diff --git a/de4dot.code/deobfuscators/MaxtoCode/Deobfuscator.cs b/de4dot.code/deobfuscators/MaxtoCode/Deobfuscator.cs index 898ddc38..630259af 100644 --- a/de4dot.code/deobfuscators/MaxtoCode/Deobfuscator.cs +++ b/de4dot.code/deobfuscators/MaxtoCode/Deobfuscator.cs @@ -138,6 +138,7 @@ namespace de4dot.code.deobfuscators.MaxtoCode { addCctorInitCallToBeRemoved(method); addTypeToBeRemoved(mainType.Type, "Obfuscator type"); addModuleReferencesToBeRemoved(mainType.ModuleReferences, "MC runtime module reference"); + removeDuplicateEmbeddedResources(); } static Encoding getEncoding(int cp) { @@ -149,6 +150,43 @@ namespace de4dot.code.deobfuscators.MaxtoCode { } } + void removeDuplicateEmbeddedResources() { + var resources = new Dictionary>(); + foreach (var tmp in module.Resources) { + var rsrc = tmp as EmbeddedResource; + if (rsrc == null) + continue; + if (rsrc.Offset == null) + continue; + List list; + if (!resources.TryGetValue(rsrc.Offset.Value, out list)) + resources[rsrc.Offset.Value] = list = new List(); + list.Add(rsrc); + } + + foreach (var list in resources.Values) { + if (list.Count <= 1) + continue; + + EmbeddedResource resourceToKeep = null; + foreach (var rsrc in list) { + if (string.IsNullOrEmpty(rsrc.Name)) + continue; + + resourceToKeep = rsrc; + break; + } + if (resourceToKeep == null) + continue; + + foreach (var rsrc in list) { + if (rsrc == resourceToKeep) + continue; + addResourceToBeRemoved(rsrc, string.Format("Duplicate of resource {0}", Utils.toCsharpString(resourceToKeep.Name))); + } + } + } + public override IEnumerable getStringDecrypterMethods() { var list = new List(); if (stringDecrypter != null && stringDecrypter.Detected)