Update code; submodule was updated
This commit is contained in:
parent
4be5776da7
commit
6a7ddbaa56
|
@ -281,7 +281,7 @@ namespace AssemblyData.methodsrewriter {
|
||||||
var mparams = getParameters(method.methodDef);
|
var mparams = getParameters(method.methodDef);
|
||||||
if (mparams.Count > 0) {
|
if (mparams.Count > 0) {
|
||||||
block.insert(n++, Instruction.Create(OpCodes.Ldc_I4, mparams.Count));
|
block.insert(n++, Instruction.Create(OpCodes.Ldc_I4, mparams.Count));
|
||||||
var objectType = method.methodDef.DeclaringType.OwnerModule.CorLibTypes.Object;
|
var objectType = method.methodDef.DeclaringType.Module.CorLibTypes.Object;
|
||||||
block.insert(n++, Instruction.Create(OpCodes.Newarr, objectType));
|
block.insert(n++, Instruction.Create(OpCodes.Newarr, objectType));
|
||||||
block.insert(n++, create(OpCodes.Stloc, new Operand(Operand.Type.TempObjArray)));
|
block.insert(n++, create(OpCodes.Stloc, new Operand(Operand.Type.TempObjArray)));
|
||||||
|
|
||||||
|
|
|
@ -144,7 +144,7 @@ namespace de4dot.blocks {
|
||||||
var defAsm = local.Type.DefinitionAssembly;
|
var defAsm = local.Type.DefinitionAssembly;
|
||||||
if (defAsm == null)
|
if (defAsm == null)
|
||||||
continue; // eg. fnptr
|
continue; // eg. fnptr
|
||||||
if (defAsm == method.DeclaringType.OwnerModule.Assembly)
|
if (defAsm == method.DeclaringType.Module.Assembly)
|
||||||
continue; // this assembly is always loaded
|
continue; // this assembly is always loaded
|
||||||
if (defAsm.IsCorLib())
|
if (defAsm.IsCorLib())
|
||||||
continue; // mscorlib is always loaded
|
continue; // mscorlib is always loaded
|
||||||
|
|
|
@ -155,7 +155,7 @@ namespace de4dot.blocks {
|
||||||
}
|
}
|
||||||
|
|
||||||
public static MethodDef getModuleTypeCctor(ModuleDef module) {
|
public static MethodDef getModuleTypeCctor(ModuleDef module) {
|
||||||
return module.GlobalType.FindClassConstructor();
|
return module.GlobalType.FindStaticConstructor();
|
||||||
}
|
}
|
||||||
|
|
||||||
public static bool isEmpty(MethodDef method) {
|
public static bool isEmpty(MethodDef method) {
|
||||||
|
@ -275,7 +275,7 @@ namespace de4dot.blocks {
|
||||||
return false;
|
return false;
|
||||||
if (method.ImplMap == null || method.ImplMap.Name.String != funcName)
|
if (method.ImplMap == null || method.ImplMap.Name.String != funcName)
|
||||||
return false;
|
return false;
|
||||||
return getDllName(dll).Equals(getDllName(method.ImplMap.Scope.Name.String), StringComparison.OrdinalIgnoreCase);
|
return getDllName(dll).Equals(getDllName(method.ImplMap.Module.Name.String), StringComparison.OrdinalIgnoreCase);
|
||||||
}
|
}
|
||||||
|
|
||||||
#if PORT
|
#if PORT
|
||||||
|
@ -359,7 +359,7 @@ namespace de4dot.blocks {
|
||||||
td = tr.Resolve();
|
td = tr.Resolve();
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
return td != null && td.OwnerModule == module ? td : null;
|
return td != null && td.Module == module ? td : null;
|
||||||
}
|
}
|
||||||
|
|
||||||
static MethodDef getMethod(ModuleDef module, IMethod method, ITypeDefOrRef declaringType) {
|
static MethodDef getMethod(ModuleDef module, IMethod method, ITypeDefOrRef declaringType) {
|
||||||
|
@ -540,16 +540,16 @@ namespace de4dot.blocks {
|
||||||
|
|
||||||
// Copies most things but not everything
|
// Copies most things but not everything
|
||||||
public static MethodDef clone(MethodDef method) {
|
public static MethodDef clone(MethodDef method) {
|
||||||
var newMethod = new MethodDefUser(method.Name, method.MethodSig, method.ImplFlags, method.Flags);
|
var newMethod = new MethodDefUser(method.Name, method.MethodSig, method.ImplAttributes, method.Attributes);
|
||||||
newMethod.Rid = method.Rid;
|
newMethod.Rid = method.Rid;
|
||||||
newMethod.DeclaringType2 = method.DeclaringType;
|
newMethod.DeclaringType2 = method.DeclaringType;
|
||||||
foreach (var pd in method.ParamList)
|
foreach (var pd in method.ParamList)
|
||||||
newMethod.ParamList.Add(new ParamDefUser(pd.Name, pd.Sequence, pd.Flags));
|
newMethod.ParamList.Add(new ParamDefUser(pd.Name, pd.Sequence, pd.Attributes));
|
||||||
foreach (var gp in method.GenericParams) {
|
foreach (var gp in method.GenericParameters) {
|
||||||
var newGp = new GenericParamUser(gp.Number, gp.Flags, gp.Name);
|
var newGp = new GenericParamUser(gp.Number, gp.Flags, gp.Name);
|
||||||
foreach (var gpc in newGp.GenericParamConstraints)
|
foreach (var gpc in newGp.GenericParamConstraints)
|
||||||
newGp.GenericParamConstraints.Add(new GenericParamConstraintUser(gpc.Constraint));
|
newGp.GenericParamConstraints.Add(new GenericParamConstraintUser(gpc.Constraint));
|
||||||
newMethod.GenericParams.Add(newGp);
|
newMethod.GenericParameters.Add(newGp);
|
||||||
}
|
}
|
||||||
newMethod.Body = new CilBody();
|
newMethod.Body = new CilBody();
|
||||||
copyBodyFromTo(method, newMethod);
|
copyBodyFromTo(method, newMethod);
|
||||||
|
@ -754,9 +754,9 @@ namespace de4dot.blocks {
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
public static string getCustomArgAsString(CustomAttribute cattr, int arg) {
|
public static string getCustomArgAsString(CustomAttribute cattr, int arg) {
|
||||||
if (cattr == null || arg >= cattr.Arguments.Count)
|
if (cattr == null || arg >= cattr.ConstructorArguments.Count)
|
||||||
return null;
|
return null;
|
||||||
var carg = cattr.Arguments[arg];
|
var carg = cattr.ConstructorArguments[arg];
|
||||||
if (carg.Type.GetElementType() != ElementType.String)
|
if (carg.Type.GetElementType() != ElementType.String)
|
||||||
return null;
|
return null;
|
||||||
return UTF8String.ToSystemStringOrEmpty((UTF8String)carg.Value);
|
return UTF8String.ToSystemStringOrEmpty((UTF8String)carg.Value);
|
||||||
|
|
|
@ -60,8 +60,8 @@ namespace de4dot.blocks {
|
||||||
var newSig = create(field.FieldSig, genericArgs);
|
var newSig = create(field.FieldSig, genericArgs);
|
||||||
if (newSig == field.FieldSig)
|
if (newSig == field.FieldSig)
|
||||||
return field;
|
return field;
|
||||||
var ownerModule = field.DeclaringType != null ? field.DeclaringType.OwnerModule : null;
|
var module = field.DeclaringType != null ? field.DeclaringType.Module : null;
|
||||||
return new MemberRefUser(ownerModule, field.Name, newSig, field.DeclaringType);
|
return new MemberRefUser(module, field.Name, newSig, field.DeclaringType);
|
||||||
}
|
}
|
||||||
|
|
||||||
public static FieldSig create(FieldSig sig, GenericInstSig git) {
|
public static FieldSig create(FieldSig sig, GenericInstSig git) {
|
||||||
|
@ -141,7 +141,7 @@ namespace de4dot.blocks {
|
||||||
if (newSig == sig)
|
if (newSig == sig)
|
||||||
return method;
|
return method;
|
||||||
|
|
||||||
return new MemberRefUser(method.DeclaringType.OwnerModule, method.Name, newSig, method.DeclaringType);
|
return new MemberRefUser(method.DeclaringType.Module, method.Name, newSig, method.DeclaringType);
|
||||||
}
|
}
|
||||||
|
|
||||||
GenericArgsSubstitutor(IList<TypeSig> genericArgs) {
|
GenericArgsSubstitutor(IList<TypeSig> genericArgs) {
|
||||||
|
|
|
@ -90,7 +90,7 @@ namespace de4dot.blocks {
|
||||||
30, // NestedFamORAssem
|
30, // NestedFamORAssem
|
||||||
};
|
};
|
||||||
static int getAccessibilityOrder(TypeDef typeDef) {
|
static int getAccessibilityOrder(TypeDef typeDef) {
|
||||||
return accessibilityOrder[(int)typeDef.Flags & 7];
|
return accessibilityOrder[(int)typeDef.Attributes & 7];
|
||||||
}
|
}
|
||||||
|
|
||||||
public void onTypesRenamed() {
|
public void onTypesRenamed() {
|
||||||
|
@ -170,7 +170,7 @@ namespace de4dot.blocks {
|
||||||
70, // <reserved>
|
70, // <reserved>
|
||||||
};
|
};
|
||||||
static int getAccessibilityOrder(FieldDef fieldDefinition) {
|
static int getAccessibilityOrder(FieldDef fieldDefinition) {
|
||||||
return accessibilityOrder[(int)fieldDefinition.Flags & 7];
|
return accessibilityOrder[(int)fieldDefinition.Attributes & 7];
|
||||||
}
|
}
|
||||||
|
|
||||||
public void onTypesRenamed() {
|
public void onTypesRenamed() {
|
||||||
|
@ -262,7 +262,7 @@ namespace de4dot.blocks {
|
||||||
70, // <reserved>
|
70, // <reserved>
|
||||||
};
|
};
|
||||||
static int getAccessibilityOrder(MethodDef methodDefinition) {
|
static int getAccessibilityOrder(MethodDef methodDefinition) {
|
||||||
return accessibilityOrder[(int)methodDefinition.Flags & 7];
|
return accessibilityOrder[(int)methodDefinition.Attributes & 7];
|
||||||
}
|
}
|
||||||
|
|
||||||
public void onTypesRenamed() {
|
public void onTypesRenamed() {
|
||||||
|
@ -422,23 +422,23 @@ namespace de4dot.blocks {
|
||||||
readonly uint token;
|
readonly uint token;
|
||||||
|
|
||||||
public ScopeAndTokenKey(TypeDef type)
|
public ScopeAndTokenKey(TypeDef type)
|
||||||
: this(type.OwnerModule, type.MDToken.Raw) {
|
: this(type.Module, type.MDToken.Raw) {
|
||||||
}
|
}
|
||||||
|
|
||||||
public ScopeAndTokenKey(FieldDef field)
|
public ScopeAndTokenKey(FieldDef field)
|
||||||
: this(field.DeclaringType == null ? null : field.DeclaringType.OwnerModule, field.MDToken.Raw) {
|
: this(field.DeclaringType == null ? null : field.DeclaringType.Module, field.MDToken.Raw) {
|
||||||
}
|
}
|
||||||
|
|
||||||
public ScopeAndTokenKey(MethodDef method)
|
public ScopeAndTokenKey(MethodDef method)
|
||||||
: this(method.DeclaringType == null ? null : method.DeclaringType.OwnerModule, method.MDToken.Raw) {
|
: this(method.DeclaringType == null ? null : method.DeclaringType.Module, method.MDToken.Raw) {
|
||||||
}
|
}
|
||||||
|
|
||||||
public ScopeAndTokenKey(PropertyDef prop)
|
public ScopeAndTokenKey(PropertyDef prop)
|
||||||
: this(prop.DeclaringType == null ? null : prop.DeclaringType.OwnerModule, prop.MDToken.Raw) {
|
: this(prop.DeclaringType == null ? null : prop.DeclaringType.Module, prop.MDToken.Raw) {
|
||||||
}
|
}
|
||||||
|
|
||||||
public ScopeAndTokenKey(EventDef evt)
|
public ScopeAndTokenKey(EventDef evt)
|
||||||
: this(evt.DeclaringType == null ? null : evt.DeclaringType.OwnerModule, evt.MDToken.Raw) {
|
: this(evt.DeclaringType == null ? null : evt.DeclaringType.Module, evt.MDToken.Raw) {
|
||||||
}
|
}
|
||||||
|
|
||||||
public ScopeAndTokenKey(IScope scope, uint token) {
|
public ScopeAndTokenKey(IScope scope, uint token) {
|
||||||
|
|
|
@ -41,7 +41,7 @@ namespace de4dot.blocks.cflow {
|
||||||
}
|
}
|
||||||
|
|
||||||
protected virtual bool canInline(MethodDef method) {
|
protected virtual bool canInline(MethodDef method) {
|
||||||
if (method.GenericParams.Count > 0)
|
if (method.GenericParameters.Count > 0)
|
||||||
return false;
|
return false;
|
||||||
if (method == blocks.Method)
|
if (method == blocks.Method)
|
||||||
return false;
|
return false;
|
||||||
|
|
|
@ -678,13 +678,13 @@ namespace de4dot.code {
|
||||||
static bool getMethodImplOptions(CustomAttribute cattr, ref int value) {
|
static bool getMethodImplOptions(CustomAttribute cattr, ref int value) {
|
||||||
if (cattr.IsRawBlob)
|
if (cattr.IsRawBlob)
|
||||||
return false;
|
return false;
|
||||||
if (cattr.Arguments.Count != 1)
|
if (cattr.ConstructorArguments.Count != 1)
|
||||||
return false;
|
return false;
|
||||||
if (cattr.Arguments[0].Type.ElementType != ElementType.I2 &&
|
if (cattr.ConstructorArguments[0].Type.ElementType != ElementType.I2 &&
|
||||||
cattr.Arguments[0].Type.FullName != "System.Runtime.CompilerServices.MethodImplOptions")
|
cattr.ConstructorArguments[0].Type.FullName != "System.Runtime.CompilerServices.MethodImplOptions")
|
||||||
return false;
|
return false;
|
||||||
|
|
||||||
var arg = cattr.Arguments[0].Value;
|
var arg = cattr.ConstructorArguments[0].Value;
|
||||||
if (arg is short) {
|
if (arg is short) {
|
||||||
value = (short)arg;
|
value = (short)arg;
|
||||||
return true;
|
return true;
|
||||||
|
|
|
@ -135,7 +135,7 @@ namespace de4dot.code.deobfuscators.Agile_NET {
|
||||||
continue;
|
continue;
|
||||||
if (type.Methods.Count != 2)
|
if (type.Methods.Count != 2)
|
||||||
continue;
|
continue;
|
||||||
if (type.FindClassConstructor() == null)
|
if (type.FindStaticConstructor() == null)
|
||||||
continue;
|
continue;
|
||||||
var cs = type.FindMethod("cs");
|
var cs = type.FindMethod("cs");
|
||||||
if (cs == null)
|
if (cs == null)
|
||||||
|
|
|
@ -110,7 +110,7 @@ namespace de4dot.code.deobfuscators.Agile_NET.vm {
|
||||||
case ElementType.Var:
|
case ElementType.Var:
|
||||||
var gvar = (GenericVar)type;
|
var gvar = (GenericVar)type;
|
||||||
var dt = method.DeclaringType;
|
var dt = method.DeclaringType;
|
||||||
if (dt == null || gvar.Number >= dt.GenericParams.Count)
|
if (dt == null || gvar.Number >= dt.GenericParameters.Count)
|
||||||
return false;
|
return false;
|
||||||
break;
|
break;
|
||||||
|
|
||||||
|
|
|
@ -109,7 +109,7 @@ namespace de4dot.code.deobfuscators.Agile_NET.vm {
|
||||||
}
|
}
|
||||||
|
|
||||||
bool isStackType(TypeDef type, TypeDef stackValueType) {
|
bool isStackType(TypeDef type, TypeDef stackValueType) {
|
||||||
if (type.InterfaceImpls.Count != 2)
|
if (type.Interfaces.Count != 2)
|
||||||
return false;
|
return false;
|
||||||
if (!implementsInterface(type, "System.Collections.ICollection"))
|
if (!implementsInterface(type, "System.Collections.ICollection"))
|
||||||
return false;
|
return false;
|
||||||
|
@ -141,7 +141,7 @@ namespace de4dot.code.deobfuscators.Agile_NET.vm {
|
||||||
}
|
}
|
||||||
|
|
||||||
static bool implementsInterface(TypeDef type, string ifaceName) {
|
static bool implementsInterface(TypeDef type, string ifaceName) {
|
||||||
foreach (var iface in type.InterfaceImpls) {
|
foreach (var iface in type.Interfaces) {
|
||||||
if (iface.Interface.FullName == ifaceName)
|
if (iface.Interface.FullName == ifaceName)
|
||||||
return true;
|
return true;
|
||||||
}
|
}
|
||||||
|
@ -176,7 +176,7 @@ namespace de4dot.code.deobfuscators.Agile_NET.vm {
|
||||||
};
|
};
|
||||||
var cflowDeobfuscator = new CflowDeobfuscator();
|
var cflowDeobfuscator = new CflowDeobfuscator();
|
||||||
foreach (var type in module.Types) {
|
foreach (var type in module.Types) {
|
||||||
var cctor = type.FindClassConstructor();
|
var cctor = type.FindStaticConstructor();
|
||||||
if (cctor == null)
|
if (cctor == null)
|
||||||
continue;
|
continue;
|
||||||
requiredFields[0] = type.FullName;
|
requiredFields[0] = type.FullName;
|
||||||
|
|
|
@ -35,7 +35,7 @@ namespace de4dot.code.deobfuscators.Babel_NET {
|
||||||
}
|
}
|
||||||
|
|
||||||
bool isInOurModule(IMemberRef memberRef) {
|
bool isInOurModule(IMemberRef memberRef) {
|
||||||
return memberRef.OwnerModule == module;
|
return memberRef.Module == module;
|
||||||
}
|
}
|
||||||
|
|
||||||
Importer createImporter() {
|
Importer createImporter() {
|
||||||
|
|
|
@ -305,9 +305,9 @@ namespace de4dot.code.deobfuscators.CodeVeil {
|
||||||
if (!DotNetUtils.isMethod(newobjCtor, "System.Void", "(System.Reflection.Assembly,System.String)"))
|
if (!DotNetUtils.isMethod(newobjCtor, "System.Void", "(System.Reflection.Assembly,System.String)"))
|
||||||
continue;
|
continue;
|
||||||
var type = newobjCtor.DeclaringType;
|
var type = newobjCtor.DeclaringType;
|
||||||
if (type.InterfaceImpls.Count != 1)
|
if (type.Interfaces.Count != 1)
|
||||||
continue;
|
continue;
|
||||||
if (type.InterfaceImpls[0].Interface != bundleStreamProviderIFace)
|
if (type.Interfaces[0].Interface != bundleStreamProviderIFace)
|
||||||
continue;
|
continue;
|
||||||
|
|
||||||
streamProviderType = type;
|
streamProviderType = type;
|
||||||
|
|
|
@ -46,7 +46,7 @@ namespace de4dot.code.deobfuscators.CodeVeil {
|
||||||
if (retType.IsMethodVar)
|
if (retType.IsMethodVar)
|
||||||
return retType.Number >= sig.GenParamCount;
|
return retType.Number >= sig.GenParamCount;
|
||||||
var dt = method.DeclaringType;
|
var dt = method.DeclaringType;
|
||||||
return dt == null || retType.Number >= dt.GenericParams.Count;
|
return dt == null || retType.Number >= dt.GenericParameters.Count;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
|
@ -183,7 +183,7 @@ namespace de4dot.code.deobfuscators.CodeVeil {
|
||||||
}
|
}
|
||||||
|
|
||||||
static bool hasInterface(TypeDef type, string interfaceFullName) {
|
static bool hasInterface(TypeDef type, string interfaceFullName) {
|
||||||
foreach (var iface in type.InterfaceImpls) {
|
foreach (var iface in type.Interfaces) {
|
||||||
if (iface.Interface.FullName == interfaceFullName)
|
if (iface.Interface.FullName == interfaceFullName)
|
||||||
return true;
|
return true;
|
||||||
}
|
}
|
||||||
|
@ -324,7 +324,7 @@ namespace de4dot.code.deobfuscators.CodeVeil {
|
||||||
continue;
|
continue;
|
||||||
|
|
||||||
Logger.v("Decrypted resource {0}", Utils.toCsharpString(resource.Name));
|
Logger.v("Decrypted resource {0}", Utils.toCsharpString(resource.Name));
|
||||||
module.Resources[i] = new EmbeddedResource(resource.Name, decrypted, resource.Flags);
|
module.Resources[i] = new EmbeddedResource(resource.Name, decrypted, resource.Attributes);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
@ -56,7 +56,7 @@ namespace de4dot.code.deobfuscators.CodeVeil {
|
||||||
foreach (var type in module.Types) {
|
foreach (var type in module.Types) {
|
||||||
if (!type.HasNestedTypes)
|
if (!type.HasNestedTypes)
|
||||||
continue;
|
continue;
|
||||||
if ((type.Flags & ~TypeAttributes.Sealed) != 0)
|
if ((type.Attributes & ~TypeAttributes.Sealed) != 0)
|
||||||
continue;
|
continue;
|
||||||
|
|
||||||
if (!checkTamperDetectionClasses(type.NestedTypes))
|
if (!checkTamperDetectionClasses(type.NestedTypes))
|
||||||
|
@ -92,7 +92,7 @@ namespace de4dot.code.deobfuscators.CodeVeil {
|
||||||
bool isTamperDetectionClass(TypeDef type) {
|
bool isTamperDetectionClass(TypeDef type) {
|
||||||
if (type.BaseType == null || type.BaseType.FullName != "System.Object")
|
if (type.BaseType == null || type.BaseType.FullName != "System.Object")
|
||||||
return false;
|
return false;
|
||||||
if ((type.Flags & ~TypeAttributes.Sealed) != TypeAttributes.NestedAssembly)
|
if ((type.Attributes & ~TypeAttributes.Sealed) != TypeAttributes.NestedAssembly)
|
||||||
return false;
|
return false;
|
||||||
|
|
||||||
MethodDef cctor = null, initMethod = null;
|
MethodDef cctor = null, initMethod = null;
|
||||||
|
|
|
@ -85,7 +85,7 @@ namespace de4dot.code.deobfuscators.CodeWall {
|
||||||
}
|
}
|
||||||
|
|
||||||
byte[] getPublicKeyToken() {
|
byte[] getPublicKeyToken() {
|
||||||
var module = method.OwnerModule;
|
var module = method.Module;
|
||||||
if (module.Assembly == null || PublicKeyBase.IsNullOrEmpty2(module.Assembly.PublicKey))
|
if (module.Assembly == null || PublicKeyBase.IsNullOrEmpty2(module.Assembly.PublicKey))
|
||||||
return null;
|
return null;
|
||||||
return module.Assembly.PublicKeyToken.Data;
|
return module.Assembly.PublicKeyToken.Data;
|
||||||
|
|
|
@ -107,7 +107,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
|
||||||
if (decrypterType == null)
|
if (decrypterType == null)
|
||||||
return;
|
return;
|
||||||
|
|
||||||
encryptedResource = CoUtils.getResource(module, DotNetUtils.getCodeStrings(decrypterType.FindClassConstructor()));
|
encryptedResource = CoUtils.getResource(module, DotNetUtils.getCodeStrings(decrypterType.FindStaticConstructor()));
|
||||||
constantsData = resourceDecrypter.decrypt(encryptedResource.Data.CreateStream());
|
constantsData = resourceDecrypter.decrypt(encryptedResource.Data.CreateStream());
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
@ -73,7 +73,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
|
||||||
if (!new FieldTypes(type).all(requiredFields))
|
if (!new FieldTypes(type).all(requiredFields))
|
||||||
return false;
|
return false;
|
||||||
|
|
||||||
var cctor = type.FindClassConstructor();
|
var cctor = type.FindStaticConstructor();
|
||||||
if (cctor == null)
|
if (cctor == null)
|
||||||
return false;
|
return false;
|
||||||
var decryptMethodTmp = findDecryptMethod(type);
|
var decryptMethodTmp = findDecryptMethod(type);
|
||||||
|
@ -169,7 +169,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
|
||||||
encMethodToken = 0;
|
encMethodToken = 0;
|
||||||
encDeclaringTypeToken = 0;
|
encDeclaringTypeToken = 0;
|
||||||
|
|
||||||
var cctor = delegateType.FindClassConstructor();
|
var cctor = delegateType.FindStaticConstructor();
|
||||||
if (cctor == null)
|
if (cctor == null)
|
||||||
return false;
|
return false;
|
||||||
|
|
||||||
|
|
|
@ -78,7 +78,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
|
||||||
|
|
||||||
switch (ctx.proxyCreatorType) {
|
switch (ctx.proxyCreatorType) {
|
||||||
case ProxyCreatorType.CallOrCallvirt:
|
case ProxyCreatorType.CallOrCallvirt:
|
||||||
callOpcode = field.IsFamORAssem ? OpCodes.Callvirt : OpCodes.Call;
|
callOpcode = field.IsFamilyOrAssembly ? OpCodes.Callvirt : OpCodes.Call;
|
||||||
break;
|
break;
|
||||||
case ProxyCreatorType.CallCtor:
|
case ProxyCreatorType.CallCtor:
|
||||||
callOpcode = OpCodes.Call;
|
callOpcode = OpCodes.Call;
|
||||||
|
|
|
@ -84,7 +84,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
|
||||||
if (!new FieldTypes(type).exactly(requiredTypes))
|
if (!new FieldTypes(type).exactly(requiredTypes))
|
||||||
continue;
|
continue;
|
||||||
|
|
||||||
var cctor = type.FindClassConstructor();
|
var cctor = type.FindStaticConstructor();
|
||||||
if (cctor == null)
|
if (cctor == null)
|
||||||
continue;
|
continue;
|
||||||
|
|
||||||
|
|
|
@ -108,7 +108,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
|
||||||
|
|
||||||
resolverVersion = checkSetupMethod(initMethod);
|
resolverVersion = checkSetupMethod(initMethod);
|
||||||
if (resolverVersion == ResolverVersion.None)
|
if (resolverVersion == ResolverVersion.None)
|
||||||
resolverVersion = checkSetupMethod(initMethod.DeclaringType.FindClassConstructor());
|
resolverVersion = checkSetupMethod(initMethod.DeclaringType.FindStaticConstructor());
|
||||||
if (resolverVersion == ResolverVersion.None)
|
if (resolverVersion == ResolverVersion.None)
|
||||||
return false;
|
return false;
|
||||||
|
|
||||||
|
|
|
@ -76,7 +76,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
|
||||||
string getResourceName() {
|
string getResourceName() {
|
||||||
var defaultName = module.Assembly.Name.String + module.Assembly.Name.String;
|
var defaultName = module.Assembly.Name.String + module.Assembly.Name.String;
|
||||||
|
|
||||||
var cctor = stringDecrypterType.FindClassConstructor();
|
var cctor = stringDecrypterType.FindStaticConstructor();
|
||||||
if (cctor == null)
|
if (cctor == null)
|
||||||
return defaultName;
|
return defaultName;
|
||||||
|
|
||||||
|
|
|
@ -298,9 +298,9 @@ done:
|
||||||
public static bool canInline(MethodDef method) {
|
public static bool canInline(MethodDef method) {
|
||||||
if (method == null || method.Body == null)
|
if (method == null || method.Body == null)
|
||||||
return false;
|
return false;
|
||||||
if (method.Flags != (MethodAttributes.Assembly | MethodAttributes.Static))
|
if (method.Attributes != (MethodAttributes.Assembly | MethodAttributes.Static))
|
||||||
return false;
|
return false;
|
||||||
if (method.GenericParams.Count > 0)
|
if (method.GenericParameters.Count > 0)
|
||||||
return false;
|
return false;
|
||||||
if (method.Body.ExceptionHandlers.Count > 0)
|
if (method.Body.ExceptionHandlers.Count > 0)
|
||||||
return false;
|
return false;
|
||||||
|
|
|
@ -79,7 +79,7 @@ namespace de4dot.code.deobfuscators.DeepSea {
|
||||||
var fieldsDict = new FieldDefinitionAndDeclaringTypeDict<FieldDef>();
|
var fieldsDict = new FieldDefinitionAndDeclaringTypeDict<FieldDef>();
|
||||||
typeToFieldsDict.add(ownerType, fieldsDict);
|
typeToFieldsDict.add(ownerType, fieldsDict);
|
||||||
foreach (var structField in structType.Fields) {
|
foreach (var structField in structType.Fields) {
|
||||||
var newField = module.UpdateRowId(new FieldDefUser(structField.Name, structField.FieldSig.Clone(), structField.Flags));
|
var newField = module.UpdateRowId(new FieldDefUser(structField.Name, structField.FieldSig.Clone(), structField.Attributes));
|
||||||
ownerType.Fields.Add(newField);
|
ownerType.Fields.Add(newField);
|
||||||
fieldsDict.add(structField, newField);
|
fieldsDict.add(structField, newField);
|
||||||
}
|
}
|
||||||
|
@ -97,11 +97,11 @@ namespace de4dot.code.deobfuscators.DeepSea {
|
||||||
continue;
|
continue;
|
||||||
if (!checkBaseType(fieldType))
|
if (!checkBaseType(fieldType))
|
||||||
continue;
|
continue;
|
||||||
if ((fieldType.Flags & ~TypeAttributes.Sealed) != TypeAttributes.NestedAssembly)
|
if ((fieldType.Attributes & ~TypeAttributes.Sealed) != TypeAttributes.NestedAssembly)
|
||||||
continue;
|
continue;
|
||||||
if (fieldType.NestedTypes.Count > 0)
|
if (fieldType.NestedTypes.Count > 0)
|
||||||
continue;
|
continue;
|
||||||
if (fieldType.GenericParams.Count > 0)
|
if (fieldType.GenericParameters.Count > 0)
|
||||||
continue;
|
continue;
|
||||||
if (fieldType.Fields.Count == 0)
|
if (fieldType.Fields.Count == 0)
|
||||||
continue;
|
continue;
|
||||||
|
@ -146,7 +146,7 @@ namespace de4dot.code.deobfuscators.DeepSea {
|
||||||
IEnumerable<FieldDef> getPossibleFields(TypeDef type) {
|
IEnumerable<FieldDef> getPossibleFields(TypeDef type) {
|
||||||
var typeToFields = new TypeDefinitionDict<List<FieldDef>>();
|
var typeToFields = new TypeDefinitionDict<List<FieldDef>>();
|
||||||
foreach (var field in type.Fields) {
|
foreach (var field in type.Fields) {
|
||||||
if (field.Flags != FieldAttributes.Private)
|
if (field.Attributes != FieldAttributes.Private)
|
||||||
continue;
|
continue;
|
||||||
var fieldType = DotNetUtils.getType(module, field.FieldSig.GetFieldType());
|
var fieldType = DotNetUtils.getType(module, field.FieldSig.GetFieldType());
|
||||||
if (fieldType == null)
|
if (fieldType == null)
|
||||||
|
@ -187,7 +187,7 @@ namespace de4dot.code.deobfuscators.DeepSea {
|
||||||
continue;
|
continue;
|
||||||
if (!method.IsStatic)
|
if (!method.IsStatic)
|
||||||
return true;
|
return true;
|
||||||
if (method.GenericParams.Count > 0)
|
if (method.GenericParameters.Count > 0)
|
||||||
return true;
|
return true;
|
||||||
if (method.Body == null)
|
if (method.Body == null)
|
||||||
return true;
|
return true;
|
||||||
|
|
|
@ -318,9 +318,9 @@ namespace de4dot.code.deobfuscators.DeepSea {
|
||||||
}
|
}
|
||||||
|
|
||||||
short[] findKey() {
|
short[] findKey() {
|
||||||
if (cctor.OwnerModule.Assembly == null)
|
if (cctor.Module.Assembly == null)
|
||||||
return null;
|
return null;
|
||||||
var pkt = cctor.OwnerModule.Assembly.PublicKeyToken;
|
var pkt = cctor.Module.Assembly.PublicKeyToken;
|
||||||
if (!PublicKeyBase.IsNullOrEmpty2(pkt))
|
if (!PublicKeyBase.IsNullOrEmpty2(pkt))
|
||||||
return getPublicKeyTokenKey(pkt.Data);
|
return getPublicKeyTokenKey(pkt.Data);
|
||||||
return findKey(cctor);
|
return findKey(cctor);
|
||||||
|
@ -379,7 +379,7 @@ namespace de4dot.code.deobfuscators.DeepSea {
|
||||||
|
|
||||||
public void cleanup() {
|
public void cleanup() {
|
||||||
arrayInfo.initField.InitialValue = new byte[1];
|
arrayInfo.initField.InitialValue = new byte[1];
|
||||||
arrayInfo.initField.FieldSig.Type = arrayInfo.initField.OwnerModule.CorLibTypes.Byte;
|
arrayInfo.initField.FieldSig.Type = arrayInfo.initField.Module.CorLibTypes.Byte;
|
||||||
removeInitializeArrayCall(cctor, arrayInfo.initField);
|
removeInitializeArrayCall(cctor, arrayInfo.initField);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
@ -501,9 +501,9 @@ namespace de4dot.code.deobfuscators.DeepSea {
|
||||||
}
|
}
|
||||||
|
|
||||||
short[] findKey() {
|
short[] findKey() {
|
||||||
if (cctor.OwnerModule.Assembly == null)
|
if (cctor.Module.Assembly == null)
|
||||||
return null;
|
return null;
|
||||||
var pkt = cctor.OwnerModule.Assembly.PublicKeyToken;
|
var pkt = cctor.Module.Assembly.PublicKeyToken;
|
||||||
if (!PublicKeyBase.IsNullOrEmpty2(pkt))
|
if (!PublicKeyBase.IsNullOrEmpty2(pkt))
|
||||||
return getPublicKeyTokenKey(pkt.Data);
|
return getPublicKeyTokenKey(pkt.Data);
|
||||||
return findKey(cctor);
|
return findKey(cctor);
|
||||||
|
@ -538,7 +538,7 @@ namespace de4dot.code.deobfuscators.DeepSea {
|
||||||
|
|
||||||
public void cleanup() {
|
public void cleanup() {
|
||||||
encryptedDataField.InitialValue = new byte[1];
|
encryptedDataField.InitialValue = new byte[1];
|
||||||
encryptedDataField.FieldSig.Type = encryptedDataField.OwnerModule.CorLibTypes.Byte;
|
encryptedDataField.FieldSig.Type = encryptedDataField.Module.CorLibTypes.Byte;
|
||||||
removeInitializeArrayCall(cctor, encryptedDataField);
|
removeInitializeArrayCall(cctor, encryptedDataField);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
@ -628,9 +628,9 @@ namespace de4dot.code.deobfuscators.DeepSea {
|
||||||
}
|
}
|
||||||
|
|
||||||
short[] findKey() {
|
short[] findKey() {
|
||||||
if (cctor.OwnerModule.Assembly == null)
|
if (cctor.Module.Assembly == null)
|
||||||
return null;
|
return null;
|
||||||
var pkt = cctor.OwnerModule.Assembly.PublicKeyToken;
|
var pkt = cctor.Module.Assembly.PublicKeyToken;
|
||||||
if (!PublicKeyBase.IsNullOrEmpty2(pkt))
|
if (!PublicKeyBase.IsNullOrEmpty2(pkt))
|
||||||
return getPublicKeyTokenKey(pkt.Data);
|
return getPublicKeyTokenKey(pkt.Data);
|
||||||
return findKey(cctor);
|
return findKey(cctor);
|
||||||
|
@ -730,7 +730,7 @@ namespace de4dot.code.deobfuscators.DeepSea {
|
||||||
var pkt = module.Assembly.PublicKeyToken;
|
var pkt = module.Assembly.PublicKeyToken;
|
||||||
bool hasPublicKeyToken = !PublicKeyBase.IsNullOrEmpty2(pkt);
|
bool hasPublicKeyToken = !PublicKeyBase.IsNullOrEmpty2(pkt);
|
||||||
foreach (var type in module.GetTypes()) {
|
foreach (var type in module.GetTypes()) {
|
||||||
var cctor = type.FindClassConstructor();
|
var cctor = type.FindStaticConstructor();
|
||||||
if (cctor == null)
|
if (cctor == null)
|
||||||
continue;
|
continue;
|
||||||
|
|
||||||
|
|
|
@ -243,7 +243,7 @@ namespace de4dot.code.deobfuscators {
|
||||||
|
|
||||||
var entryPoint = module.EntryPoint;
|
var entryPoint = module.EntryPoint;
|
||||||
if (entryPoint != null) {
|
if (entryPoint != null) {
|
||||||
cctor = entryPoint.DeclaringType.FindClassConstructor();
|
cctor = entryPoint.DeclaringType.FindStaticConstructor();
|
||||||
if (cctor != null)
|
if (cctor != null)
|
||||||
yield return cctor;
|
yield return cctor;
|
||||||
}
|
}
|
||||||
|
@ -251,7 +251,7 @@ namespace de4dot.code.deobfuscators {
|
||||||
foreach (var type in module.GetTypes()) {
|
foreach (var type in module.GetTypes()) {
|
||||||
if (type == module.GlobalType)
|
if (type == module.GlobalType)
|
||||||
continue;
|
continue;
|
||||||
cctor = type.FindClassConstructor();
|
cctor = type.FindStaticConstructor();
|
||||||
if (cctor == null)
|
if (cctor == null)
|
||||||
continue;
|
continue;
|
||||||
yield return cctor;
|
yield return cctor;
|
||||||
|
|
|
@ -212,7 +212,7 @@ namespace de4dot.code.deobfuscators {
|
||||||
foreach (var field in type.Fields) {
|
foreach (var field in type.Fields) {
|
||||||
if (field.IsStatic)
|
if (field.IsStatic)
|
||||||
continue;
|
continue;
|
||||||
field.IsRTSpecialName = true;
|
field.IsRuntimeSpecialName = true;
|
||||||
field.IsSpecialName = true;
|
field.IsSpecialName = true;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
@ -377,7 +377,7 @@ namespace de4dot.code.deobfuscators {
|
||||||
void deleteEmptyCctors() {
|
void deleteEmptyCctors() {
|
||||||
var emptyCctorsToRemove = new List<MethodDef>();
|
var emptyCctorsToRemove = new List<MethodDef>();
|
||||||
foreach (var type in module.GetTypes()) {
|
foreach (var type in module.GetTypes()) {
|
||||||
var cctor = type.FindClassConstructor();
|
var cctor = type.FindStaticConstructor();
|
||||||
if (cctor != null && DotNetUtils.isEmpty(cctor))
|
if (cctor != null && DotNetUtils.isEmpty(cctor))
|
||||||
emptyCctorsToRemove.Add(cctor);
|
emptyCctorsToRemove.Add(cctor);
|
||||||
}
|
}
|
||||||
|
|
|
@ -67,7 +67,7 @@ namespace de4dot.code.deobfuscators {
|
||||||
return;
|
return;
|
||||||
|
|
||||||
ourType = new TypeDefUser("", string.Format("<PrivateImplementationDetails>{0}", getModuleId()), module.CorLibTypes.Object.TypeDefOrRef);
|
ourType = new TypeDefUser("", string.Format("<PrivateImplementationDetails>{0}", getModuleId()), module.CorLibTypes.Object.TypeDefOrRef);
|
||||||
ourType.Flags = TypeAttributes.NotPublic | TypeAttributes.AutoLayout |
|
ourType.Attributes = TypeAttributes.NotPublic | TypeAttributes.AutoLayout |
|
||||||
TypeAttributes.Class | TypeAttributes.AnsiClass;
|
TypeAttributes.Class | TypeAttributes.AnsiClass;
|
||||||
module.UpdateRowId(ourType);
|
module.UpdateRowId(ourType);
|
||||||
module.Types.Add(ourType);
|
module.Types.Add(ourType);
|
||||||
|
@ -99,7 +99,7 @@ namespace de4dot.code.deobfuscators {
|
||||||
valueType = DotNetUtils.findOrCreateTypeReference(module, module.CorLibTypes.AssemblyRef, "System", "ValueType", false);
|
valueType = DotNetUtils.findOrCreateTypeReference(module, module.CorLibTypes.AssemblyRef, "System", "ValueType", false);
|
||||||
arrayType = new TypeDefUser("", string.Format("__StaticArrayInitTypeSize={0}", size), valueType.TypeDefOrRef);
|
arrayType = new TypeDefUser("", string.Format("__StaticArrayInitTypeSize={0}", size), valueType.TypeDefOrRef);
|
||||||
module.UpdateRowId(arrayType);
|
module.UpdateRowId(arrayType);
|
||||||
arrayType.Flags = TypeAttributes.NestedPrivate | TypeAttributes.ExplicitLayout |
|
arrayType.Attributes = TypeAttributes.NestedPrivate | TypeAttributes.ExplicitLayout |
|
||||||
TypeAttributes.Class | TypeAttributes.Sealed | TypeAttributes.AnsiClass;
|
TypeAttributes.Class | TypeAttributes.Sealed | TypeAttributes.AnsiClass;
|
||||||
ourType.NestedTypes.Add(arrayType);
|
ourType.NestedTypes.Add(arrayType);
|
||||||
sizeToArrayType[size] = arrayType;
|
sizeToArrayType[size] = arrayType;
|
||||||
|
|
|
@ -36,7 +36,7 @@ namespace de4dot.code.deobfuscators {
|
||||||
continue;
|
continue;
|
||||||
if (!method.IsAssembly && !method.IsPrivateScope && !method.IsPrivate)
|
if (!method.IsAssembly && !method.IsPrivateScope && !method.IsPrivate)
|
||||||
continue;
|
continue;
|
||||||
if (method.GenericParams.Count > 0)
|
if (method.GenericParameters.Count > 0)
|
||||||
continue;
|
continue;
|
||||||
if (method.Name == ".cctor")
|
if (method.Name == ".cctor")
|
||||||
continue;
|
continue;
|
||||||
|
|
|
@ -161,7 +161,7 @@ namespace de4dot.code.deobfuscators {
|
||||||
|
|
||||||
TypeSig type;
|
TypeSig type;
|
||||||
Local local;
|
Local local;
|
||||||
var corLibTypes = method.DeclaringType.OwnerModule.CorLibTypes;
|
var corLibTypes = method.DeclaringType.Module.CorLibTypes;
|
||||||
switch (pushInstr.OpCode.Code) {
|
switch (pushInstr.OpCode.Code) {
|
||||||
case Code.Ldstr:
|
case Code.Ldstr:
|
||||||
type = corLibTypes.String;
|
type = corLibTypes.String;
|
||||||
|
|
|
@ -209,7 +209,7 @@ namespace de4dot.code.deobfuscators {
|
||||||
Logger.v("Finding all proxy delegates");
|
Logger.v("Finding all proxy delegates");
|
||||||
foreach (var tmp in getDelegateTypes()) {
|
foreach (var tmp in getDelegateTypes()) {
|
||||||
var type = tmp;
|
var type = tmp;
|
||||||
var cctor = type.FindClassConstructor();
|
var cctor = type.FindStaticConstructor();
|
||||||
if (cctor == null || !cctor.HasBody)
|
if (cctor == null || !cctor.HasBody)
|
||||||
continue;
|
continue;
|
||||||
if (!type.HasFields)
|
if (!type.HasFields)
|
||||||
|
@ -393,7 +393,7 @@ namespace de4dot.code.deobfuscators {
|
||||||
|
|
||||||
protected void find2() {
|
protected void find2() {
|
||||||
foreach (var type in getDelegateTypes()) {
|
foreach (var type in getDelegateTypes()) {
|
||||||
var cctor = type.FindClassConstructor();
|
var cctor = type.FindStaticConstructor();
|
||||||
if (cctor == null || !cctor.HasBody)
|
if (cctor == null || !cctor.HasBody)
|
||||||
continue;
|
continue;
|
||||||
if (!type.HasFields)
|
if (!type.HasFields)
|
||||||
|
|
|
@ -96,7 +96,7 @@ namespace de4dot.code.deobfuscators.Rummage {
|
||||||
static MethodDef checkType(TypeDef type) {
|
static MethodDef checkType(TypeDef type) {
|
||||||
if (!new FieldTypes(type).exactly(requiredFields))
|
if (!new FieldTypes(type).exactly(requiredFields))
|
||||||
return null;
|
return null;
|
||||||
var cctor = type.FindClassConstructor();
|
var cctor = type.FindStaticConstructor();
|
||||||
if (cctor == null)
|
if (cctor == null)
|
||||||
return null;
|
return null;
|
||||||
if (!new LocalTypes(cctor).all(requiredLocals))
|
if (!new LocalTypes(cctor).all(requiredLocals))
|
||||||
|
@ -161,7 +161,7 @@ namespace de4dot.code.deobfuscators.Rummage {
|
||||||
}
|
}
|
||||||
|
|
||||||
void initType(TypeDef type) {
|
void initType(TypeDef type) {
|
||||||
var cctor = type.FindClassConstructor();
|
var cctor = type.FindStaticConstructor();
|
||||||
if (cctor == null)
|
if (cctor == null)
|
||||||
return;
|
return;
|
||||||
var info = getStringInfo(cctor);
|
var info = getStringInfo(cctor);
|
||||||
|
|
|
@ -97,7 +97,7 @@ namespace de4dot.code.deobfuscators.Skater_NET {
|
||||||
if (type.HasProperties || type.HasEvents)
|
if (type.HasProperties || type.HasEvents)
|
||||||
continue;
|
continue;
|
||||||
|
|
||||||
var cctor = type.FindClassConstructor();
|
var cctor = type.FindStaticConstructor();
|
||||||
if (cctor == null)
|
if (cctor == null)
|
||||||
continue;
|
continue;
|
||||||
|
|
||||||
|
|
|
@ -73,7 +73,7 @@ namespace de4dot.code.deobfuscators.Spices_Net {
|
||||||
return false;
|
return false;
|
||||||
if (type.HasProperties || type.HasEvents || type.HasFields)
|
if (type.HasProperties || type.HasEvents || type.HasFields)
|
||||||
return false;
|
return false;
|
||||||
if (type.InterfaceImpls.Count > 0)
|
if (type.Interfaces.Count > 0)
|
||||||
return false;
|
return false;
|
||||||
var method = type.FindMethod("GetResourceFileName");
|
var method = type.FindMethod("GetResourceFileName");
|
||||||
if (!DotNetUtils.isMethod(method, "System.String", "(System.Globalization.CultureInfo)"))
|
if (!DotNetUtils.isMethod(method, "System.String", "(System.Globalization.CultureInfo)"))
|
||||||
|
|
|
@ -113,7 +113,7 @@ namespace de4dot.code.deobfuscators.Spices_Net {
|
||||||
return false;
|
return false;
|
||||||
if (!calledMethod.IsStatic)
|
if (!calledMethod.IsStatic)
|
||||||
return false;
|
return false;
|
||||||
if (calledMethod.GenericParams.Count > 0)
|
if (calledMethod.GenericParameters.Count > 0)
|
||||||
return false;
|
return false;
|
||||||
if (calledMethod.Body == null || calledMethod.Body.Instructions.Count == 0)
|
if (calledMethod.Body == null || calledMethod.Body.Instructions.Count == 0)
|
||||||
return false;
|
return false;
|
||||||
|
@ -154,17 +154,17 @@ namespace de4dot.code.deobfuscators.Spices_Net {
|
||||||
static bool checkMethodsType(TypeDef type) {
|
static bool checkMethodsType(TypeDef type) {
|
||||||
if (!type.IsNested)
|
if (!type.IsNested)
|
||||||
return false;
|
return false;
|
||||||
if ((type.Flags & ~TypeAttributes.BeforeFieldInit) != TypeAttributes.NestedAssembly)
|
if ((type.Attributes & ~TypeAttributes.BeforeFieldInit) != TypeAttributes.NestedAssembly)
|
||||||
return false;
|
return false;
|
||||||
if (type.HasProperties || type.HasEvents || type.HasFields || type.HasNestedTypes)
|
if (type.HasProperties || type.HasEvents || type.HasFields || type.HasNestedTypes)
|
||||||
return false;
|
return false;
|
||||||
if (type.GenericParams.Count > 0)
|
if (type.GenericParameters.Count > 0)
|
||||||
return false;
|
return false;
|
||||||
if (type.IsValueType || type.IsInterface)
|
if (type.IsValueType || type.IsInterface)
|
||||||
return false;
|
return false;
|
||||||
if (type.BaseType == null || type.BaseType.FullName != "System.Object")
|
if (type.BaseType == null || type.BaseType.FullName != "System.Object")
|
||||||
return false;
|
return false;
|
||||||
if (type.InterfaceImpls.Count > 0)
|
if (type.Interfaces.Count > 0)
|
||||||
return false;
|
return false;
|
||||||
if (!checkMethods(type))
|
if (!checkMethods(type))
|
||||||
return false;
|
return false;
|
||||||
|
@ -185,11 +185,11 @@ namespace de4dot.code.deobfuscators.Spices_Net {
|
||||||
foundCtor = true;
|
foundCtor = true;
|
||||||
continue;
|
continue;
|
||||||
}
|
}
|
||||||
if (method.Flags != (MethodAttributes.Assembly | MethodAttributes.Static | MethodAttributes.HideBySig))
|
if (method.Attributes != (MethodAttributes.Assembly | MethodAttributes.Static | MethodAttributes.HideBySig))
|
||||||
return false;
|
return false;
|
||||||
if (method.ImplMap != null)
|
if (method.ImplMap != null)
|
||||||
return false;
|
return false;
|
||||||
if (method.GenericParams.Count > 0)
|
if (method.GenericParameters.Count > 0)
|
||||||
return false;
|
return false;
|
||||||
|
|
||||||
numMethods++;
|
numMethods++;
|
||||||
|
|
|
@ -64,7 +64,7 @@ namespace de4dot.code.deobfuscators.Spices_Net {
|
||||||
return null;
|
return null;
|
||||||
if (type.HasMethods || type.HasEvents || type.HasProperties || type.HasNestedTypes)
|
if (type.HasMethods || type.HasEvents || type.HasProperties || type.HasNestedTypes)
|
||||||
return null;
|
return null;
|
||||||
if (type.InterfaceImpls.Count > 0)
|
if (type.Interfaces.Count > 0)
|
||||||
return null;
|
return null;
|
||||||
|
|
||||||
return type;
|
return type;
|
||||||
|
@ -95,13 +95,13 @@ namespace de4dot.code.deobfuscators.Spices_Net {
|
||||||
continue;
|
continue;
|
||||||
if (type.Fields.Count != 2)
|
if (type.Fields.Count != 2)
|
||||||
continue;
|
continue;
|
||||||
if ((type.Flags & ~TypeAttributes.Sealed) != 0)
|
if ((type.Attributes & ~TypeAttributes.Sealed) != 0)
|
||||||
continue;
|
continue;
|
||||||
if (type.BaseType == null || type.BaseType.FullName != "System.Object")
|
if (type.BaseType == null || type.BaseType.FullName != "System.Object")
|
||||||
continue;
|
continue;
|
||||||
if (hasInstanceMethods(type))
|
if (hasInstanceMethods(type))
|
||||||
continue;
|
continue;
|
||||||
var cctor = type.FindClassConstructor();
|
var cctor = type.FindStaticConstructor();
|
||||||
if (cctor == null)
|
if (cctor == null)
|
||||||
continue;
|
continue;
|
||||||
|
|
||||||
|
|
|
@ -142,7 +142,7 @@ namespace de4dot.code.renamer {
|
||||||
|
|
||||||
var outStream = new MemoryStream();
|
var outStream = new MemoryStream();
|
||||||
ResourceWriter.write(module, outStream, resourceSet);
|
ResourceWriter.write(module, outStream, resourceSet);
|
||||||
var newResource = new EmbeddedResource(resource.Name, outStream.ToArray(), resource.Flags);
|
var newResource = new EmbeddedResource(resource.Name, outStream.ToArray(), resource.Attributes);
|
||||||
int resourceIndex = module.Resources.IndexOf(resource);
|
int resourceIndex = module.Resources.IndexOf(resource);
|
||||||
if (resourceIndex < 0)
|
if (resourceIndex < 0)
|
||||||
throw new ApplicationException("Could not find index of resource");
|
throw new ApplicationException("Could not find index of resource");
|
||||||
|
|
|
@ -403,7 +403,7 @@ namespace de4dot.code.renamer {
|
||||||
string getPinvokeName(MMethodDef methodDef) {
|
string getPinvokeName(MMethodDef methodDef) {
|
||||||
var entryPoint = methodDef.MethodDef.ImplMap.Name.String;
|
var entryPoint = methodDef.MethodDef.ImplMap.Name.String;
|
||||||
if (Regex.IsMatch(entryPoint, @"^#\d+$"))
|
if (Regex.IsMatch(entryPoint, @"^#\d+$"))
|
||||||
entryPoint = DotNetUtils.getDllName(methodDef.MethodDef.ImplMap.Scope.Name.String) + "_" + entryPoint.Substring(1);
|
entryPoint = DotNetUtils.getDllName(methodDef.MethodDef.ImplMap.Module.Name.String) + "_" + entryPoint.Substring(1);
|
||||||
return entryPoint;
|
return entryPoint;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
@ -49,17 +49,17 @@ namespace de4dot.code.renamer {
|
||||||
string newName;
|
string newName;
|
||||||
|
|
||||||
string asmFullName;
|
string asmFullName;
|
||||||
if (type.OwnerModule.Assembly != null)
|
if (type.Module.Assembly != null)
|
||||||
asmFullName = type.OwnerModule.Assembly.FullName;
|
asmFullName = type.Module.Assembly.FullName;
|
||||||
else
|
else
|
||||||
asmFullName = "<no assembly>";
|
asmFullName = "<no assembly>";
|
||||||
|
|
||||||
// Make sure that two namespaces with the same names in different modules aren't renamed
|
// Make sure that two namespaces with the same names in different modules aren't renamed
|
||||||
// to the same name.
|
// to the same name.
|
||||||
var key = string.Format(" [{0}] [{1}] [{2}] [{3}] ",
|
var key = string.Format(" [{0}] [{1}] [{2}] [{3}] ",
|
||||||
type.OwnerModule.Location,
|
type.Module.Location,
|
||||||
asmFullName,
|
asmFullName,
|
||||||
type.OwnerModule.Name,
|
type.Module.Name,
|
||||||
ns);
|
ns);
|
||||||
if (namespaceToNewName.TryGetValue(key, out newName))
|
if (namespaceToNewName.TryGetValue(key, out newName))
|
||||||
return newName;
|
return newName;
|
||||||
|
|
|
@ -244,8 +244,8 @@ namespace de4dot.code.renamer.asmmodules {
|
||||||
if (ca == null || customAttributes.ContainsKey(ca))
|
if (ca == null || customAttributes.ContainsKey(ca))
|
||||||
return;
|
return;
|
||||||
customAttributes[ca] = true;
|
customAttributes[ca] = true;
|
||||||
push(ca.Ctor);
|
push(ca.Constructor);
|
||||||
add(ca.Arguments);
|
add(ca.ConstructorArguments);
|
||||||
add(ca.NamedArguments);
|
add(ca.NamedArguments);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -298,10 +298,10 @@ namespace de4dot.code.renamer.asmmodules {
|
||||||
void add(EventDef ed) {
|
void add(EventDef ed) {
|
||||||
if (ed == null || eventDefs.ContainsKey(ed))
|
if (ed == null || eventDefs.ContainsKey(ed))
|
||||||
return;
|
return;
|
||||||
if (ed.DeclaringType != null && ed.DeclaringType.OwnerModule != validModule)
|
if (ed.DeclaringType != null && ed.DeclaringType.Module != validModule)
|
||||||
return;
|
return;
|
||||||
eventDefs[ed] = true;
|
eventDefs[ed] = true;
|
||||||
push(ed.Type);
|
push(ed.EventType);
|
||||||
add(ed.CustomAttributes);
|
add(ed.CustomAttributes);
|
||||||
add(ed.AddMethod);
|
add(ed.AddMethod);
|
||||||
add(ed.InvokeMethod);
|
add(ed.InvokeMethod);
|
||||||
|
@ -320,7 +320,7 @@ namespace de4dot.code.renamer.asmmodules {
|
||||||
void add(FieldDef fd) {
|
void add(FieldDef fd) {
|
||||||
if (fd == null || fieldDefs.ContainsKey(fd))
|
if (fd == null || fieldDefs.ContainsKey(fd))
|
||||||
return;
|
return;
|
||||||
if (fd.DeclaringType != null && fd.DeclaringType.OwnerModule != validModule)
|
if (fd.DeclaringType != null && fd.DeclaringType.Module != validModule)
|
||||||
return;
|
return;
|
||||||
fieldDefs[fd] = true;
|
fieldDefs[fd] = true;
|
||||||
add(fd.CustomAttributes);
|
add(fd.CustomAttributes);
|
||||||
|
@ -363,7 +363,7 @@ namespace de4dot.code.renamer.asmmodules {
|
||||||
void add(MemberRef mr) {
|
void add(MemberRef mr) {
|
||||||
if (mr == null || memberRefs.ContainsKey(mr))
|
if (mr == null || memberRefs.ContainsKey(mr))
|
||||||
return;
|
return;
|
||||||
if (mr.OwnerModule != validModule)
|
if (mr.Module != validModule)
|
||||||
return;
|
return;
|
||||||
memberRefs[mr] = true;
|
memberRefs[mr] = true;
|
||||||
push(mr.Class);
|
push(mr.Class);
|
||||||
|
@ -381,12 +381,12 @@ namespace de4dot.code.renamer.asmmodules {
|
||||||
void add(MethodDef md) {
|
void add(MethodDef md) {
|
||||||
if (md == null || methodDefs.ContainsKey(md))
|
if (md == null || methodDefs.ContainsKey(md))
|
||||||
return;
|
return;
|
||||||
if (md.DeclaringType != null && md.DeclaringType.OwnerModule != validModule)
|
if (md.DeclaringType != null && md.DeclaringType.Module != validModule)
|
||||||
return;
|
return;
|
||||||
methodDefs[md] = true;
|
methodDefs[md] = true;
|
||||||
add(md.Signature);
|
add(md.Signature);
|
||||||
add(md.ParamList);
|
add(md.ParamList);
|
||||||
add(md.GenericParams);
|
add(md.GenericParameters);
|
||||||
add(md.DeclSecurities);
|
add(md.DeclSecurities);
|
||||||
add(md.MethodBody);
|
add(md.MethodBody);
|
||||||
add(md.CustomAttributes);
|
add(md.CustomAttributes);
|
||||||
|
@ -507,7 +507,7 @@ namespace de4dot.code.renamer.asmmodules {
|
||||||
void add(MethodSpec ms) {
|
void add(MethodSpec ms) {
|
||||||
if (ms == null || methodSpecs.ContainsKey(ms))
|
if (ms == null || methodSpecs.ContainsKey(ms))
|
||||||
return;
|
return;
|
||||||
if (ms.Method != null && ms.Method.DeclaringType != null && ms.Method.DeclaringType.OwnerModule != validModule)
|
if (ms.Method != null && ms.Method.DeclaringType != null && ms.Method.DeclaringType.Module != validModule)
|
||||||
return;
|
return;
|
||||||
methodSpecs[ms] = true;
|
methodSpecs[ms] = true;
|
||||||
push(ms.Method);
|
push(ms.Method);
|
||||||
|
@ -525,7 +525,7 @@ namespace de4dot.code.renamer.asmmodules {
|
||||||
void add(PropertyDef pd) {
|
void add(PropertyDef pd) {
|
||||||
if (pd == null || propertyDefs.ContainsKey(pd))
|
if (pd == null || propertyDefs.ContainsKey(pd))
|
||||||
return;
|
return;
|
||||||
if (pd.DeclaringType != null && pd.DeclaringType.OwnerModule != validModule)
|
if (pd.DeclaringType != null && pd.DeclaringType.Module != validModule)
|
||||||
return;
|
return;
|
||||||
propertyDefs[pd] = true;
|
propertyDefs[pd] = true;
|
||||||
add(pd.Type);
|
add(pd.Type);
|
||||||
|
@ -546,14 +546,14 @@ namespace de4dot.code.renamer.asmmodules {
|
||||||
void add(TypeDef td) {
|
void add(TypeDef td) {
|
||||||
if (td == null || typeDefs.ContainsKey(td))
|
if (td == null || typeDefs.ContainsKey(td))
|
||||||
return;
|
return;
|
||||||
if (td.OwnerModule != validModule)
|
if (td.Module != validModule)
|
||||||
return;
|
return;
|
||||||
typeDefs[td] = true;
|
typeDefs[td] = true;
|
||||||
push(td.BaseType);
|
push(td.BaseType);
|
||||||
add(td.Fields);
|
add(td.Fields);
|
||||||
add(td.Methods);
|
add(td.Methods);
|
||||||
add(td.GenericParams);
|
add(td.GenericParameters);
|
||||||
add(td.InterfaceImpls);
|
add(td.Interfaces);
|
||||||
add(td.DeclSecurities);
|
add(td.DeclSecurities);
|
||||||
add(td.DeclaringType);
|
add(td.DeclaringType);
|
||||||
add(td.Events);
|
add(td.Events);
|
||||||
|
@ -579,7 +579,7 @@ namespace de4dot.code.renamer.asmmodules {
|
||||||
void add(TypeRef tr) {
|
void add(TypeRef tr) {
|
||||||
if (tr == null || typeRefs.ContainsKey(tr))
|
if (tr == null || typeRefs.ContainsKey(tr))
|
||||||
return;
|
return;
|
||||||
if (tr.OwnerModule != validModule)
|
if (tr.Module != validModule)
|
||||||
return;
|
return;
|
||||||
typeRefs[tr] = true;
|
typeRefs[tr] = true;
|
||||||
push(tr.ResolutionScope);
|
push(tr.ResolutionScope);
|
||||||
|
@ -596,7 +596,7 @@ namespace de4dot.code.renamer.asmmodules {
|
||||||
void add(TypeSig ts) {
|
void add(TypeSig ts) {
|
||||||
if (ts == null || typeSigs.ContainsKey(ts))
|
if (ts == null || typeSigs.ContainsKey(ts))
|
||||||
return;
|
return;
|
||||||
if (ts.OwnerModule != validModule)
|
if (ts.Module != validModule)
|
||||||
return;
|
return;
|
||||||
typeSigs[ts] = true;
|
typeSigs[ts] = true;
|
||||||
|
|
||||||
|
@ -664,7 +664,7 @@ namespace de4dot.code.renamer.asmmodules {
|
||||||
void add(TypeSpec ts) {
|
void add(TypeSpec ts) {
|
||||||
if (ts == null || typeSpecs.ContainsKey(ts))
|
if (ts == null || typeSpecs.ContainsKey(ts))
|
||||||
return;
|
return;
|
||||||
if (ts.OwnerModule != validModule)
|
if (ts.Module != validModule)
|
||||||
return;
|
return;
|
||||||
typeSpecs[ts] = true;
|
typeSpecs[ts] = true;
|
||||||
add(ts.TypeSig);
|
add(ts.TypeSig);
|
||||||
|
@ -681,7 +681,7 @@ namespace de4dot.code.renamer.asmmodules {
|
||||||
void add(ExportedType et) {
|
void add(ExportedType et) {
|
||||||
if (et == null || exportedTypes.ContainsKey(et))
|
if (et == null || exportedTypes.ContainsKey(et))
|
||||||
return;
|
return;
|
||||||
if (et.OwnerModule != validModule)
|
if (et.Module != validModule)
|
||||||
return;
|
return;
|
||||||
exportedTypes[et] = true;
|
exportedTypes[et] = true;
|
||||||
add(et.CustomAttributes);
|
add(et.CustomAttributes);
|
||||||
|
|
|
@ -65,7 +65,7 @@ namespace de4dot.code.renamer.asmmodules {
|
||||||
|
|
||||||
public MMethodDef(MethodDef methodDefinition, MTypeDef owner, int index)
|
public MMethodDef(MethodDef methodDefinition, MTypeDef owner, int index)
|
||||||
: base(methodDefinition, owner, index) {
|
: base(methodDefinition, owner, index) {
|
||||||
genericParams = MGenericParamDef.createGenericParamDefList(MethodDef.GenericParams);
|
genericParams = MGenericParamDef.createGenericParamDefList(MethodDef.GenericParameters);
|
||||||
visibleBaseIndex = methodDefinition.MethodSig != null && methodDefinition.MethodSig.HasThis ? 1 : 0;
|
visibleBaseIndex = methodDefinition.MethodSig != null && methodDefinition.MethodSig.HasThis ? 1 : 0;
|
||||||
for (int i = 0; i < methodDefinition.Parameters.Count; i++) {
|
for (int i = 0; i < methodDefinition.Parameters.Count; i++) {
|
||||||
var param = methodDefinition.Parameters[i];
|
var param = methodDefinition.Parameters[i];
|
||||||
|
|
|
@ -205,7 +205,7 @@ namespace de4dot.code.renamer.asmmodules {
|
||||||
|
|
||||||
// Initialize interfaces
|
// Initialize interfaces
|
||||||
foreach (var typeDef in allTypes) {
|
foreach (var typeDef in allTypes) {
|
||||||
foreach (var iface in typeDef.TypeDef.InterfaceImpls) {
|
foreach (var iface in typeDef.TypeDef.Interfaces) {
|
||||||
var ifaceTypeDef = resolveType(iface.Interface) ?? resolveOther(iface.Interface);
|
var ifaceTypeDef = resolveType(iface.Interface) ?? resolveOther(iface.Interface);
|
||||||
if (ifaceTypeDef != null)
|
if (ifaceTypeDef != null)
|
||||||
typeDef.addInterface(ifaceTypeDef, iface.Interface);
|
typeDef.addInterface(ifaceTypeDef, iface.Interface);
|
||||||
|
@ -336,7 +336,7 @@ namespace de4dot.code.renamer.asmmodules {
|
||||||
|
|
||||||
typeDef = new MTypeDef(typeDefinition, null, 0);
|
typeDef = new MTypeDef(typeDefinition, null, 0);
|
||||||
typeDef.addMembers();
|
typeDef.addMembers();
|
||||||
foreach (var iface in typeDef.TypeDef.InterfaceImpls) {
|
foreach (var iface in typeDef.TypeDef.Interfaces) {
|
||||||
var ifaceDef = resolveOther(iface.Interface);
|
var ifaceDef = resolveOther(iface.Interface);
|
||||||
if (ifaceDef == null)
|
if (ifaceDef == null)
|
||||||
continue;
|
continue;
|
||||||
|
@ -391,15 +391,15 @@ namespace de4dot.code.renamer.asmmodules {
|
||||||
|
|
||||||
if (scopeType == ScopeType.ModuleRef) {
|
if (scopeType == ScopeType.ModuleRef) {
|
||||||
var moduleRef = (ModuleRef)scope;
|
var moduleRef = (ModuleRef)scope;
|
||||||
if (moduleRef.Name == type.OwnerModule.Name) {
|
if (moduleRef.Name == type.Module.Name) {
|
||||||
var modules = findModules(type.OwnerModule);
|
var modules = findModules(type.Module);
|
||||||
if (modules != null)
|
if (modules != null)
|
||||||
return modules;
|
return modules;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
if (scopeType == ScopeType.ModuleRef || scopeType == ScopeType.ModuleDef) {
|
if (scopeType == ScopeType.ModuleRef || scopeType == ScopeType.ModuleDef) {
|
||||||
var asm = type.OwnerModule.Assembly;
|
var asm = type.Module.Assembly;
|
||||||
if (asm == null)
|
if (asm == null)
|
||||||
return null;
|
return null;
|
||||||
var moduleHash = assemblyHash.lookup(asm.FullName);
|
var moduleHash = assemblyHash.lookup(asm.FullName);
|
||||||
|
@ -452,7 +452,7 @@ namespace de4dot.code.renamer.asmmodules {
|
||||||
Logger.e("Could not resolve TypeReference {0} ({1:X8}) (from {2} -> {3})",
|
Logger.e("Could not resolve TypeReference {0} ({1:X8}) (from {2} -> {3})",
|
||||||
Utils.removeNewlines(typeRef),
|
Utils.removeNewlines(typeRef),
|
||||||
typeRef.MDToken.ToInt32(),
|
typeRef.MDToken.ToInt32(),
|
||||||
typeRef.OwnerModule,
|
typeRef.Module,
|
||||||
typeRef.Scope);
|
typeRef.Scope);
|
||||||
return null;
|
return null;
|
||||||
}
|
}
|
||||||
|
@ -473,7 +473,7 @@ namespace de4dot.code.renamer.asmmodules {
|
||||||
Logger.e("Could not resolve MethodReference {0} ({1:X8}) (from {2} -> {3})",
|
Logger.e("Could not resolve MethodReference {0} ({1:X8}) (from {2} -> {3})",
|
||||||
Utils.removeNewlines(methodRef),
|
Utils.removeNewlines(methodRef),
|
||||||
methodRef.MDToken.ToInt32(),
|
methodRef.MDToken.ToInt32(),
|
||||||
methodRef.DeclaringType.OwnerModule,
|
methodRef.DeclaringType.Module,
|
||||||
methodRef.DeclaringType.Scope);
|
methodRef.DeclaringType.Scope);
|
||||||
return null;
|
return null;
|
||||||
}
|
}
|
||||||
|
@ -494,7 +494,7 @@ namespace de4dot.code.renamer.asmmodules {
|
||||||
Logger.e("Could not resolve FieldReference {0} ({1:X8}) (from {2} -> {3})",
|
Logger.e("Could not resolve FieldReference {0} ({1:X8}) (from {2} -> {3})",
|
||||||
Utils.removeNewlines(fieldReference),
|
Utils.removeNewlines(fieldReference),
|
||||||
fieldReference.MDToken.ToInt32(),
|
fieldReference.MDToken.ToInt32(),
|
||||||
fieldReference.DeclaringType.OwnerModule,
|
fieldReference.DeclaringType.Module,
|
||||||
fieldReference.DeclaringType.Scope);
|
fieldReference.DeclaringType.Scope);
|
||||||
return null;
|
return null;
|
||||||
}
|
}
|
||||||
|
|
|
@ -298,7 +298,7 @@ namespace de4dot.code.renamer.asmmodules {
|
||||||
public MTypeDef(TypeDef typeDefinition, Module module, int index)
|
public MTypeDef(TypeDef typeDefinition, Module module, int index)
|
||||||
: base(typeDefinition, null, index) {
|
: base(typeDefinition, null, index) {
|
||||||
this.module = module;
|
this.module = module;
|
||||||
genericParams = MGenericParamDef.createGenericParamDefList(TypeDef.GenericParams);
|
genericParams = MGenericParamDef.createGenericParamDefList(TypeDef.GenericParameters);
|
||||||
}
|
}
|
||||||
|
|
||||||
public void addInterface(MTypeDef ifaceDef, ITypeDefOrRef iface) {
|
public void addInterface(MTypeDef ifaceDef, ITypeDefOrRef iface) {
|
||||||
|
@ -663,7 +663,7 @@ namespace de4dot.code.renamer.asmmodules {
|
||||||
return resolvedAllInterfacesResult.Value;
|
return resolvedAllInterfacesResult.Value;
|
||||||
}
|
}
|
||||||
bool resolvedAllInterfacesInternal() {
|
bool resolvedAllInterfacesInternal() {
|
||||||
if (TypeDef.InterfaceImpls.Count != interfaces.Count)
|
if (TypeDef.Interfaces.Count != interfaces.Count)
|
||||||
return false;
|
return false;
|
||||||
foreach (var ifaceInfo in interfaces) {
|
foreach (var ifaceInfo in interfaces) {
|
||||||
if (!ifaceInfo.typeDef.resolvedAllInterfaces())
|
if (!ifaceInfo.typeDef.resolvedAllInterfaces())
|
||||||
|
|
2
dot10
2
dot10
|
@ -1 +1 @@
|
||||||
Subproject commit e17e420a2427869b70963756222518aa003f8aec
|
Subproject commit 4f392d624e7a9e23133801f2d18b0948e13e4411
|
Loading…
Reference in New Issue
Block a user