diff --git a/de4dot.code/de4dot.code.csproj b/de4dot.code/de4dot.code.csproj index a2c1d13c..881d9378 100644 --- a/de4dot.code/de4dot.code.csproj +++ b/de4dot.code/de4dot.code.csproj @@ -126,9 +126,11 @@ + + diff --git a/de4dot.code/deobfuscators/CryptoObfuscator/CoMethodCallInliner.cs b/de4dot.code/deobfuscators/CryptoObfuscator/CoMethodCallInliner.cs new file mode 100644 index 00000000..312196f4 --- /dev/null +++ b/de4dot.code/deobfuscators/CryptoObfuscator/CoMethodCallInliner.cs @@ -0,0 +1,53 @@ +/* + Copyright (C) 2011-2013 de4dot@gmail.com + + This file is part of de4dot. + + de4dot is free software: you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation, either version 3 of the License, or + (at your option) any later version. + + de4dot is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with de4dot. If not, see . +*/ + +using dnlib.DotNet; +using de4dot.blocks.cflow; + +namespace de4dot.code.deobfuscators.CryptoObfuscator { + class CoMethodCallInliner : MethodCallInliner { + readonly InlinedMethodTypes inlinedMethodTypes; + + public CoMethodCallInliner(InlinedMethodTypes inlinedMethodTypes) + : base(false) { + this.inlinedMethodTypes = inlinedMethodTypes; + } + + protected override bool CanInline(MethodDef method) { + if (method == null) + return false; + + if (method.Attributes != (MethodAttributes.Assembly | MethodAttributes.Static | MethodAttributes.HideBySig)) + return false; + if (method.HasGenericParameters) + return false; + if (!inlinedMethodTypes.IsValidMethodType(method.DeclaringType)) + return false; + + return true; + } + + protected override void OnInlinedMethod(MethodDef methodToInline, bool inlinedMethod) { + if (inlinedMethod) + inlinedMethodTypes.Add(methodToInline.DeclaringType); + else + inlinedMethodTypes.DontRemoveType(methodToInline.DeclaringType); + } + } +} diff --git a/de4dot.code/deobfuscators/CryptoObfuscator/Deobfuscator.cs b/de4dot.code/deobfuscators/CryptoObfuscator/Deobfuscator.cs index 93d98fc0..874c4632 100644 --- a/de4dot.code/deobfuscators/CryptoObfuscator/Deobfuscator.cs +++ b/de4dot.code/deobfuscators/CryptoObfuscator/Deobfuscator.cs @@ -22,6 +22,7 @@ using System.Collections.Generic; using System.Text.RegularExpressions; using dnlib.DotNet; using de4dot.blocks; +using de4dot.blocks.cflow; namespace de4dot.code.deobfuscators.CryptoObfuscator { public class DeobfuscatorInfo : DeobfuscatorInfoBase { @@ -30,11 +31,13 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator { const string DEFAULT_REGEX = @"!^(get_|set_|add_|remove_)?[A-Z]{1,3}(?:`\d+)?$&!^(get_|set_|add_|remove_)?c[0-9a-f]{32}(?:`\d+)?$&" + DeobfuscatorBase.DEFAULT_VALID_NAME_REGEX; BoolOption removeTamperProtection; BoolOption decryptConstants; + BoolOption inlineMethods; public DeobfuscatorInfo() : base(DEFAULT_REGEX) { removeTamperProtection = new BoolOption(null, MakeArgName("tamper"), "Remove tamper protection code", true); decryptConstants = new BoolOption(null, MakeArgName("consts"), "Decrypt constants", true); + inlineMethods = new BoolOption(null, MakeArgName("inline"), "Inline short methods", true); } public override string Name { @@ -50,6 +53,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator { ValidNameRegex = validNameRegex.get(), RemoveTamperProtection = removeTamperProtection.get(), DecryptConstants = decryptConstants.get(), + InlineMethods = inlineMethods.get(), }); } @@ -57,6 +61,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator { return new List