 >= instrs.Count)
|
if (index + 4 >= instrs.Count)
|
||||||
return false;
|
return false;
|
||||||
var ldloc = instrs[index + 3];
|
var ldloc = instrs[index + 2];
|
||||||
var stfld = instrs[index + 4];
|
var stfld = instrs[index + 3];
|
||||||
if (!ldloc.IsLdloc() || stfld.OpCode.Code != Code.Stfld)
|
if (!ldloc.IsLdloc() || stfld.OpCode.Code != Code.Stfld)
|
||||||
return false;
|
return false;
|
||||||
var enumerableField = stfld.Operand as FieldDef;
|
var enumerableField = stfld.Operand as FieldDef;
|
||||||
|
|
Loading…
Reference in New Issue
Block a user