Deobfuscate cflow again if a bool was decrypted

This commit is contained in:
de4dot 2011-10-26 22:16:51 +02:00
parent bd7a6763a6
commit 63ab61fb12
4 changed files with 21 additions and 2 deletions

View File

@ -481,9 +481,18 @@ namespace de4dot {
if (options.ControlFlowDeobfuscation) {
cflowDeobfuscator.init(blocks);
cflowDeobfuscator.deobfuscate();
}
if (deob.deobfuscateOther(blocks) && options.ControlFlowDeobfuscation) {
cflowDeobfuscator.init(blocks);
cflowDeobfuscator.deobfuscate();
}
if (options.ControlFlowDeobfuscation) {
numRemovedLocals = blocks.optimizeLocals();
blocks.repartitionBlocks();
}
deobfuscateStrings(blocks);
deob.deobfuscateMethodEnd(blocks);

View File

@ -123,6 +123,10 @@ namespace de4dot.deobfuscators {
staticStringDecrypter.decrypt(blocks);
}
public virtual bool deobfuscateOther(Blocks blocks) {
return false;
}
public virtual void deobfuscateEnd() {
if (!Operations.KeepObfuscatorTypes) {
deleteEmptyCctors();

View File

@ -80,6 +80,9 @@ namespace de4dot.deobfuscators {
// Called before the code is deobfuscated
void deobfuscateMethodBegin(Blocks blocks);
// Return true if we should deobfuscate control flow again
bool deobfuscateOther(Blocks blocks);
// Called after deobfuscateMethodBegin() but before deobfuscateMethodEnd()
void deobfuscateStrings(Blocks blocks);

View File

@ -149,10 +149,13 @@ namespace de4dot.deobfuscators.dotNET_Reactor {
DeobfuscatedFile.stringDecryptersAdded();
}
public override void deobfuscateMethodEnd(Blocks blocks) {
public override bool deobfuscateOther(Blocks blocks) {
if (boolValueInliner.HasHandlers)
boolValueInliner.decrypt(blocks);
return boolValueInliner.decrypt(blocks) > 0;
return false;
}
public override void deobfuscateMethodEnd(Blocks blocks) {
base.deobfuscateMethodEnd(blocks);
}