Change getCalledMethods() return type
This commit is contained in:
parent
0b858c47ed
commit
6f01d48593
|
@ -689,7 +689,7 @@ namespace de4dot.blocks {
|
|||
return (string)carg.Value;
|
||||
}
|
||||
|
||||
public static IEnumerable<Tuple<TypeDefinition, MethodDefinition>> getCalledMethods(ModuleDefinition module, MethodDefinition method) {
|
||||
public static IEnumerable<MethodDefinition> getCalledMethods(ModuleDefinition module, MethodDefinition method) {
|
||||
if (method != null && method.HasBody) {
|
||||
foreach (var call in method.Body.Instructions) {
|
||||
if (call.OpCode.Code != Code.Call && call.OpCode.Code != Code.Callvirt)
|
||||
|
@ -699,12 +699,8 @@ namespace de4dot.blocks {
|
|||
continue;
|
||||
var type = getType(module, methodRef.DeclaringType);
|
||||
var methodDef = getMethod(type, methodRef);
|
||||
if (methodDef != null) {
|
||||
yield return new Tuple<TypeDefinition, MethodDefinition> {
|
||||
Item1 = type,
|
||||
Item2 = methodDef,
|
||||
};
|
||||
}
|
||||
if (methodDef != null)
|
||||
yield return methodDef;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
|
@ -159,8 +159,7 @@ namespace de4dot.code.deobfuscators.Babel_NET {
|
|||
}
|
||||
|
||||
ProxyCreatorType getProxyCreatorType(MethodDefinition methodToCheck) {
|
||||
foreach (var info in DotNetUtils.getCalledMethods(module, methodToCheck)) {
|
||||
var calledMethod = info.Item2;
|
||||
foreach (var calledMethod in DotNetUtils.getCalledMethods(module, methodToCheck)) {
|
||||
if (!calledMethod.IsStatic || calledMethod.Body == null)
|
||||
continue;
|
||||
if (!MemberReferenceHelper.compareTypes(methodToCheck.DeclaringType, calledMethod.DeclaringType))
|
||||
|
|
|
@ -231,8 +231,8 @@ namespace de4dot.code.deobfuscators.CodeVeil {
|
|||
}
|
||||
|
||||
bool callsMethod(MethodDefinition methodToCheck, MethodDefinition calledMethod) {
|
||||
foreach (var info in DotNetUtils.getCalledMethods(module, methodToCheck)) {
|
||||
if (info.Item2 == calledMethod)
|
||||
foreach (var method in DotNetUtils.getCalledMethods(module, methodToCheck)) {
|
||||
if (method == calledMethod)
|
||||
return true;
|
||||
}
|
||||
return false;
|
||||
|
|
|
@ -156,16 +156,16 @@ namespace de4dot.code.deobfuscators.CodeVeil {
|
|||
}
|
||||
|
||||
bool initProxyType(Info infoTmp, MethodDefinition method) {
|
||||
foreach (var call in DotNetUtils.getCalledMethods(module, method)) {
|
||||
if (!call.Item2.IsStatic)
|
||||
foreach (var calledMethod in DotNetUtils.getCalledMethods(module, method)) {
|
||||
if (!calledMethod.IsStatic)
|
||||
continue;
|
||||
if (!DotNetUtils.isMethod(call.Item2, "System.Void", "(System.Int32)"))
|
||||
if (!DotNetUtils.isMethod(calledMethod, "System.Void", "(System.Int32)"))
|
||||
continue;
|
||||
if (!checkProxyType(infoTmp, call.Item1))
|
||||
if (!checkProxyType(infoTmp, calledMethod.DeclaringType))
|
||||
continue;
|
||||
|
||||
infoTmp.proxyType = call.Item1;
|
||||
infoTmp.initMethod = call.Item2;
|
||||
infoTmp.proxyType = calledMethod.DeclaringType;
|
||||
infoTmp.initMethod = calledMethod;
|
||||
return true;
|
||||
}
|
||||
return false;
|
||||
|
|
|
@ -108,8 +108,8 @@ namespace de4dot.code.deobfuscators.CodeVeil {
|
|||
void findV5(MethodDefinition method) {
|
||||
if (!mainType.Detected)
|
||||
return;
|
||||
foreach (var info in DotNetUtils.getCalledMethods(module, mainType.InitMethod)) {
|
||||
if (find(info.Item2))
|
||||
foreach (var calledMethod in DotNetUtils.getCalledMethods(module, mainType.InitMethod)) {
|
||||
if (find(calledMethod))
|
||||
return;
|
||||
}
|
||||
}
|
||||
|
|
|
@ -117,8 +117,8 @@ namespace de4dot.code.deobfuscators.CodeVeil {
|
|||
}
|
||||
|
||||
bool callsMainTypeTamperCheckMethod(MethodDefinition method) {
|
||||
foreach (var info in DotNetUtils.getCalledMethods(module, method)) {
|
||||
if (info.Item2 == mainType.TamperCheckMethod)
|
||||
foreach (var calledMethod in DotNetUtils.getCalledMethods(module, method)) {
|
||||
if (calledMethod == mainType.TamperCheckMethod)
|
||||
return true;
|
||||
}
|
||||
|
||||
|
|
|
@ -52,9 +52,8 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
|
|||
bool find(MethodDefinition methodToCheck) {
|
||||
if (methodToCheck == null)
|
||||
return false;
|
||||
foreach (var info in DotNetUtils.getCalledMethods(module, methodToCheck)) {
|
||||
var type = info.Item1;
|
||||
var method = info.Item2;
|
||||
foreach (var method in DotNetUtils.getCalledMethods(module, methodToCheck)) {
|
||||
var type = method.DeclaringType;
|
||||
|
||||
if (!method.IsStatic || !DotNetUtils.isMethod(method, "System.Void", "()"))
|
||||
continue;
|
||||
|
|
|
@ -67,13 +67,12 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
|
|||
if (cctor == null)
|
||||
return;
|
||||
|
||||
foreach (var tuple in DotNetUtils.getCalledMethods(module, cctor)) {
|
||||
var method = tuple.Item2;
|
||||
foreach (var method in DotNetUtils.getCalledMethods(module, cctor)) {
|
||||
if (method.Name == ".cctor" || method.Name == ".ctor")
|
||||
continue;
|
||||
if (!method.IsStatic || !DotNetUtils.isMethod(method, "System.Void", "()"))
|
||||
continue;
|
||||
if (checkType(tuple.Item1, method))
|
||||
if (checkType(method.DeclaringType, method))
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
|
|
@ -55,8 +55,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
|
|||
if (cctor == null)
|
||||
return;
|
||||
|
||||
foreach (var tuple in DotNetUtils.getCalledMethods(module, cctor)) {
|
||||
var method = tuple.Item2;
|
||||
foreach (var method in DotNetUtils.getCalledMethods(module, cctor)) {
|
||||
if (method.Name == ".cctor" || method.Name == ".ctor")
|
||||
continue;
|
||||
if (!method.IsStatic || !DotNetUtils.isMethod(method, "System.Void", "()"))
|
||||
|
|
|
@ -55,9 +55,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
|
|||
if (methodToCheck == null)
|
||||
return false;
|
||||
|
||||
foreach (var info in DotNetUtils.getCalledMethods(module, methodToCheck)) {
|
||||
var method = info.Item2;
|
||||
|
||||
foreach (var method in DotNetUtils.getCalledMethods(module, methodToCheck)) {
|
||||
bool result = false;
|
||||
switch (frameworkType) {
|
||||
case FrameworkType.Desktop:
|
||||
|
|
|
@ -82,8 +82,7 @@ namespace de4dot.code.deobfuscators.DeepSea {
|
|||
if (resolverInitMethod.Body.ExceptionHandlers.Count != 1)
|
||||
return false;
|
||||
|
||||
foreach (var info in DotNetUtils.getCalledMethods(module, resolverInitMethod)) {
|
||||
var method = info.Item2;
|
||||
foreach (var method in DotNetUtils.getCalledMethods(module, resolverInitMethod)) {
|
||||
if (!method.IsStatic || method.Body == null)
|
||||
continue;
|
||||
if (!method.IsPublic || method.HasGenericParameters)
|
||||
|
|
|
@ -62,8 +62,7 @@ namespace de4dot.code.deobfuscators.DeepSea {
|
|||
if (checkMethod == null || checkMethod.Body == null)
|
||||
return false;
|
||||
|
||||
foreach (var tuple in DotNetUtils.getCalledMethods(module, checkMethod)) {
|
||||
var method = tuple.Item2;
|
||||
foreach (var method in DotNetUtils.getCalledMethods(module, checkMethod)) {
|
||||
if (method.Name == ".cctor" || method.Name == ".ctor")
|
||||
continue;
|
||||
if (!method.IsStatic || !DotNetUtils.isMethod(method, "System.Void", "()"))
|
||||
|
|
|
@ -210,8 +210,7 @@ namespace de4dot.code.deobfuscators.Goliath_NET {
|
|||
return false;
|
||||
|
||||
MethodDefinition initMethod = null;
|
||||
foreach (var info in DotNetUtils.getCalledMethods(module, cctor)) {
|
||||
var method = info.Item2;
|
||||
foreach (var method in DotNetUtils.getCalledMethods(module, cctor)) {
|
||||
if (DotNetUtils.isMethod(method, "System.Void", "(System.Type)")) {
|
||||
initMethod = method;
|
||||
break;
|
||||
|
|
|
@ -85,8 +85,7 @@ namespace de4dot.code.deobfuscators.MaxtoCode {
|
|||
if (cctor == null)
|
||||
return;
|
||||
|
||||
foreach (var info in DotNetUtils.getCalledMethods(module, cctor)) {
|
||||
var method = info.Item2;
|
||||
foreach (var method in DotNetUtils.getCalledMethods(module, cctor)) {
|
||||
if (method.Name != "Startup")
|
||||
continue;
|
||||
if (!DotNetUtils.isMethod(method, "System.Void", "()"))
|
||||
|
|
|
@ -164,8 +164,7 @@ namespace de4dot.code.deobfuscators.Skater_NET {
|
|||
}
|
||||
|
||||
string getPassword(MethodDefinition decryptMethod) {
|
||||
foreach (var info in DotNetUtils.getCalledMethods(module, decryptMethod)) {
|
||||
var method = info.Item2;
|
||||
foreach (var method in DotNetUtils.getCalledMethods(module, decryptMethod)) {
|
||||
if (!method.IsStatic || method.Body == null)
|
||||
continue;
|
||||
if (!MemberReferenceHelper.compareTypes(method.DeclaringType, decryptMethod.DeclaringType))
|
||||
|
@ -200,8 +199,8 @@ namespace de4dot.code.deobfuscators.Skater_NET {
|
|||
|
||||
string getPassword2(MethodDefinition method) {
|
||||
string password = "";
|
||||
foreach (var info in DotNetUtils.getCalledMethods(module, method)) {
|
||||
var s = getPassword3(info.Item2);
|
||||
foreach (var calledMethod in DotNetUtils.getCalledMethods(module, method)) {
|
||||
var s = getPassword3(calledMethod);
|
||||
if (string.IsNullOrEmpty(s))
|
||||
return null;
|
||||
|
||||
|
|
|
@ -53,14 +53,13 @@ namespace de4dot.code.deobfuscators.SmartAssembly {
|
|||
bool checkCalledMethods(MethodDefinition checkMethod) {
|
||||
if (checkMethod == null)
|
||||
return false;
|
||||
foreach (var tuple in DotNetUtils.getCalledMethods(module, checkMethod)) {
|
||||
var method = tuple.Item2;
|
||||
foreach (var method in DotNetUtils.getCalledMethods(module, checkMethod)) {
|
||||
if (method.Name == ".cctor" || method.Name == ".ctor")
|
||||
continue;
|
||||
if (!method.IsStatic || !DotNetUtils.isMethod(method, "System.Void", "()"))
|
||||
continue;
|
||||
if (checkMemoryManagerType(tuple.Item1, method)) {
|
||||
memoryManagerType = tuple.Item1;
|
||||
if (checkMemoryManagerType(method.DeclaringType, method)) {
|
||||
memoryManagerType = method.DeclaringType;
|
||||
attachAppMethod = method;
|
||||
return true;
|
||||
}
|
||||
|
|
|
@ -69,8 +69,7 @@ namespace de4dot.code.deobfuscators.SmartAssembly {
|
|||
bool findTypes(MethodDefinition initMethod) {
|
||||
if (initMethod == null)
|
||||
return false;
|
||||
foreach (var tuple in DotNetUtils.getCalledMethods(module, initMethod)) {
|
||||
var method = tuple.Item2;
|
||||
foreach (var method in DotNetUtils.getCalledMethods(module, initMethod)) {
|
||||
if (method.Name == ".cctor" || method.Name == ".ctor")
|
||||
continue;
|
||||
if (!method.IsStatic || !DotNetUtils.isMethod(method, "System.Void", "()"))
|
||||
|
@ -87,8 +86,7 @@ namespace de4dot.code.deobfuscators.SmartAssembly {
|
|||
if (!attachAppMethod.HasBody)
|
||||
return false;
|
||||
|
||||
foreach (var tuple in DotNetUtils.getCalledMethods(module, attachAppMethod)) {
|
||||
var method = tuple.Item2;
|
||||
foreach (var method in DotNetUtils.getCalledMethods(module, attachAppMethod)) {
|
||||
if (method.Name == ".cctor" || method.Name == ".ctor")
|
||||
continue;
|
||||
if (!method.IsStatic || !DotNetUtils.isMethod(method, "System.Void", "()"))
|
||||
|
|
|
@ -58,9 +58,7 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v3 {
|
|||
"System.Boolean",
|
||||
};
|
||||
|
||||
foreach (var tuple in DotNetUtils.getCalledMethods(module, checkMethod)) {
|
||||
var method = tuple.Item2;
|
||||
|
||||
foreach (var method in DotNetUtils.getCalledMethods(module, checkMethod)) {
|
||||
if (method.Body == null)
|
||||
continue;
|
||||
if (!method.IsStatic)
|
||||
|
|
|
@ -65,14 +65,14 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v3 {
|
|||
}
|
||||
|
||||
public void find() {
|
||||
foreach (var info in DotNetUtils.getCalledMethods(module, DotNetUtils.getModuleTypeCctor(module))) {
|
||||
if (!DotNetUtils.isMethod(info.Item2, "System.Void", "()"))
|
||||
foreach (var calledMethod in DotNetUtils.getCalledMethods(module, DotNetUtils.getModuleTypeCctor(module))) {
|
||||
if (!DotNetUtils.isMethod(calledMethod, "System.Void", "()"))
|
||||
continue;
|
||||
if (info.Item1.FullName != "<PrivateImplementationDetails>{F1C5056B-0AFC-4423-9B83-D13A26B48869}")
|
||||
if (calledMethod.DeclaringType.FullName != "<PrivateImplementationDetails>{F1C5056B-0AFC-4423-9B83-D13A26B48869}")
|
||||
continue;
|
||||
|
||||
nativeLibCallerType = info.Item1;
|
||||
initMethod = info.Item2;
|
||||
nativeLibCallerType = calledMethod.DeclaringType;
|
||||
initMethod = calledMethod;
|
||||
foreach (var s in DotNetUtils.getCodeStrings(initMethod)) {
|
||||
nativeFileResource = DotNetUtils.getResource(module, s);
|
||||
if (nativeFileResource != null)
|
||||
|
|
|
@ -94,9 +94,8 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 {
|
|||
};
|
||||
|
||||
simpleDeobfuscator.deobfuscate(methodToCheck);
|
||||
foreach (var tuple in DotNetUtils.getCalledMethods(module, methodToCheck)) {
|
||||
var type = tuple.Item1;
|
||||
var method = tuple.Item2;
|
||||
foreach (var method in DotNetUtils.getCalledMethods(module, methodToCheck)) {
|
||||
var type = method.DeclaringType;
|
||||
if (!DotNetUtils.isMethod(method, "System.Void", "()"))
|
||||
continue;
|
||||
if (!method.IsStatic)
|
||||
|
|
|
@ -496,8 +496,8 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 {
|
|||
void addEntryPointCallToBeRemoved(MethodDefinition methodToBeRemoved) {
|
||||
var entryPoint = module.EntryPoint;
|
||||
addCallToBeRemoved(entryPoint, methodToBeRemoved);
|
||||
foreach (var info in DotNetUtils.getCalledMethods(module, entryPoint))
|
||||
addCallToBeRemoved(info.Item2, methodToBeRemoved);
|
||||
foreach (var calledMethod in DotNetUtils.getCalledMethods(module, entryPoint))
|
||||
addCallToBeRemoved(calledMethod, methodToBeRemoved);
|
||||
}
|
||||
|
||||
void decryptResources() {
|
||||
|
|
|
@ -48,8 +48,7 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 {
|
|||
foreach (var method in type.Methods) {
|
||||
if (method.Name != ".ctor" && method.Name != ".cctor" && module.EntryPoint != method)
|
||||
continue;
|
||||
foreach (var tuple in DotNetUtils.getCalledMethods(module, method)) {
|
||||
var calledMethod = tuple.Item2;
|
||||
foreach (var calledMethod in DotNetUtils.getCalledMethods(module, method)) {
|
||||
if (!calledMethod.IsStatic || calledMethod.Body == null)
|
||||
continue;
|
||||
if (!DotNetUtils.isMethod(calledMethod, "System.Void", "()"))
|
||||
|
|
|
@ -83,12 +83,11 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 {
|
|||
if (typesLeft-- <= 0)
|
||||
break;
|
||||
|
||||
foreach (var info in DotNetUtils.getCalledMethods(module, cctor)) {
|
||||
var method = info.Item2;
|
||||
foreach (var method in DotNetUtils.getCalledMethods(module, cctor)) {
|
||||
var key = new MethodReferenceAndDeclaringTypeKey(method);
|
||||
if (!checkedMethods.ContainsKey(key)) {
|
||||
checkedMethods[key] = false;
|
||||
if (info.Item1.BaseType == null || info.Item1.BaseType.FullName != "System.Object")
|
||||
if (method.DeclaringType.BaseType == null || method.DeclaringType.BaseType.FullName != "System.Object")
|
||||
continue;
|
||||
if (!DotNetUtils.isMethod(method, "System.Void", "()"))
|
||||
continue;
|
||||
|
|
|
@ -173,8 +173,7 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 {
|
|||
"System.Security.Cryptography.CryptoStream",
|
||||
"System.Security.Cryptography.Rijndael",
|
||||
};
|
||||
foreach (var info in DotNetUtils.getCalledMethods(module, method)) {
|
||||
var calledMethod = info.Item2;
|
||||
foreach (var calledMethod in DotNetUtils.getCalledMethods(module, method)) {
|
||||
if (calledMethod.DeclaringType != method.DeclaringType)
|
||||
continue;
|
||||
if (calledMethod.MethodReturnType.ReturnType.FullName != "System.Byte[]")
|
||||
|
|
Loading…
Reference in New Issue
Block a user