diff --git a/de4dot.code/ObfuscatedFile.cs b/de4dot.code/ObfuscatedFile.cs index 97c563cc..2d9f98df 100644 --- a/de4dot.code/ObfuscatedFile.cs +++ b/de4dot.code/ObfuscatedFile.cs @@ -481,9 +481,18 @@ namespace de4dot { if (options.ControlFlowDeobfuscation) { cflowDeobfuscator.init(blocks); cflowDeobfuscator.deobfuscate(); + } + + if (deob.deobfuscateOther(blocks) && options.ControlFlowDeobfuscation) { + cflowDeobfuscator.init(blocks); + cflowDeobfuscator.deobfuscate(); + } + + if (options.ControlFlowDeobfuscation) { numRemovedLocals = blocks.optimizeLocals(); blocks.repartitionBlocks(); } + deobfuscateStrings(blocks); deob.deobfuscateMethodEnd(blocks); diff --git a/de4dot.code/deobfuscators/DeobfuscatorBase.cs b/de4dot.code/deobfuscators/DeobfuscatorBase.cs index 026e0f5b..50739a81 100644 --- a/de4dot.code/deobfuscators/DeobfuscatorBase.cs +++ b/de4dot.code/deobfuscators/DeobfuscatorBase.cs @@ -123,6 +123,10 @@ namespace de4dot.deobfuscators { staticStringDecrypter.decrypt(blocks); } + public virtual bool deobfuscateOther(Blocks blocks) { + return false; + } + public virtual void deobfuscateEnd() { if (!Operations.KeepObfuscatorTypes) { deleteEmptyCctors(); diff --git a/de4dot.code/deobfuscators/IDeobfuscator.cs b/de4dot.code/deobfuscators/IDeobfuscator.cs index 3720ba8e..96d2c8bc 100644 --- a/de4dot.code/deobfuscators/IDeobfuscator.cs +++ b/de4dot.code/deobfuscators/IDeobfuscator.cs @@ -80,6 +80,9 @@ namespace de4dot.deobfuscators { // Called before the code is deobfuscated void deobfuscateMethodBegin(Blocks blocks); + // Return true if we should deobfuscate control flow again + bool deobfuscateOther(Blocks blocks); + // Called after deobfuscateMethodBegin() but before deobfuscateMethodEnd() void deobfuscateStrings(Blocks blocks); diff --git a/de4dot.code/deobfuscators/dotNET_Reactor/Deobfuscator.cs b/de4dot.code/deobfuscators/dotNET_Reactor/Deobfuscator.cs index 4323f6f5..fd32bc11 100644 --- a/de4dot.code/deobfuscators/dotNET_Reactor/Deobfuscator.cs +++ b/de4dot.code/deobfuscators/dotNET_Reactor/Deobfuscator.cs @@ -149,10 +149,13 @@ namespace de4dot.deobfuscators.dotNET_Reactor { DeobfuscatedFile.stringDecryptersAdded(); } - public override void deobfuscateMethodEnd(Blocks blocks) { + public override bool deobfuscateOther(Blocks blocks) { if (boolValueInliner.HasHandlers) - boolValueInliner.decrypt(blocks); + return boolValueInliner.decrypt(blocks) > 0; + return false; + } + public override void deobfuscateMethodEnd(Blocks blocks) { base.deobfuscateMethodEnd(blocks); }