monocul.us/de4dot-cex
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Change getCalledMethods() return type

Browse Source
This commit is contained in:
de4dot 2012-03-17 20:36:41 +01:00
parent 0b858c47ed
commit 6f01d48593
24 changed files with 48 additions and 72 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
blocks/DotNetUtils.cs
View File

@ -689,7 +689,7 @@ namespace de4dot.blocks {
return (string)carg.Value;
}
public static IEnumerable<Tuple<TypeDefinition, MethodDefinition>> getCalledMethods(ModuleDefinition module, MethodDefinition method) {
public static IEnumerable<MethodDefinition> getCalledMethods(ModuleDefinition module, MethodDefinition method) {
if (method != null && method.HasBody) {
foreach (var call in method.Body.Instructions) {
if (call.OpCode.Code != Code.Call && call.OpCode.Code != Code.Callvirt)
@ -699,12 +699,8 @@ namespace de4dot.blocks {
continue;
var type = getType(module, methodRef.DeclaringType);
var methodDef = getMethod(type, methodRef);
if (methodDef != null) {
yield return new Tuple<TypeDefinition, MethodDefinition> {
Item1 = type,
Item2 = methodDef,
};
}
if (methodDef != null)
yield return methodDef;
}
}
}

3
de4dot.code/deobfuscators/Babel_NET/ProxyDelegateFinder.cs
View File

@ -159,8 +159,7 @@ namespace de4dot.code.deobfuscators.Babel_NET {
}
ProxyCreatorType getProxyCreatorType(MethodDefinition methodToCheck) {
foreach (var info in DotNetUtils.getCalledMethods(module, methodToCheck)) {
var calledMethod = info.Item2;
foreach (var calledMethod in DotNetUtils.getCalledMethods(module, methodToCheck)) {
if (!calledMethod.IsStatic || calledMethod.Body == null)
continue;
if (!MemberReferenceHelper.compareTypes(methodToCheck.DeclaringType, calledMethod.DeclaringType))

4
de4dot.code/deobfuscators/CodeVeil/MainType.cs
View File

@ -231,8 +231,8 @@ namespace de4dot.code.deobfuscators.CodeVeil {
}
bool callsMethod(MethodDefinition methodToCheck, MethodDefinition calledMethod) {
foreach (var info in DotNetUtils.getCalledMethods(module, methodToCheck)) {
if (info.Item2 == calledMethod)
foreach (var method in DotNetUtils.getCalledMethods(module, methodToCheck)) {
if (method == calledMethod)
return true;
}
return false;

12
de4dot.code/deobfuscators/CodeVeil/ProxyDelegateFinder.cs
View File

@ -156,16 +156,16 @@ namespace de4dot.code.deobfuscators.CodeVeil {
}
bool initProxyType(Info infoTmp, MethodDefinition method) {
foreach (var call in DotNetUtils.getCalledMethods(module, method)) {
if (!call.Item2.IsStatic)
foreach (var calledMethod in DotNetUtils.getCalledMethods(module, method)) {
if (!calledMethod.IsStatic)
continue;
if (!DotNetUtils.isMethod(call.Item2, "System.Void", "(System.Int32)"))
if (!DotNetUtils.isMethod(calledMethod, "System.Void", "(System.Int32)"))
continue;
if (!checkProxyType(infoTmp, call.Item1))
if (!checkProxyType(infoTmp, calledMethod.DeclaringType))
continue;
infoTmp.proxyType = call.Item1;
infoTmp.initMethod = call.Item2;
infoTmp.proxyType = calledMethod.DeclaringType;
infoTmp.initMethod = calledMethod;
return true;
}
return false;

4
de4dot.code/deobfuscators/CodeVeil/StringDecrypter.cs
View File

@ -108,8 +108,8 @@ namespace de4dot.code.deobfuscators.CodeVeil {
void findV5(MethodDefinition method) {
if (!mainType.Detected)
return;
foreach (var info in DotNetUtils.getCalledMethods(module, mainType.InitMethod)) {
if (find(info.Item2))
foreach (var calledMethod in DotNetUtils.getCalledMethods(module, mainType.InitMethod)) {
if (find(calledMethod))
return;
}
}

4
de4dot.code/deobfuscators/CodeVeil/TamperDetection.cs
View File

@ -117,8 +117,8 @@ namespace de4dot.code.deobfuscators.CodeVeil {
}
bool callsMainTypeTamperCheckMethod(MethodDefinition method) {
foreach (var info in DotNetUtils.getCalledMethods(module, method)) {
if (info.Item2 == mainType.TamperCheckMethod)
foreach (var calledMethod in DotNetUtils.getCalledMethods(module, method)) {
if (calledMethod == mainType.TamperCheckMethod)
return true;
}

5
de4dot.code/deobfuscators/CryptoObfuscator/AntiDebugger.cs
View File

@ -52,9 +52,8 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
bool find(MethodDefinition methodToCheck) {
if (methodToCheck == null)
return false;
foreach (var info in DotNetUtils.getCalledMethods(module, methodToCheck)) {
var type = info.Item1;
var method = info.Item2;
foreach (var method in DotNetUtils.getCalledMethods(module, methodToCheck)) {
var type = method.DeclaringType;
if (!method.IsStatic || !DotNetUtils.isMethod(method, "System.Void", "()"))
continue;

5
de4dot.code/deobfuscators/CryptoObfuscator/AssemblyResolver.cs
View File

@ -67,13 +67,12 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
if (cctor == null)
return;
foreach (var tuple in DotNetUtils.getCalledMethods(module, cctor)) {
var method = tuple.Item2;
foreach (var method in DotNetUtils.getCalledMethods(module, cctor)) {
if (method.Name == ".cctor" || method.Name == ".ctor")
continue;
if (!method.IsStatic || !DotNetUtils.isMethod(method, "System.Void", "()"))
continue;
if (checkType(tuple.Item1, method))
if (checkType(method.DeclaringType, method))
break;
}
}

3
de4dot.code/deobfuscators/CryptoObfuscator/ResourceResolver.cs
View File

@ -55,8 +55,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
if (cctor == null)
return;
foreach (var tuple in DotNetUtils.getCalledMethods(module, cctor)) {
var method = tuple.Item2;
foreach (var method in DotNetUtils.getCalledMethods(module, cctor)) {
if (method.Name == ".cctor" || method.Name == ".ctor")
continue;
if (!method.IsStatic || !DotNetUtils.isMethod(method, "System.Void", "()"))

4
de4dot.code/deobfuscators/CryptoObfuscator/TamperDetection.cs
View File

@ -55,9 +55,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
if (methodToCheck == null)
return false;
foreach (var info in DotNetUtils.getCalledMethods(module, methodToCheck)) {
var method = info.Item2;
foreach (var method in DotNetUtils.getCalledMethods(module, methodToCheck)) {
bool result = false;
switch (frameworkType) {
case FrameworkType.Desktop:

3
de4dot.code/deobfuscators/DeepSea/AssemblyResolver.cs
View File

@ -82,8 +82,7 @@ namespace de4dot.code.deobfuscators.DeepSea {
if (resolverInitMethod.Body.ExceptionHandlers.Count != 1)
return false;
foreach (var info in DotNetUtils.getCalledMethods(module, resolverInitMethod)) {
var method = info.Item2;
foreach (var method in DotNetUtils.getCalledMethods(module, resolverInitMethod)) {
if (!method.IsStatic || method.Body == null)
continue;
if (!method.IsPublic || method.HasGenericParameters)

3
de4dot.code/deobfuscators/DeepSea/ResolverBase.cs
View File

@ -62,8 +62,7 @@ namespace de4dot.code.deobfuscators.DeepSea {
if (checkMethod == null || checkMethod.Body == null)
return false;
foreach (var tuple in DotNetUtils.getCalledMethods(module, checkMethod)) {
var method = tuple.Item2;
foreach (var method in DotNetUtils.getCalledMethods(module, checkMethod)) {
if (method.Name == ".cctor" || method.Name == ".ctor")
continue;
if (!method.IsStatic || !DotNetUtils.isMethod(method, "System.Void", "()"))

3
de4dot.code/deobfuscators/Goliath_NET/DecrypterBase.cs
View File

@ -210,8 +210,7 @@ namespace de4dot.code.deobfuscators.Goliath_NET {
return false;
MethodDefinition initMethod = null;
foreach (var info in DotNetUtils.getCalledMethods(module, cctor)) {
var method = info.Item2;
foreach (var method in DotNetUtils.getCalledMethods(module, cctor)) {
if (DotNetUtils.isMethod(method, "System.Void", "(System.Type)")) {
initMethod = method;
break;

3
de4dot.code/deobfuscators/MaxtoCode/MainType.cs
View File

@ -85,8 +85,7 @@ namespace de4dot.code.deobfuscators.MaxtoCode {
if (cctor == null)
return;
foreach (var info in DotNetUtils.getCalledMethods(module, cctor)) {
var method = info.Item2;
foreach (var method in DotNetUtils.getCalledMethods(module, cctor)) {
if (method.Name != "Startup")
continue;
if (!DotNetUtils.isMethod(method, "System.Void", "()"))

7
de4dot.code/deobfuscators/Skater_NET/StringDecrypter.cs
View File

@ -164,8 +164,7 @@ namespace de4dot.code.deobfuscators.Skater_NET {
}
string getPassword(MethodDefinition decryptMethod) {
foreach (var info in DotNetUtils.getCalledMethods(module, decryptMethod)) {
var method = info.Item2;
foreach (var method in DotNetUtils.getCalledMethods(module, decryptMethod)) {
if (!method.IsStatic || method.Body == null)
continue;
if (!MemberReferenceHelper.compareTypes(method.DeclaringType, decryptMethod.DeclaringType))
@ -200,8 +199,8 @@ namespace de4dot.code.deobfuscators.Skater_NET {
string getPassword2(MethodDefinition method) {
string password = "";
foreach (var info in DotNetUtils.getCalledMethods(module, method)) {
var s = getPassword3(info.Item2);
foreach (var calledMethod in DotNetUtils.getCalledMethods(module, method)) {
var s = getPassword3(calledMethod);
if (string.IsNullOrEmpty(s))
return null;

7
de4dot.code/deobfuscators/SmartAssembly/MemoryManagerInfo.cs
View File

@ -53,14 +53,13 @@ namespace de4dot.code.deobfuscators.SmartAssembly {
bool checkCalledMethods(MethodDefinition checkMethod) {
if (checkMethod == null)
return false;
foreach (var tuple in DotNetUtils.getCalledMethods(module, checkMethod)) {
var method = tuple.Item2;
foreach (var method in DotNetUtils.getCalledMethods(module, checkMethod)) {
if (method.Name == ".cctor" || method.Name == ".ctor")
continue;
if (!method.IsStatic || !DotNetUtils.isMethod(method, "System.Void", "()"))
continue;
if (checkMemoryManagerType(tuple.Item1, method)) {
memoryManagerType = tuple.Item1;
if (checkMemoryManagerType(method.DeclaringType, method)) {
memoryManagerType = method.DeclaringType;
attachAppMethod = method;
return true;
}

6
de4dot.code/deobfuscators/SmartAssembly/ResolverInfoBase.cs
View File

@ -69,8 +69,7 @@ namespace de4dot.code.deobfuscators.SmartAssembly {
bool findTypes(MethodDefinition initMethod) {
if (initMethod == null)
return false;
foreach (var tuple in DotNetUtils.getCalledMethods(module, initMethod)) {
var method = tuple.Item2;
foreach (var method in DotNetUtils.getCalledMethods(module, initMethod)) {
if (method.Name == ".cctor" || method.Name == ".ctor")
continue;
if (!method.IsStatic || !DotNetUtils.isMethod(method, "System.Void", "()"))
@ -87,8 +86,7 @@ namespace de4dot.code.deobfuscators.SmartAssembly {
if (!attachAppMethod.HasBody)
return false;
foreach (var tuple in DotNetUtils.getCalledMethods(module, attachAppMethod)) {
var method = tuple.Item2;
foreach (var method in DotNetUtils.getCalledMethods(module, attachAppMethod)) {
if (method.Name == ".cctor" || method.Name == ".ctor")
continue;
if (!method.IsStatic || !DotNetUtils.isMethod(method, "System.Void", "()"))

4
de4dot.code/deobfuscators/dotNET_Reactor/v3/LibAssemblyResolver.cs
View File

@ -58,9 +58,7 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v3 {
"System.Boolean",
};
foreach (var tuple in DotNetUtils.getCalledMethods(module, checkMethod)) {
var method = tuple.Item2;
foreach (var method in DotNetUtils.getCalledMethods(module, checkMethod)) {
if (method.Body == null)
continue;
if (!method.IsStatic)

10
de4dot.code/deobfuscators/dotNET_Reactor/v3/NativeLibSaver.cs
View File

@ -65,14 +65,14 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v3 {
}
public void find() {
foreach (var info in DotNetUtils.getCalledMethods(module, DotNetUtils.getModuleTypeCctor(module))) {
if (!DotNetUtils.isMethod(info.Item2, "System.Void", "()"))
foreach (var calledMethod in DotNetUtils.getCalledMethods(module, DotNetUtils.getModuleTypeCctor(module))) {
if (!DotNetUtils.isMethod(calledMethod, "System.Void", "()"))
continue;
if (info.Item1.FullName != "<PrivateImplementationDetails>{F1C5056B-0AFC-4423-9B83-D13A26B48869}")
if (calledMethod.DeclaringType.FullName != "<PrivateImplementationDetails>{F1C5056B-0AFC-4423-9B83-D13A26B48869}")
continue;
nativeLibCallerType = info.Item1;
initMethod = info.Item2;
nativeLibCallerType = calledMethod.DeclaringType;
initMethod = calledMethod;
foreach (var s in DotNetUtils.getCodeStrings(initMethod)) {
nativeFileResource = DotNetUtils.getResource(module, s);
if (nativeFileResource != null)

5
de4dot.code/deobfuscators/dotNET_Reactor/v4/AssemblyResolver.cs
View File

@ -94,9 +94,8 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 {
};
simpleDeobfuscator.deobfuscate(methodToCheck);
foreach (var tuple in DotNetUtils.getCalledMethods(module, methodToCheck)) {
var type = tuple.Item1;
var method = tuple.Item2;
foreach (var method in DotNetUtils.getCalledMethods(module, methodToCheck)) {
var type = method.DeclaringType;
if (!DotNetUtils.isMethod(method, "System.Void", "()"))
continue;
if (!method.IsStatic)

4
de4dot.code/deobfuscators/dotNET_Reactor/v4/Deobfuscator.cs
View File

@ -496,8 +496,8 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 {
void addEntryPointCallToBeRemoved(MethodDefinition methodToBeRemoved) {
var entryPoint = module.EntryPoint;
addCallToBeRemoved(entryPoint, methodToBeRemoved);
foreach (var info in DotNetUtils.getCalledMethods(module, entryPoint))
addCallToBeRemoved(info.Item2, methodToBeRemoved);
foreach (var calledMethod in DotNetUtils.getCalledMethods(module, entryPoint))
addCallToBeRemoved(calledMethod, methodToBeRemoved);
}
void decryptResources() {

3
de4dot.code/deobfuscators/dotNET_Reactor/v4/EmptyClass.cs
View File

@ -48,8 +48,7 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 {
foreach (var method in type.Methods) {
if (method.Name != ".ctor" && method.Name != ".cctor" && module.EntryPoint != method)
continue;
foreach (var tuple in DotNetUtils.getCalledMethods(module, method)) {
var calledMethod = tuple.Item2;
foreach (var calledMethod in DotNetUtils.getCalledMethods(module, method)) {
if (!calledMethod.IsStatic || calledMethod.Body == null)
continue;
if (!DotNetUtils.isMethod(calledMethod, "System.Void", "()"))

5
de4dot.code/deobfuscators/dotNET_Reactor/v4/MethodsDecrypter.cs
View File

@ -83,12 +83,11 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 {
if (typesLeft-- <= 0)
break;
foreach (var info in DotNetUtils.getCalledMethods(module, cctor)) {
var method = info.Item2;
foreach (var method in DotNetUtils.getCalledMethods(module, cctor)) {
var key = new MethodReferenceAndDeclaringTypeKey(method);
if (!checkedMethods.ContainsKey(key)) {
checkedMethods[key] = false;
if (info.Item1.BaseType == null || info.Item1.BaseType.FullName != "System.Object")
if (method.DeclaringType.BaseType == null || method.DeclaringType.BaseType.FullName != "System.Object")
continue;
if (!DotNetUtils.isMethod(method, "System.Void", "()"))
continue;

3
de4dot.code/deobfuscators/dotNET_Reactor/v4/StringDecrypter.cs
View File

@ -173,8 +173,7 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 {
"System.Security.Cryptography.CryptoStream",
"System.Security.Cryptography.Rijndael",
};
foreach (var info in DotNetUtils.getCalledMethods(module, method)) {
var calledMethod = info.Item2;
foreach (var calledMethod in DotNetUtils.getCalledMethods(module, method)) {
if (calledMethod.DeclaringType != method.DeclaringType)
continue;
if (calledMethod.MethodReturnType.ReturnType.FullName != "System.Byte[]")