diff --git a/blocks/DotNetUtils.cs b/blocks/DotNetUtils.cs index b8efc36f..9fa0f462 100644 --- a/blocks/DotNetUtils.cs +++ b/blocks/DotNetUtils.cs @@ -689,7 +689,7 @@ namespace de4dot.blocks { return (string)carg.Value; } - public static IEnumerable> getCalledMethods(ModuleDefinition module, MethodDefinition method) { + public static IEnumerable getCalledMethods(ModuleDefinition module, MethodDefinition method) { if (method != null && method.HasBody) { foreach (var call in method.Body.Instructions) { if (call.OpCode.Code != Code.Call && call.OpCode.Code != Code.Callvirt) @@ -699,12 +699,8 @@ namespace de4dot.blocks { continue; var type = getType(module, methodRef.DeclaringType); var methodDef = getMethod(type, methodRef); - if (methodDef != null) { - yield return new Tuple { - Item1 = type, - Item2 = methodDef, - }; - } + if (methodDef != null) + yield return methodDef; } } } diff --git a/de4dot.code/deobfuscators/Babel_NET/ProxyDelegateFinder.cs b/de4dot.code/deobfuscators/Babel_NET/ProxyDelegateFinder.cs index d33afe34..4257cf02 100644 --- a/de4dot.code/deobfuscators/Babel_NET/ProxyDelegateFinder.cs +++ b/de4dot.code/deobfuscators/Babel_NET/ProxyDelegateFinder.cs @@ -159,8 +159,7 @@ namespace de4dot.code.deobfuscators.Babel_NET { } ProxyCreatorType getProxyCreatorType(MethodDefinition methodToCheck) { - foreach (var info in DotNetUtils.getCalledMethods(module, methodToCheck)) { - var calledMethod = info.Item2; + foreach (var calledMethod in DotNetUtils.getCalledMethods(module, methodToCheck)) { if (!calledMethod.IsStatic || calledMethod.Body == null) continue; if (!MemberReferenceHelper.compareTypes(methodToCheck.DeclaringType, calledMethod.DeclaringType)) diff --git a/de4dot.code/deobfuscators/CodeVeil/MainType.cs b/de4dot.code/deobfuscators/CodeVeil/MainType.cs index 8c311cdf..d5f3e32a 100644 --- a/de4dot.code/deobfuscators/CodeVeil/MainType.cs +++ b/de4dot.code/deobfuscators/CodeVeil/MainType.cs @@ -231,8 +231,8 @@ namespace de4dot.code.deobfuscators.CodeVeil { } bool callsMethod(MethodDefinition methodToCheck, MethodDefinition calledMethod) { - foreach (var info in DotNetUtils.getCalledMethods(module, methodToCheck)) { - if (info.Item2 == calledMethod) + foreach (var method in DotNetUtils.getCalledMethods(module, methodToCheck)) { + if (method == calledMethod) return true; } return false; diff --git a/de4dot.code/deobfuscators/CodeVeil/ProxyDelegateFinder.cs b/de4dot.code/deobfuscators/CodeVeil/ProxyDelegateFinder.cs index d61e5a72..2768b42d 100644 --- a/de4dot.code/deobfuscators/CodeVeil/ProxyDelegateFinder.cs +++ b/de4dot.code/deobfuscators/CodeVeil/ProxyDelegateFinder.cs @@ -156,16 +156,16 @@ namespace de4dot.code.deobfuscators.CodeVeil { } bool initProxyType(Info infoTmp, MethodDefinition method) { - foreach (var call in DotNetUtils.getCalledMethods(module, method)) { - if (!call.Item2.IsStatic) + foreach (var calledMethod in DotNetUtils.getCalledMethods(module, method)) { + if (!calledMethod.IsStatic) continue; - if (!DotNetUtils.isMethod(call.Item2, "System.Void", "(System.Int32)")) + if (!DotNetUtils.isMethod(calledMethod, "System.Void", "(System.Int32)")) continue; - if (!checkProxyType(infoTmp, call.Item1)) + if (!checkProxyType(infoTmp, calledMethod.DeclaringType)) continue; - infoTmp.proxyType = call.Item1; - infoTmp.initMethod = call.Item2; + infoTmp.proxyType = calledMethod.DeclaringType; + infoTmp.initMethod = calledMethod; return true; } return false; diff --git a/de4dot.code/deobfuscators/CodeVeil/StringDecrypter.cs b/de4dot.code/deobfuscators/CodeVeil/StringDecrypter.cs index 203d1062..c959bce4 100644 --- a/de4dot.code/deobfuscators/CodeVeil/StringDecrypter.cs +++ b/de4dot.code/deobfuscators/CodeVeil/StringDecrypter.cs @@ -108,8 +108,8 @@ namespace de4dot.code.deobfuscators.CodeVeil { void findV5(MethodDefinition method) { if (!mainType.Detected) return; - foreach (var info in DotNetUtils.getCalledMethods(module, mainType.InitMethod)) { - if (find(info.Item2)) + foreach (var calledMethod in DotNetUtils.getCalledMethods(module, mainType.InitMethod)) { + if (find(calledMethod)) return; } } diff --git a/de4dot.code/deobfuscators/CodeVeil/TamperDetection.cs b/de4dot.code/deobfuscators/CodeVeil/TamperDetection.cs index b9d8abfd..b55245c9 100644 --- a/de4dot.code/deobfuscators/CodeVeil/TamperDetection.cs +++ b/de4dot.code/deobfuscators/CodeVeil/TamperDetection.cs @@ -117,8 +117,8 @@ namespace de4dot.code.deobfuscators.CodeVeil { } bool callsMainTypeTamperCheckMethod(MethodDefinition method) { - foreach (var info in DotNetUtils.getCalledMethods(module, method)) { - if (info.Item2 == mainType.TamperCheckMethod) + foreach (var calledMethod in DotNetUtils.getCalledMethods(module, method)) { + if (calledMethod == mainType.TamperCheckMethod) return true; } diff --git a/de4dot.code/deobfuscators/CryptoObfuscator/AntiDebugger.cs b/de4dot.code/deobfuscators/CryptoObfuscator/AntiDebugger.cs index 91cb694a..c3f77c34 100644 --- a/de4dot.code/deobfuscators/CryptoObfuscator/AntiDebugger.cs +++ b/de4dot.code/deobfuscators/CryptoObfuscator/AntiDebugger.cs @@ -52,9 +52,8 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator { bool find(MethodDefinition methodToCheck) { if (methodToCheck == null) return false; - foreach (var info in DotNetUtils.getCalledMethods(module, methodToCheck)) { - var type = info.Item1; - var method = info.Item2; + foreach (var method in DotNetUtils.getCalledMethods(module, methodToCheck)) { + var type = method.DeclaringType; if (!method.IsStatic || !DotNetUtils.isMethod(method, "System.Void", "()")) continue; diff --git a/de4dot.code/deobfuscators/CryptoObfuscator/AssemblyResolver.cs b/de4dot.code/deobfuscators/CryptoObfuscator/AssemblyResolver.cs index 032a4512..1cad1e19 100644 --- a/de4dot.code/deobfuscators/CryptoObfuscator/AssemblyResolver.cs +++ b/de4dot.code/deobfuscators/CryptoObfuscator/AssemblyResolver.cs @@ -67,13 +67,12 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator { if (cctor == null) return; - foreach (var tuple in DotNetUtils.getCalledMethods(module, cctor)) { - var method = tuple.Item2; + foreach (var method in DotNetUtils.getCalledMethods(module, cctor)) { if (method.Name == ".cctor" || method.Name == ".ctor") continue; if (!method.IsStatic || !DotNetUtils.isMethod(method, "System.Void", "()")) continue; - if (checkType(tuple.Item1, method)) + if (checkType(method.DeclaringType, method)) break; } } diff --git a/de4dot.code/deobfuscators/CryptoObfuscator/ResourceResolver.cs b/de4dot.code/deobfuscators/CryptoObfuscator/ResourceResolver.cs index c2fdbe92..da6bd034 100644 --- a/de4dot.code/deobfuscators/CryptoObfuscator/ResourceResolver.cs +++ b/de4dot.code/deobfuscators/CryptoObfuscator/ResourceResolver.cs @@ -55,8 +55,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator { if (cctor == null) return; - foreach (var tuple in DotNetUtils.getCalledMethods(module, cctor)) { - var method = tuple.Item2; + foreach (var method in DotNetUtils.getCalledMethods(module, cctor)) { if (method.Name == ".cctor" || method.Name == ".ctor") continue; if (!method.IsStatic || !DotNetUtils.isMethod(method, "System.Void", "()")) diff --git a/de4dot.code/deobfuscators/CryptoObfuscator/TamperDetection.cs b/de4dot.code/deobfuscators/CryptoObfuscator/TamperDetection.cs index 8fa351ad..b9cfa651 100644 --- a/de4dot.code/deobfuscators/CryptoObfuscator/TamperDetection.cs +++ b/de4dot.code/deobfuscators/CryptoObfuscator/TamperDetection.cs @@ -55,9 +55,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator { if (methodToCheck == null) return false; - foreach (var info in DotNetUtils.getCalledMethods(module, methodToCheck)) { - var method = info.Item2; - + foreach (var method in DotNetUtils.getCalledMethods(module, methodToCheck)) { bool result = false; switch (frameworkType) { case FrameworkType.Desktop: diff --git a/de4dot.code/deobfuscators/DeepSea/AssemblyResolver.cs b/de4dot.code/deobfuscators/DeepSea/AssemblyResolver.cs index 49085928..595f3f2b 100644 --- a/de4dot.code/deobfuscators/DeepSea/AssemblyResolver.cs +++ b/de4dot.code/deobfuscators/DeepSea/AssemblyResolver.cs @@ -82,8 +82,7 @@ namespace de4dot.code.deobfuscators.DeepSea { if (resolverInitMethod.Body.ExceptionHandlers.Count != 1) return false; - foreach (var info in DotNetUtils.getCalledMethods(module, resolverInitMethod)) { - var method = info.Item2; + foreach (var method in DotNetUtils.getCalledMethods(module, resolverInitMethod)) { if (!method.IsStatic || method.Body == null) continue; if (!method.IsPublic || method.HasGenericParameters) diff --git a/de4dot.code/deobfuscators/DeepSea/ResolverBase.cs b/de4dot.code/deobfuscators/DeepSea/ResolverBase.cs index aeb82c10..fec1020b 100644 --- a/de4dot.code/deobfuscators/DeepSea/ResolverBase.cs +++ b/de4dot.code/deobfuscators/DeepSea/ResolverBase.cs @@ -62,8 +62,7 @@ namespace de4dot.code.deobfuscators.DeepSea { if (checkMethod == null || checkMethod.Body == null) return false; - foreach (var tuple in DotNetUtils.getCalledMethods(module, checkMethod)) { - var method = tuple.Item2; + foreach (var method in DotNetUtils.getCalledMethods(module, checkMethod)) { if (method.Name == ".cctor" || method.Name == ".ctor") continue; if (!method.IsStatic || !DotNetUtils.isMethod(method, "System.Void", "()")) diff --git a/de4dot.code/deobfuscators/Goliath_NET/DecrypterBase.cs b/de4dot.code/deobfuscators/Goliath_NET/DecrypterBase.cs index 501fe62f..3a917bec 100644 --- a/de4dot.code/deobfuscators/Goliath_NET/DecrypterBase.cs +++ b/de4dot.code/deobfuscators/Goliath_NET/DecrypterBase.cs @@ -210,8 +210,7 @@ namespace de4dot.code.deobfuscators.Goliath_NET { return false; MethodDefinition initMethod = null; - foreach (var info in DotNetUtils.getCalledMethods(module, cctor)) { - var method = info.Item2; + foreach (var method in DotNetUtils.getCalledMethods(module, cctor)) { if (DotNetUtils.isMethod(method, "System.Void", "(System.Type)")) { initMethod = method; break; diff --git a/de4dot.code/deobfuscators/MaxtoCode/MainType.cs b/de4dot.code/deobfuscators/MaxtoCode/MainType.cs index 37184301..b0ba1e89 100644 --- a/de4dot.code/deobfuscators/MaxtoCode/MainType.cs +++ b/de4dot.code/deobfuscators/MaxtoCode/MainType.cs @@ -85,8 +85,7 @@ namespace de4dot.code.deobfuscators.MaxtoCode { if (cctor == null) return; - foreach (var info in DotNetUtils.getCalledMethods(module, cctor)) { - var method = info.Item2; + foreach (var method in DotNetUtils.getCalledMethods(module, cctor)) { if (method.Name != "Startup") continue; if (!DotNetUtils.isMethod(method, "System.Void", "()")) diff --git a/de4dot.code/deobfuscators/Skater_NET/StringDecrypter.cs b/de4dot.code/deobfuscators/Skater_NET/StringDecrypter.cs index 059be928..85e2a5c6 100644 --- a/de4dot.code/deobfuscators/Skater_NET/StringDecrypter.cs +++ b/de4dot.code/deobfuscators/Skater_NET/StringDecrypter.cs @@ -164,8 +164,7 @@ namespace de4dot.code.deobfuscators.Skater_NET { } string getPassword(MethodDefinition decryptMethod) { - foreach (var info in DotNetUtils.getCalledMethods(module, decryptMethod)) { - var method = info.Item2; + foreach (var method in DotNetUtils.getCalledMethods(module, decryptMethod)) { if (!method.IsStatic || method.Body == null) continue; if (!MemberReferenceHelper.compareTypes(method.DeclaringType, decryptMethod.DeclaringType)) @@ -200,8 +199,8 @@ namespace de4dot.code.deobfuscators.Skater_NET { string getPassword2(MethodDefinition method) { string password = ""; - foreach (var info in DotNetUtils.getCalledMethods(module, method)) { - var s = getPassword3(info.Item2); + foreach (var calledMethod in DotNetUtils.getCalledMethods(module, method)) { + var s = getPassword3(calledMethod); if (string.IsNullOrEmpty(s)) return null; diff --git a/de4dot.code/deobfuscators/SmartAssembly/MemoryManagerInfo.cs b/de4dot.code/deobfuscators/SmartAssembly/MemoryManagerInfo.cs index 6b292ea9..b6844134 100644 --- a/de4dot.code/deobfuscators/SmartAssembly/MemoryManagerInfo.cs +++ b/de4dot.code/deobfuscators/SmartAssembly/MemoryManagerInfo.cs @@ -53,14 +53,13 @@ namespace de4dot.code.deobfuscators.SmartAssembly { bool checkCalledMethods(MethodDefinition checkMethod) { if (checkMethod == null) return false; - foreach (var tuple in DotNetUtils.getCalledMethods(module, checkMethod)) { - var method = tuple.Item2; + foreach (var method in DotNetUtils.getCalledMethods(module, checkMethod)) { if (method.Name == ".cctor" || method.Name == ".ctor") continue; if (!method.IsStatic || !DotNetUtils.isMethod(method, "System.Void", "()")) continue; - if (checkMemoryManagerType(tuple.Item1, method)) { - memoryManagerType = tuple.Item1; + if (checkMemoryManagerType(method.DeclaringType, method)) { + memoryManagerType = method.DeclaringType; attachAppMethod = method; return true; } diff --git a/de4dot.code/deobfuscators/SmartAssembly/ResolverInfoBase.cs b/de4dot.code/deobfuscators/SmartAssembly/ResolverInfoBase.cs index 902b3215..023d86a2 100644 --- a/de4dot.code/deobfuscators/SmartAssembly/ResolverInfoBase.cs +++ b/de4dot.code/deobfuscators/SmartAssembly/ResolverInfoBase.cs @@ -69,8 +69,7 @@ namespace de4dot.code.deobfuscators.SmartAssembly { bool findTypes(MethodDefinition initMethod) { if (initMethod == null) return false; - foreach (var tuple in DotNetUtils.getCalledMethods(module, initMethod)) { - var method = tuple.Item2; + foreach (var method in DotNetUtils.getCalledMethods(module, initMethod)) { if (method.Name == ".cctor" || method.Name == ".ctor") continue; if (!method.IsStatic || !DotNetUtils.isMethod(method, "System.Void", "()")) @@ -87,8 +86,7 @@ namespace de4dot.code.deobfuscators.SmartAssembly { if (!attachAppMethod.HasBody) return false; - foreach (var tuple in DotNetUtils.getCalledMethods(module, attachAppMethod)) { - var method = tuple.Item2; + foreach (var method in DotNetUtils.getCalledMethods(module, attachAppMethod)) { if (method.Name == ".cctor" || method.Name == ".ctor") continue; if (!method.IsStatic || !DotNetUtils.isMethod(method, "System.Void", "()")) diff --git a/de4dot.code/deobfuscators/dotNET_Reactor/v3/LibAssemblyResolver.cs b/de4dot.code/deobfuscators/dotNET_Reactor/v3/LibAssemblyResolver.cs index e2cb8273..bad6fbc6 100644 --- a/de4dot.code/deobfuscators/dotNET_Reactor/v3/LibAssemblyResolver.cs +++ b/de4dot.code/deobfuscators/dotNET_Reactor/v3/LibAssemblyResolver.cs @@ -58,9 +58,7 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v3 { "System.Boolean", }; - foreach (var tuple in DotNetUtils.getCalledMethods(module, checkMethod)) { - var method = tuple.Item2; - + foreach (var method in DotNetUtils.getCalledMethods(module, checkMethod)) { if (method.Body == null) continue; if (!method.IsStatic) diff --git a/de4dot.code/deobfuscators/dotNET_Reactor/v3/NativeLibSaver.cs b/de4dot.code/deobfuscators/dotNET_Reactor/v3/NativeLibSaver.cs index dcbe87f2..bc2eb849 100644 --- a/de4dot.code/deobfuscators/dotNET_Reactor/v3/NativeLibSaver.cs +++ b/de4dot.code/deobfuscators/dotNET_Reactor/v3/NativeLibSaver.cs @@ -65,14 +65,14 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v3 { } public void find() { - foreach (var info in DotNetUtils.getCalledMethods(module, DotNetUtils.getModuleTypeCctor(module))) { - if (!DotNetUtils.isMethod(info.Item2, "System.Void", "()")) + foreach (var calledMethod in DotNetUtils.getCalledMethods(module, DotNetUtils.getModuleTypeCctor(module))) { + if (!DotNetUtils.isMethod(calledMethod, "System.Void", "()")) continue; - if (info.Item1.FullName != "{F1C5056B-0AFC-4423-9B83-D13A26B48869}") + if (calledMethod.DeclaringType.FullName != "{F1C5056B-0AFC-4423-9B83-D13A26B48869}") continue; - nativeLibCallerType = info.Item1; - initMethod = info.Item2; + nativeLibCallerType = calledMethod.DeclaringType; + initMethod = calledMethod; foreach (var s in DotNetUtils.getCodeStrings(initMethod)) { nativeFileResource = DotNetUtils.getResource(module, s); if (nativeFileResource != null) diff --git a/de4dot.code/deobfuscators/dotNET_Reactor/v4/AssemblyResolver.cs b/de4dot.code/deobfuscators/dotNET_Reactor/v4/AssemblyResolver.cs index 3c6abca0..c54482ef 100644 --- a/de4dot.code/deobfuscators/dotNET_Reactor/v4/AssemblyResolver.cs +++ b/de4dot.code/deobfuscators/dotNET_Reactor/v4/AssemblyResolver.cs @@ -94,9 +94,8 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 { }; simpleDeobfuscator.deobfuscate(methodToCheck); - foreach (var tuple in DotNetUtils.getCalledMethods(module, methodToCheck)) { - var type = tuple.Item1; - var method = tuple.Item2; + foreach (var method in DotNetUtils.getCalledMethods(module, methodToCheck)) { + var type = method.DeclaringType; if (!DotNetUtils.isMethod(method, "System.Void", "()")) continue; if (!method.IsStatic) diff --git a/de4dot.code/deobfuscators/dotNET_Reactor/v4/Deobfuscator.cs b/de4dot.code/deobfuscators/dotNET_Reactor/v4/Deobfuscator.cs index a77238dd..6a350042 100644 --- a/de4dot.code/deobfuscators/dotNET_Reactor/v4/Deobfuscator.cs +++ b/de4dot.code/deobfuscators/dotNET_Reactor/v4/Deobfuscator.cs @@ -496,8 +496,8 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 { void addEntryPointCallToBeRemoved(MethodDefinition methodToBeRemoved) { var entryPoint = module.EntryPoint; addCallToBeRemoved(entryPoint, methodToBeRemoved); - foreach (var info in DotNetUtils.getCalledMethods(module, entryPoint)) - addCallToBeRemoved(info.Item2, methodToBeRemoved); + foreach (var calledMethod in DotNetUtils.getCalledMethods(module, entryPoint)) + addCallToBeRemoved(calledMethod, methodToBeRemoved); } void decryptResources() { diff --git a/de4dot.code/deobfuscators/dotNET_Reactor/v4/EmptyClass.cs b/de4dot.code/deobfuscators/dotNET_Reactor/v4/EmptyClass.cs index 68a77caf..705901ce 100644 --- a/de4dot.code/deobfuscators/dotNET_Reactor/v4/EmptyClass.cs +++ b/de4dot.code/deobfuscators/dotNET_Reactor/v4/EmptyClass.cs @@ -48,8 +48,7 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 { foreach (var method in type.Methods) { if (method.Name != ".ctor" && method.Name != ".cctor" && module.EntryPoint != method) continue; - foreach (var tuple in DotNetUtils.getCalledMethods(module, method)) { - var calledMethod = tuple.Item2; + foreach (var calledMethod in DotNetUtils.getCalledMethods(module, method)) { if (!calledMethod.IsStatic || calledMethod.Body == null) continue; if (!DotNetUtils.isMethod(calledMethod, "System.Void", "()")) diff --git a/de4dot.code/deobfuscators/dotNET_Reactor/v4/MethodsDecrypter.cs b/de4dot.code/deobfuscators/dotNET_Reactor/v4/MethodsDecrypter.cs index e7c1ae8b..8de2f0da 100644 --- a/de4dot.code/deobfuscators/dotNET_Reactor/v4/MethodsDecrypter.cs +++ b/de4dot.code/deobfuscators/dotNET_Reactor/v4/MethodsDecrypter.cs @@ -83,12 +83,11 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 { if (typesLeft-- <= 0) break; - foreach (var info in DotNetUtils.getCalledMethods(module, cctor)) { - var method = info.Item2; + foreach (var method in DotNetUtils.getCalledMethods(module, cctor)) { var key = new MethodReferenceAndDeclaringTypeKey(method); if (!checkedMethods.ContainsKey(key)) { checkedMethods[key] = false; - if (info.Item1.BaseType == null || info.Item1.BaseType.FullName != "System.Object") + if (method.DeclaringType.BaseType == null || method.DeclaringType.BaseType.FullName != "System.Object") continue; if (!DotNetUtils.isMethod(method, "System.Void", "()")) continue; diff --git a/de4dot.code/deobfuscators/dotNET_Reactor/v4/StringDecrypter.cs b/de4dot.code/deobfuscators/dotNET_Reactor/v4/StringDecrypter.cs index 25963f56..750c2dc6 100644 --- a/de4dot.code/deobfuscators/dotNET_Reactor/v4/StringDecrypter.cs +++ b/de4dot.code/deobfuscators/dotNET_Reactor/v4/StringDecrypter.cs @@ -173,8 +173,7 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 { "System.Security.Cryptography.CryptoStream", "System.Security.Cryptography.Rijndael", }; - foreach (var info in DotNetUtils.getCalledMethods(module, method)) { - var calledMethod = info.Item2; + foreach (var calledMethod in DotNetUtils.getCalledMethods(module, method)) { if (calledMethod.DeclaringType != method.DeclaringType) continue; if (calledMethod.MethodReturnType.ReturnType.FullName != "System.Byte[]")