From 63ab61fb12e2121cb87482c7d73d31e907fc06a5 Mon Sep 17 00:00:00 2001 From: de4dot Date: Wed, 26 Oct 2011 22:16:51 +0200 Subject: [PATCH] Deobfuscate cflow again if a bool was decrypted --- de4dot.code/ObfuscatedFile.cs | 9 +++++++++ de4dot.code/deobfuscators/DeobfuscatorBase.cs | 4 ++++ de4dot.code/deobfuscators/IDeobfuscator.cs | 3 +++ de4dot.code/deobfuscators/dotNET_Reactor/Deobfuscator.cs | 7 +++++-- 4 files changed, 21 insertions(+), 2 deletions(-) diff --git a/de4dot.code/ObfuscatedFile.cs b/de4dot.code/ObfuscatedFile.cs index 97c563cc..2d9f98df 100644 --- a/de4dot.code/ObfuscatedFile.cs +++ b/de4dot.code/ObfuscatedFile.cs @@ -481,9 +481,18 @@ namespace de4dot { if (options.ControlFlowDeobfuscation) { cflowDeobfuscator.init(blocks); cflowDeobfuscator.deobfuscate(); + } + + if (deob.deobfuscateOther(blocks) && options.ControlFlowDeobfuscation) { + cflowDeobfuscator.init(blocks); + cflowDeobfuscator.deobfuscate(); + } + + if (options.ControlFlowDeobfuscation) { numRemovedLocals = blocks.optimizeLocals(); blocks.repartitionBlocks(); } + deobfuscateStrings(blocks); deob.deobfuscateMethodEnd(blocks); diff --git a/de4dot.code/deobfuscators/DeobfuscatorBase.cs b/de4dot.code/deobfuscators/DeobfuscatorBase.cs index 026e0f5b..50739a81 100644 --- a/de4dot.code/deobfuscators/DeobfuscatorBase.cs +++ b/de4dot.code/deobfuscators/DeobfuscatorBase.cs @@ -123,6 +123,10 @@ namespace de4dot.deobfuscators { staticStringDecrypter.decrypt(blocks); } + public virtual bool deobfuscateOther(Blocks blocks) { + return false; + } + public virtual void deobfuscateEnd() { if (!Operations.KeepObfuscatorTypes) { deleteEmptyCctors(); diff --git a/de4dot.code/deobfuscators/IDeobfuscator.cs b/de4dot.code/deobfuscators/IDeobfuscator.cs index 3720ba8e..96d2c8bc 100644 --- a/de4dot.code/deobfuscators/IDeobfuscator.cs +++ b/de4dot.code/deobfuscators/IDeobfuscator.cs @@ -80,6 +80,9 @@ namespace de4dot.deobfuscators { // Called before the code is deobfuscated void deobfuscateMethodBegin(Blocks blocks); + // Return true if we should deobfuscate control flow again + bool deobfuscateOther(Blocks blocks); + // Called after deobfuscateMethodBegin() but before deobfuscateMethodEnd() void deobfuscateStrings(Blocks blocks); diff --git a/de4dot.code/deobfuscators/dotNET_Reactor/Deobfuscator.cs b/de4dot.code/deobfuscators/dotNET_Reactor/Deobfuscator.cs index 4323f6f5..fd32bc11 100644 --- a/de4dot.code/deobfuscators/dotNET_Reactor/Deobfuscator.cs +++ b/de4dot.code/deobfuscators/dotNET_Reactor/Deobfuscator.cs @@ -149,10 +149,13 @@ namespace de4dot.deobfuscators.dotNET_Reactor { DeobfuscatedFile.stringDecryptersAdded(); } - public override void deobfuscateMethodEnd(Blocks blocks) { + public override bool deobfuscateOther(Blocks blocks) { if (boolValueInliner.HasHandlers) - boolValueInliner.decrypt(blocks); + return boolValueInliner.decrypt(blocks) > 0; + return false; + } + public override void deobfuscateMethodEnd(Blocks blocks) { base.deobfuscateMethodEnd(blocks); }