Deobfuscate cflow again if a bool was decrypted
This commit is contained in:
parent
bd7a6763a6
commit
63ab61fb12
|
@ -481,9 +481,18 @@ namespace de4dot {
|
|||
if (options.ControlFlowDeobfuscation) {
|
||||
cflowDeobfuscator.init(blocks);
|
||||
cflowDeobfuscator.deobfuscate();
|
||||
}
|
||||
|
||||
if (deob.deobfuscateOther(blocks) && options.ControlFlowDeobfuscation) {
|
||||
cflowDeobfuscator.init(blocks);
|
||||
cflowDeobfuscator.deobfuscate();
|
||||
}
|
||||
|
||||
if (options.ControlFlowDeobfuscation) {
|
||||
numRemovedLocals = blocks.optimizeLocals();
|
||||
blocks.repartitionBlocks();
|
||||
}
|
||||
|
||||
deobfuscateStrings(blocks);
|
||||
deob.deobfuscateMethodEnd(blocks);
|
||||
|
||||
|
|
|
@ -123,6 +123,10 @@ namespace de4dot.deobfuscators {
|
|||
staticStringDecrypter.decrypt(blocks);
|
||||
}
|
||||
|
||||
public virtual bool deobfuscateOther(Blocks blocks) {
|
||||
return false;
|
||||
}
|
||||
|
||||
public virtual void deobfuscateEnd() {
|
||||
if (!Operations.KeepObfuscatorTypes) {
|
||||
deleteEmptyCctors();
|
||||
|
|
|
@ -80,6 +80,9 @@ namespace de4dot.deobfuscators {
|
|||
// Called before the code is deobfuscated
|
||||
void deobfuscateMethodBegin(Blocks blocks);
|
||||
|
||||
// Return true if we should deobfuscate control flow again
|
||||
bool deobfuscateOther(Blocks blocks);
|
||||
|
||||
// Called after deobfuscateMethodBegin() but before deobfuscateMethodEnd()
|
||||
void deobfuscateStrings(Blocks blocks);
|
||||
|
||||
|
|
|
@ -149,10 +149,13 @@ namespace de4dot.deobfuscators.dotNET_Reactor {
|
|||
DeobfuscatedFile.stringDecryptersAdded();
|
||||
}
|
||||
|
||||
public override void deobfuscateMethodEnd(Blocks blocks) {
|
||||
public override bool deobfuscateOther(Blocks blocks) {
|
||||
if (boolValueInliner.HasHandlers)
|
||||
boolValueInliner.decrypt(blocks);
|
||||
return boolValueInliner.decrypt(blocks) > 0;
|
||||
return false;
|
||||
}
|
||||
|
||||
public override void deobfuscateMethodEnd(Blocks blocks) {
|
||||
base.deobfuscateMethodEnd(blocks);
|
||||
}
|
||||
|
||||
|
|
Loading…
Reference in New Issue
Block a user