From 6b18d70e7710c41620a60b48f847cd86174831c4 Mon Sep 17 00:00:00 2001 From: de4dot Date: Mon, 30 Apr 2012 01:26:10 +0200 Subject: [PATCH] Move common code to another class --- de4dot.code/de4dot.code.csproj | 3 +- .../{Eazfuscator_NET => }/ConstantsReader.cs | 70 ++++++++++++------- .../Eazfuscator_NET/DecrypterType.cs | 2 +- .../Eazfuscator_NET/EfConstantsReader.cs | 54 ++++++++++++++ .../Eazfuscator_NET/StringDecrypter.cs | 8 +-- 5 files changed, 105 insertions(+), 32 deletions(-) rename de4dot.code/deobfuscators/{Eazfuscator_NET => }/ConstantsReader.cs (78%) create mode 100644 de4dot.code/deobfuscators/Eazfuscator_NET/EfConstantsReader.cs diff --git a/de4dot.code/de4dot.code.csproj b/de4dot.code/de4dot.code.csproj index 301df29c..68fe955d 100644 --- a/de4dot.code/de4dot.code.csproj +++ b/de4dot.code/de4dot.code.csproj @@ -107,6 +107,7 @@ + @@ -152,7 +153,7 @@ - + diff --git a/de4dot.code/deobfuscators/Eazfuscator_NET/ConstantsReader.cs b/de4dot.code/deobfuscators/ConstantsReader.cs similarity index 78% rename from de4dot.code/deobfuscators/Eazfuscator_NET/ConstantsReader.cs rename to de4dot.code/deobfuscators/ConstantsReader.cs index 7bffdad8..a3b3d1e7 100644 --- a/de4dot.code/deobfuscators/Eazfuscator_NET/ConstantsReader.cs +++ b/de4dot.code/deobfuscators/ConstantsReader.cs @@ -23,39 +23,57 @@ using Mono.Cecil.Cil; using Mono.Cecil.Metadata; using de4dot.blocks; -namespace de4dot.code.deobfuscators.Eazfuscator_NET { +namespace de4dot.code.deobfuscators { class ConstantsReader { - IList instructions; - IList locals; - Dictionary localsValues = new Dictionary(); + protected IInstructions instructions; + protected IList locals; + protected Dictionary localsValues = new Dictionary(); - public ConstantsReader(MethodDefinition method) { - instructions = method.Body.Instructions; - locals = method.Body.Variables; - initialize(); + public interface IInstructions { + int Count { get; } + Instruction this[int index] { get; } } - void initialize() { - findConstants(); - } + class ListInstructions : IInstructions { + IList instrs; - void findConstants() { - for (int index = 0; index < instructions.Count; ) { - int value; - if (!getInt32(ref index, out value)) - break; - var stloc = instructions[index]; - if (!DotNetUtils.isStloc(stloc)) - break; - var local = DotNetUtils.getLocalVar(locals, stloc); - if (local == null || local.VariableType.EType != ElementType.I4) - break; - localsValues[local] = value; - index++; + public int Count { + get { return instrs.Count; } } - if (localsValues.Count != 2) - localsValues.Clear(); + public Instruction this[int index] { + get { return instrs[index]; } + } + + public ListInstructions(IList instrs) { + this.instrs = instrs; + } + } + + class ListInstrs : IInstructions { + IList instrs; + + public int Count { + get { return instrs.Count; } + } + + public Instruction this[int index] { + get { return instrs[index].Instruction; } + } + + public ListInstrs(IList instrs) { + this.instrs = instrs; + } + } + + public ConstantsReader(MethodDefinition method) { + this.locals = method.Body.Variables; + this.instructions = new ListInstructions(method.Body.Instructions); + } + + public ConstantsReader(IList locals, IList instrs) { + this.locals = locals; + this.instructions = new ListInstrs(instrs); } public bool getNextInt32(ref int index, out int val) { diff --git a/de4dot.code/deobfuscators/Eazfuscator_NET/DecrypterType.cs b/de4dot.code/deobfuscators/Eazfuscator_NET/DecrypterType.cs index 88f27868..f113dfa0 100644 --- a/de4dot.code/deobfuscators/Eazfuscator_NET/DecrypterType.cs +++ b/de4dot.code/deobfuscators/Eazfuscator_NET/DecrypterType.cs @@ -283,7 +283,7 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET { int index = 0; var instrs = method.Body.Instructions; - var constantsReader = new ConstantsReader(method); + var constantsReader = new EfConstantsReader(method); while (true) { int val; if (!constantsReader.getNextInt32(ref index, out val)) diff --git a/de4dot.code/deobfuscators/Eazfuscator_NET/EfConstantsReader.cs b/de4dot.code/deobfuscators/Eazfuscator_NET/EfConstantsReader.cs new file mode 100644 index 00000000..fc2b7702 --- /dev/null +++ b/de4dot.code/deobfuscators/Eazfuscator_NET/EfConstantsReader.cs @@ -0,0 +1,54 @@ +/* + Copyright (C) 2011-2012 de4dot@gmail.com + + This file is part of de4dot. + + de4dot is free software: you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation, either version 3 of the License, or + (at your option) any later version. + + de4dot is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with de4dot. If not, see . +*/ + +using Mono.Cecil; +using Mono.Cecil.Metadata; +using de4dot.blocks; + +namespace de4dot.code.deobfuscators.Eazfuscator_NET { + class EfConstantsReader : ConstantsReader { + public EfConstantsReader(MethodDefinition method) + : base(method) { + initialize(); + } + + void initialize() { + findConstants(); + } + + void findConstants() { + for (int index = 0; index < instructions.Count; ) { + int value; + if (!getInt32(ref index, out value)) + break; + var stloc = instructions[index]; + if (!DotNetUtils.isStloc(stloc)) + break; + var local = DotNetUtils.getLocalVar(locals, stloc); + if (local == null || local.VariableType.EType != ElementType.I4) + break; + localsValues[local] = value; + index++; + } + + if (localsValues.Count != 2) + localsValues.Clear(); + } + } +} diff --git a/de4dot.code/deobfuscators/Eazfuscator_NET/StringDecrypter.cs b/de4dot.code/deobfuscators/Eazfuscator_NET/StringDecrypter.cs index 3205592f..98dcfc4b 100644 --- a/de4dot.code/deobfuscators/Eazfuscator_NET/StringDecrypter.cs +++ b/de4dot.code/deobfuscators/Eazfuscator_NET/StringDecrypter.cs @@ -44,7 +44,7 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET { BinaryReader reader; DecrypterType decrypterType; StreamHelperType streamHelperType; - ConstantsReader stringMethodConsts; + EfConstantsReader stringMethodConsts; bool isV32OrLater; class StreamHelperType { @@ -219,7 +219,7 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET { bool findConstants(ISimpleDeobfuscator simpleDeobfuscator) { simpleDeobfuscator.deobfuscate(stringMethod); - stringMethodConsts = new ConstantsReader(stringMethod); + stringMethodConsts = new EfConstantsReader(stringMethod); if (!findResource(stringMethod)) return false; @@ -658,7 +658,7 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET { return findIntsCctor2(cctor); int tmp1, tmp2, tmp3 = 0; - var constantsReader = new ConstantsReader(cctor); + var constantsReader = new EfConstantsReader(cctor); if (!constantsReader.getNextInt32(ref index, out tmp1)) return false; if (tmp1 == 0 && !constantsReader.getNextInt32(ref index, out tmp1)) @@ -684,7 +684,7 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET { bool findIntsCctor2(MethodDefinition cctor) { int index = 0; var instrs = cctor.Body.Instructions; - var constantsReader = new ConstantsReader(cctor); + var constantsReader = new EfConstantsReader(cctor); while (index >= 0) { int val; if (!constantsReader.getNextInt32(ref index, out val))