Port .....
This commit is contained in:
de4dot
parent
ee7826576c
commit
6f73696cc5
|
|
@ -38,29 +38,29 @@
|
|||
<Compile Include="Block.cs" />
|
||||
<Compile Include="Blocks.cs" />
|
||||
<Compile Include="BlocksSorter.cs" />
|
||||
<Compile Include="cflow\BlockCflowDeobfuscator.cs" />
|
||||
<Compile Include="cflow\BlockDeobfuscator.cs" />
|
||||
<Compile Include="cflow\BranchEmulator.cs" />
|
||||
<Compile Include="cflow\CachedCflowDeobfuscator.cs" />
|
||||
<Compile Include="cflow\CflowDeobfuscator.cs" />
|
||||
<Compile Include="cflow\CflowUtils.cs" />
|
||||
<Compile Include="cflow\ConstantsFolder.cs" />
|
||||
<Compile Include="cflow\DeadCodeRemover.cs" />
|
||||
<Compile Include="cflow\DeadStoreRemover.cs" />
|
||||
<Compile Include="cflow\IBlocksDeobfuscator.cs" />
|
||||
<Compile Include="cflow\ICflowDeobfuscator.cs" />
|
||||
<None Include="cflow\BlockCflowDeobfuscator.cs" />
|
||||
<None Include="cflow\BlockDeobfuscator.cs" />
|
||||
<None Include="cflow\BlocksCflowDeobfuscator.cs" />
|
||||
<None Include="cflow\BranchEmulator.cs" />
|
||||
<None Include="cflow\CachedCflowDeobfuscator.cs" />
|
||||
<None Include="cflow\CflowDeobfuscator.cs" />
|
||||
<None Include="cflow\CflowUtils.cs" />
|
||||
<None Include="cflow\ConstantsFolder.cs" />
|
||||
<None Include="cflow\DeadCodeRemover.cs" />
|
||||
<None Include="cflow\DeadStoreRemover.cs" />
|
||||
<None Include="cflow\IBlocksDeobfuscator.cs" />
|
||||
<None Include="cflow\ICflowDeobfuscator.cs" />
|
||||
<Compile Include="cflow\InstructionEmulator.cs" />
|
||||
<Compile Include="cflow\Int32Value.cs" />
|
||||
<Compile Include="cflow\Int64Value.cs" />
|
||||
<Compile Include="cflow\MethodCallInliner.cs" />
|
||||
<Compile Include="cflow\MethodCallInlinerBase.cs" />
|
||||
<None Include="cflow\MethodCallInliner.cs" />
|
||||
<None Include="cflow\MethodCallInlinerBase.cs" />
|
||||
<Compile Include="cflow\Real8Value.cs" />
|
||||
<Compile Include="cflow\StLdlocFixer.cs" />
|
||||
<Compile Include="cflow\SwitchCflowDeobfuscator.cs" />
|
||||
<None Include="cflow\StLdlocFixer.cs" />
|
||||
<None Include="cflow\SwitchCflowDeobfuscator.cs" />
|
||||
<Compile Include="cflow\Value.cs" />
|
||||
<Compile Include="cflow\ValueStack.cs" />
|
||||
<Compile Include="CodeGenerator.cs" />
|
||||
<Compile Include="cflow\BlocksCflowDeobfuscator.cs" />
|
||||
<Compile Include="DeadBlocksRemover.cs" />
|
||||
<Compile Include="DotNetUtils.cs" />
|
||||
<Compile Include="FilterHandlerBlock.cs" />
|
||||
|
|
@ -68,8 +68,8 @@
|
|||
<Compile Include="HandlerBlock.cs" />
|
||||
<Compile Include="Instr.cs" />
|
||||
<Compile Include="InstructionListParser.cs" />
|
||||
<Compile Include="MemberRefInstance.cs" />
|
||||
<Compile Include="MemberReferenceHelper.cs" />
|
||||
<Compile Include="MemberRefInstance.cs" />
|
||||
<Compile Include="MethodBlocks.cs" />
|
||||
<Compile Include="PE\Cor20Header.cs" />
|
||||
<Compile Include="PE\DataDirectory.cs" />
|
||||
|
|
@ -99,6 +99,10 @@
|
|||
<Project>{D68133BD-1E63-496E-9EDE-4FBDBF77B486}</Project>
|
||||
<Name>Mono.Cecil</Name>
|
||||
</ProjectReference>
|
||||
<ProjectReference Include="..\dot10\src\dot10.csproj">
|
||||
<Project>{FDFC1237-143F-4919-8318-4926901F4639}</Project>
|
||||
<Name>dot10</Name>
|
||||
</ProjectReference>
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<Reference Include="System" />
|
||||
|
|
|
|||
|
|
@ -19,39 +19,38 @@
|
|||
|
||||
using System;
|
||||
using System.Collections.Generic;
|
||||
using Mono.Cecil;
|
||||
using Mono.Cecil.Cil;
|
||||
using Mono.Cecil.Metadata;
|
||||
using dot10.DotNet;
|
||||
using dot10.DotNet.Emit;
|
||||
|
||||
namespace de4dot.blocks.cflow {
|
||||
public class InstructionEmulator {
|
||||
ValueStack valueStack = new ValueStack();
|
||||
Dictionary<Value, bool> protectedStackValues = new Dictionary<Value, bool>();
|
||||
IList<ParameterDefinition> parameterDefinitions;
|
||||
IList<VariableDefinition> variableDefinitions;
|
||||
IList<Parameter> parameterDefs;
|
||||
IList<Local> localDefs;
|
||||
List<Value> args = new List<Value>();
|
||||
List<Value> locals = new List<Value>();
|
||||
int argBase;
|
||||
|
||||
MethodDefinition prev_method;
|
||||
MethodDef prev_method;
|
||||
List<Value> cached_args = new List<Value>();
|
||||
List<Value> cached_locals = new List<Value>();
|
||||
int cached_argBase;
|
||||
|
||||
public InstructionEmulator() {
|
||||
}
|
||||
|
||||
public InstructionEmulator(MethodDefinition method) {
|
||||
public InstructionEmulator(MethodDef method) {
|
||||
init(method);
|
||||
}
|
||||
|
||||
#if PORT
|
||||
public void init(Blocks blocks) {
|
||||
init(blocks.Method);
|
||||
}
|
||||
#endif
|
||||
|
||||
public void init(MethodDefinition method) {
|
||||
this.parameterDefinitions = method.Parameters;
|
||||
this.variableDefinitions = method.Body.Variables;
|
||||
public void init(MethodDef method) {
|
||||
this.parameterDefs = method.Parameters;
|
||||
this.localDefs = method.CilBody.LocalList;
|
||||
valueStack.init();
|
||||
protectedStackValues.Clear();
|
||||
|
||||
|
|
@ -59,20 +58,14 @@ namespace de4dot.blocks.cflow {
|
|||
prev_method = method;
|
||||
|
||||
cached_args.Clear();
|
||||
cached_argBase = 0;
|
||||
if (method.HasImplicitThis) {
|
||||
cached_argBase = 1;
|
||||
cached_args.Add(new UnknownValue());
|
||||
}
|
||||
for (int i = 0; i < parameterDefinitions.Count; i++)
|
||||
cached_args.Add(getUnknownValue(parameterDefinitions[i].ParameterType));
|
||||
for (int i = 0; i < parameterDefs.Count; i++)
|
||||
cached_args.Add(getUnknownValue(parameterDefs[i].Type));
|
||||
|
||||
cached_locals.Clear();
|
||||
for (int i = 0; i < variableDefinitions.Count; i++)
|
||||
cached_locals.Add(getUnknownValue(variableDefinitions[i].VariableType));
|
||||
for (int i = 0; i < localDefs.Count; i++)
|
||||
cached_locals.Add(getUnknownValue(localDefs[i].Type));
|
||||
}
|
||||
|
||||
argBase = cached_argBase;
|
||||
args.Clear();
|
||||
args.AddRange(cached_args);
|
||||
locals.Clear();
|
||||
|
|
@ -83,10 +76,14 @@ namespace de4dot.blocks.cflow {
|
|||
protectedStackValues[value] = true;
|
||||
}
|
||||
|
||||
static Value getUnknownValue(TypeReference typeReference) {
|
||||
if (typeReference == null)
|
||||
static Value getUnknownValue(ITypeDefOrRef type) {
|
||||
return getUnknownValue(type.ToTypeSig(false));
|
||||
}
|
||||
|
||||
static Value getUnknownValue(TypeSig type) {
|
||||
if (type == null)
|
||||
return new UnknownValue();
|
||||
switch (typeReference.EType) {
|
||||
switch (type.ElementType) {
|
||||
case ElementType.Boolean: return Int32Value.createUnknownBool();
|
||||
case ElementType.I1: return Int32Value.createUnknown();
|
||||
case ElementType.U1: return Int32Value.createUnknownUInt8();
|
||||
|
|
@ -100,13 +97,13 @@ namespace de4dot.blocks.cflow {
|
|||
return new UnknownValue();
|
||||
}
|
||||
|
||||
Value truncateValue(Value value, TypeReference typeReference) {
|
||||
if (typeReference == null)
|
||||
Value truncateValue(Value value, TypeSig type) {
|
||||
if (type == null)
|
||||
return value;
|
||||
if (protectedStackValues.ContainsKey(value))
|
||||
return value;
|
||||
|
||||
switch (typeReference.EType) {
|
||||
switch (type.ElementType) {
|
||||
case ElementType.Boolean:
|
||||
if (value.isInt32())
|
||||
return ((Int32Value)value).toBoolean();
|
||||
|
|
@ -167,27 +164,22 @@ namespace de4dot.blocks.cflow {
|
|||
return getValue(args, i);
|
||||
}
|
||||
|
||||
int index(ParameterDefinition arg) {
|
||||
return arg.Sequence;
|
||||
public Value getArg(Parameter arg) {
|
||||
return getArg(arg.Number);
|
||||
}
|
||||
|
||||
public Value getArg(ParameterDefinition arg) {
|
||||
return getArg(index(arg));
|
||||
}
|
||||
|
||||
TypeReference getArgType(int index) {
|
||||
index -= argBase;
|
||||
if (0 <= index && index < parameterDefinitions.Count)
|
||||
return parameterDefinitions[index].ParameterType;
|
||||
TypeSig getArgType(int index) {
|
||||
if (0 <= index && index < parameterDefs.Count)
|
||||
return parameterDefs[index].Type;
|
||||
return null;
|
||||
}
|
||||
|
||||
public void setArg(ParameterDefinition arg, Value value) {
|
||||
setArg(index(arg), value);
|
||||
public void setArg(Parameter arg, Value value) {
|
||||
setArg(arg.Number, value);
|
||||
}
|
||||
|
||||
public void makeArgUnknown(ParameterDefinition arg) {
|
||||
setArg(arg, getUnknownArg(index(arg)));
|
||||
public void makeArgUnknown(Parameter arg) {
|
||||
setArg(arg, getUnknownArg(arg.Number));
|
||||
}
|
||||
|
||||
void setArg(int index, Value value) {
|
||||
|
|
@ -203,26 +195,26 @@ namespace de4dot.blocks.cflow {
|
|||
return getValue(locals, i);
|
||||
}
|
||||
|
||||
public Value getLocal(VariableDefinition local) {
|
||||
return getLocal(local.Index);
|
||||
public Value getLocal(Local local) {
|
||||
return getLocal(local.Number);
|
||||
}
|
||||
|
||||
public void setLocal(VariableDefinition local, Value value) {
|
||||
setLocal(local.Index, value);
|
||||
public void setLocal(Local local, Value value) {
|
||||
setLocal(local.Number, value);
|
||||
}
|
||||
|
||||
public void makeLocalUnknown(VariableDefinition local) {
|
||||
setLocal(local.Index, getUnknownLocal(local.Index));
|
||||
public void makeLocalUnknown(Local local) {
|
||||
setLocal(local.Number, getUnknownLocal(local.Number));
|
||||
}
|
||||
|
||||
void setLocal(int index, Value value) {
|
||||
if (0 <= index && index < locals.Count)
|
||||
locals[index] = truncateValue(value, variableDefinitions[index].VariableType);
|
||||
locals[index] = truncateValue(value, localDefs[index].Type);
|
||||
}
|
||||
|
||||
Value getUnknownLocal(int index) {
|
||||
if (0 <= index && index < variableDefinitions.Count)
|
||||
return getUnknownValue(variableDefinitions[index].VariableType);
|
||||
if (0 <= index && index < localDefs.Count)
|
||||
return getUnknownValue(localDefs[index].Type);
|
||||
return new UnknownValue();
|
||||
}
|
||||
|
||||
|
|
@ -242,6 +234,7 @@ namespace de4dot.blocks.cflow {
|
|||
return valueStack.peek();
|
||||
}
|
||||
|
||||
#if PORT
|
||||
public void emulate(IEnumerable<Instr> instructions) {
|
||||
foreach (var instr in instructions)
|
||||
emulate(instr.Instruction);
|
||||
|
|
@ -251,35 +244,36 @@ namespace de4dot.blocks.cflow {
|
|||
for (int i = start; i < end; i++)
|
||||
emulate(instructions[i].Instruction);
|
||||
}
|
||||
#endif
|
||||
|
||||
public void emulate(Instruction instr) {
|
||||
switch (instr.OpCode.Code) {
|
||||
case Code.Starg:
|
||||
case Code.Starg_S: emulate_Starg((ParameterDefinition)instr.Operand); break;
|
||||
case Code.Starg_S: emulate_Starg((Parameter)instr.Operand); break;
|
||||
case Code.Stloc:
|
||||
case Code.Stloc_S: emulate_Stloc(((VariableDefinition)instr.Operand).Index); break;
|
||||
case Code.Stloc_S: emulate_Stloc(((Local)instr.Operand).Number); break;
|
||||
case Code.Stloc_0: emulate_Stloc(0); break;
|
||||
case Code.Stloc_1: emulate_Stloc(1); break;
|
||||
case Code.Stloc_2: emulate_Stloc(2); break;
|
||||
case Code.Stloc_3: emulate_Stloc(3); break;
|
||||
|
||||
case Code.Ldarg:
|
||||
case Code.Ldarg_S: valueStack.push(getArg((ParameterDefinition)instr.Operand)); break;
|
||||
case Code.Ldarg_S: valueStack.push(getArg((Parameter)instr.Operand)); break;
|
||||
case Code.Ldarg_0: valueStack.push(getArg(0)); break;
|
||||
case Code.Ldarg_1: valueStack.push(getArg(1)); break;
|
||||
case Code.Ldarg_2: valueStack.push(getArg(2)); break;
|
||||
case Code.Ldarg_3: valueStack.push(getArg(3)); break;
|
||||
case Code.Ldloc:
|
||||
case Code.Ldloc_S: valueStack.push(getLocal((VariableDefinition)instr.Operand)); break;
|
||||
case Code.Ldloc_S: valueStack.push(getLocal((Local)instr.Operand)); break;
|
||||
case Code.Ldloc_0: valueStack.push(getLocal(0)); break;
|
||||
case Code.Ldloc_1: valueStack.push(getLocal(1)); break;
|
||||
case Code.Ldloc_2: valueStack.push(getLocal(2)); break;
|
||||
case Code.Ldloc_3: valueStack.push(getLocal(3)); break;
|
||||
|
||||
case Code.Ldarga:
|
||||
case Code.Ldarga_S: emulate_Ldarga((ParameterDefinition)instr.Operand); break;
|
||||
case Code.Ldarga_S: emulate_Ldarga((Parameter)instr.Operand); break;
|
||||
case Code.Ldloca:
|
||||
case Code.Ldloca_S: emulate_Ldloca(((VariableDefinition)instr.Operand).Index); break;
|
||||
case Code.Ldloca_S: emulate_Ldloca(((Local)instr.Operand).Number); break;
|
||||
|
||||
case Code.Dup: valueStack.copyTop(); break;
|
||||
|
||||
|
|
@ -369,7 +363,7 @@ namespace de4dot.blocks.cflow {
|
|||
case Code.Ldelem_U1: valueStack.pop(2); valueStack.push(Int32Value.createUnknownUInt8()); break;
|
||||
case Code.Ldelem_U2: valueStack.pop(2); valueStack.push(Int32Value.createUnknownUInt16()); break;
|
||||
case Code.Ldelem_U4: valueStack.pop(2); valueStack.push(Int32Value.createUnknown()); break;
|
||||
case Code.Ldelem_Any:valueStack.pop(2); valueStack.push(getUnknownValue(instr.Operand as TypeReference)); break;
|
||||
case Code.Ldelem: valueStack.pop(2); valueStack.push(getUnknownValue(instr.Operand as ITypeDefOrRef)); break;
|
||||
|
||||
case Code.Ldind_I1: valueStack.pop(); valueStack.push(Int32Value.createUnknown()); break;
|
||||
case Code.Ldind_I2: valueStack.pop(); valueStack.push(Int32Value.createUnknown()); break;
|
||||
|
|
@ -457,7 +451,6 @@ namespace de4dot.blocks.cflow {
|
|||
case Code.Mkrefany:
|
||||
case Code.Newarr:
|
||||
case Code.Newobj:
|
||||
case Code.No:
|
||||
case Code.Nop:
|
||||
case Code.Pop:
|
||||
case Code.Readonly:
|
||||
|
|
@ -465,7 +458,7 @@ namespace de4dot.blocks.cflow {
|
|||
case Code.Refanyval:
|
||||
case Code.Ret:
|
||||
case Code.Rethrow:
|
||||
case Code.Stelem_Any:
|
||||
case Code.Stelem:
|
||||
case Code.Stelem_I:
|
||||
case Code.Stelem_I1:
|
||||
case Code.Stelem_I2:
|
||||
|
|
@ -486,7 +479,7 @@ namespace de4dot.blocks.cflow {
|
|||
case Code.Stobj:
|
||||
case Code.Stsfld:
|
||||
case Code.Switch:
|
||||
case Code.Tail:
|
||||
case Code.Tailcall:
|
||||
case Code.Throw:
|
||||
case Code.Unaligned:
|
||||
case Code.Volatile:
|
||||
|
|
@ -498,7 +491,7 @@ namespace de4dot.blocks.cflow {
|
|||
|
||||
void updateStack(Instruction instr) {
|
||||
int pushes, pops;
|
||||
DotNetUtils.calculateStackUsage(instr, false, out pushes, out pops);
|
||||
instr.CalculateStackUsage(out pushes, out pops);
|
||||
if (pops == -1)
|
||||
valueStack.clear();
|
||||
else {
|
||||
|
|
@ -847,15 +840,15 @@ namespace de4dot.blocks.cflow {
|
|||
valueStack.pushUnknown();
|
||||
}
|
||||
|
||||
void emulate_Starg(ParameterDefinition arg) {
|
||||
setArg(index(arg), valueStack.pop());
|
||||
void emulate_Starg(Parameter arg) {
|
||||
setArg(arg.Number, valueStack.pop());
|
||||
}
|
||||
|
||||
void emulate_Stloc(int index) {
|
||||
setLocal(index, valueStack.pop());
|
||||
}
|
||||
|
||||
void emulate_Ldarga(ParameterDefinition arg) {
|
||||
void emulate_Ldarga(Parameter arg) {
|
||||
valueStack.pushUnknown();
|
||||
makeArgUnknown(arg);
|
||||
}
|
||||
|
|
@ -866,19 +859,19 @@ namespace de4dot.blocks.cflow {
|
|||
}
|
||||
|
||||
void emulate_Call(Instruction instr) {
|
||||
emulate_Call(instr, (MethodReference)instr.Operand);
|
||||
emulate_Call(instr, (IMethod)instr.Operand);
|
||||
}
|
||||
|
||||
void emulate_Callvirt(Instruction instr) {
|
||||
emulate_Call(instr, (MethodReference)instr.Operand);
|
||||
emulate_Call(instr, (IMethod)instr.Operand);
|
||||
}
|
||||
|
||||
void emulate_Call(Instruction instr, MethodReference method) {
|
||||
void emulate_Call(Instruction instr, IMethod method) {
|
||||
int pushes, pops;
|
||||
DotNetUtils.calculateStackUsage(instr, false, out pushes, out pops);
|
||||
instr.CalculateStackUsage(out pushes, out pops);
|
||||
valueStack.pop(pops);
|
||||
if (pushes == 1)
|
||||
valueStack.push(getUnknownValue(method.MethodReturnType.ReturnType));
|
||||
valueStack.push(getUnknownValue(method.MethodSig.RetType));
|
||||
else
|
||||
valueStack.push(pushes);
|
||||
}
|
||||
|
|
@ -903,16 +896,16 @@ namespace de4dot.blocks.cflow {
|
|||
|
||||
void emulate_Ldfld(Instruction instr) {
|
||||
var val1 = valueStack.pop();
|
||||
emulateLoadField(instr.Operand as FieldReference);
|
||||
emulateLoadField(instr.Operand as IField);
|
||||
}
|
||||
|
||||
void emulate_Ldsfld(Instruction instr) {
|
||||
emulateLoadField(instr.Operand as FieldReference);
|
||||
emulateLoadField(instr.Operand as IField);
|
||||
}
|
||||
|
||||
void emulateLoadField(FieldReference fieldReference) {
|
||||
if (fieldReference != null)
|
||||
valueStack.push(getUnknownValue(fieldReference.FieldType));
|
||||
void emulateLoadField(IField field) {
|
||||
if (field != null)
|
||||
valueStack.push(getUnknownValue(field.FieldSig.Type));
|
||||
else
|
||||
valueStack.pushUnknown();
|
||||
}
|
||||
|
|
|
|||
|
|
@ -527,14 +527,18 @@ namespace de4dot.code {
|
|||
|
||||
Log.v("Deobfuscating methods");
|
||||
var methodPrinter = new MethodPrinter();
|
||||
#if PORT
|
||||
var cflowDeobfuscator = new BlocksCflowDeobfuscator(deob.BlocksDeobfuscators);
|
||||
#endif
|
||||
foreach (var method in getAllMethods()) {
|
||||
Log.v("Deobfuscating {0} ({1:X8})", Utils.removeNewlines(method), method.MetadataToken.ToUInt32());
|
||||
Log.indent();
|
||||
|
||||
int oldIndentLevel = Log.indentLevel;
|
||||
try {
|
||||
#if PORT
|
||||
deobfuscate(method, cflowDeobfuscator, methodPrinter);
|
||||
#endif
|
||||
}
|
||||
catch (ApplicationException) {
|
||||
throw;
|
||||
|
|
@ -569,6 +573,7 @@ namespace de4dot.code {
|
|||
}
|
||||
}
|
||||
|
||||
#if PORT
|
||||
void deobfuscate(MethodDefinition method, BlocksCflowDeobfuscator cflowDeobfuscator, MethodPrinter methodPrinter) {
|
||||
if (!hasNonEmptyBody(method))
|
||||
return;
|
||||
|
|
@ -613,6 +618,7 @@ namespace de4dot.code {
|
|||
Log.deIndent();
|
||||
}
|
||||
}
|
||||
#endif
|
||||
|
||||
bool hasNonEmptyBody(MethodDefinition method) {
|
||||
return method.HasBody && method.Body.Instructions.Count > 0;
|
||||
|
|
@ -726,9 +732,11 @@ namespace de4dot.code {
|
|||
return;
|
||||
|
||||
deobfuscate(method, "Deobfuscating control flow", (blocks) => {
|
||||
#if PORT
|
||||
var cflowDeobfuscator = new BlocksCflowDeobfuscator(deob.BlocksDeobfuscators);
|
||||
cflowDeobfuscator.init(blocks);
|
||||
cflowDeobfuscator.deobfuscate();
|
||||
#endif
|
||||
});
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -57,166 +57,166 @@
|
|||
<Compile Include="AssemblyResolver.cs" />
|
||||
<Compile Include="DeobfuscatorContext.cs" />
|
||||
<Compile Include="deobfuscators\ArrayFinder.cs" />
|
||||
<Compile Include="deobfuscators\Babel_NET\AssemblyResolver.cs" />
|
||||
<Compile Include="deobfuscators\Babel_NET\BabelInflater.cs" />
|
||||
<Compile Include="deobfuscators\Babel_NET\BabelMethodCallInliner.cs" />
|
||||
<Compile Include="deobfuscators\Babel_NET\BabelUtils.cs" />
|
||||
<Compile Include="deobfuscators\Babel_NET\ConstantsDecrypter.cs" />
|
||||
<Compile Include="deobfuscators\Babel_NET\Deobfuscator.cs" />
|
||||
<Compile Include="deobfuscators\Babel_NET\ImageReader.cs" />
|
||||
<Compile Include="deobfuscators\Babel_NET\InflaterCreator.cs" />
|
||||
<Compile Include="deobfuscators\Babel_NET\MemberReferenceConverter.cs" />
|
||||
<Compile Include="deobfuscators\Babel_NET\MethodBodyReader.cs" />
|
||||
<Compile Include="deobfuscators\Babel_NET\MethodReferenceReader.cs" />
|
||||
<Compile Include="deobfuscators\Babel_NET\MethodsDecrypter.cs" />
|
||||
<Compile Include="deobfuscators\Babel_NET\ProxyCallFixer.cs" />
|
||||
<Compile Include="deobfuscators\Babel_NET\ResourceDecrypter.cs" />
|
||||
<Compile Include="deobfuscators\Babel_NET\ResourceResolver.cs" />
|
||||
<Compile Include="deobfuscators\Babel_NET\StringDecrypter.cs" />
|
||||
<None Include="deobfuscators\Babel_NET\AssemblyResolver.cs" />
|
||||
<None Include="deobfuscators\Babel_NET\BabelInflater.cs" />
|
||||
<None Include="deobfuscators\Babel_NET\BabelMethodCallInliner.cs" />
|
||||
<None Include="deobfuscators\Babel_NET\BabelUtils.cs" />
|
||||
<None Include="deobfuscators\Babel_NET\ConstantsDecrypter.cs" />
|
||||
<None Include="deobfuscators\Babel_NET\Deobfuscator.cs" />
|
||||
<None Include="deobfuscators\Babel_NET\ImageReader.cs" />
|
||||
<None Include="deobfuscators\Babel_NET\InflaterCreator.cs" />
|
||||
<None Include="deobfuscators\Babel_NET\MemberReferenceConverter.cs" />
|
||||
<None Include="deobfuscators\Babel_NET\MethodBodyReader.cs" />
|
||||
<None Include="deobfuscators\Babel_NET\MethodReferenceReader.cs" />
|
||||
<None Include="deobfuscators\Babel_NET\MethodsDecrypter.cs" />
|
||||
<None Include="deobfuscators\Babel_NET\ProxyCallFixer.cs" />
|
||||
<None Include="deobfuscators\Babel_NET\ResourceDecrypter.cs" />
|
||||
<None Include="deobfuscators\Babel_NET\ResourceResolver.cs" />
|
||||
<None Include="deobfuscators\Babel_NET\StringDecrypter.cs" />
|
||||
<Compile Include="deobfuscators\Blowfish.cs" />
|
||||
<Compile Include="deobfuscators\CliSecure\CliSecureRtType.cs" />
|
||||
<Compile Include="deobfuscators\CliSecure\CsBlowfish.cs" />
|
||||
<Compile Include="deobfuscators\CliSecure\Deobfuscator.cs" />
|
||||
<Compile Include="deobfuscators\CliSecure\MethodsDecrypter.cs" />
|
||||
<Compile Include="deobfuscators\CliSecure\ProxyCallFixer.cs" />
|
||||
<Compile Include="deobfuscators\CliSecure\ResourceDecrypter.cs" />
|
||||
<Compile Include="deobfuscators\CliSecure\StackFrameHelper.cs" />
|
||||
<Compile Include="deobfuscators\CliSecure\StringDecrypter.cs" />
|
||||
<Compile Include="deobfuscators\CliSecure\vm\CilOperandInstructionRestorer.cs" />
|
||||
<Compile Include="deobfuscators\CliSecure\vm\Csvm.cs" />
|
||||
<Compile Include="deobfuscators\CliSecure\vm\CsvmDataReader.cs" />
|
||||
<Compile Include="deobfuscators\CliSecure\vm\CsvmMethodData.cs" />
|
||||
<Compile Include="deobfuscators\CliSecure\vm\CsvmToCilMethodConverter.cs" />
|
||||
<Compile Include="deobfuscators\CliSecure\vm\FieldsInfo.cs" />
|
||||
<Compile Include="deobfuscators\CliSecure\vm\OpCodeHandler.cs" />
|
||||
<Compile Include="deobfuscators\CliSecure\vm\OpCodeHandlers.cs" />
|
||||
<Compile Include="deobfuscators\CliSecure\vm\UnknownHandlerInfo.cs" />
|
||||
<Compile Include="deobfuscators\CliSecure\vm\VmOpCodeHandlerDetector.cs" />
|
||||
<Compile Include="deobfuscators\CliSecure\vm\VmOperands.cs" />
|
||||
<Compile Include="deobfuscators\CodeFort\AssemblyData.cs" />
|
||||
<Compile Include="deobfuscators\CodeFort\AssemblyDecrypter.cs" />
|
||||
<Compile Include="deobfuscators\CodeFort\CfMethodCallInliner.cs" />
|
||||
<Compile Include="deobfuscators\CodeFort\Deobfuscator.cs" />
|
||||
<Compile Include="deobfuscators\CodeFort\PasswordFinder.cs" />
|
||||
<Compile Include="deobfuscators\CodeFort\ProxyCallFixer.cs" />
|
||||
<Compile Include="deobfuscators\CodeFort\StringDecrypter.cs" />
|
||||
<Compile Include="deobfuscators\CodeVeil\AssemblyResolver.cs" />
|
||||
<Compile Include="deobfuscators\CodeVeil\Deobfuscator.cs" />
|
||||
<Compile Include="deobfuscators\CodeVeil\ErexResourceReader.cs" />
|
||||
<Compile Include="deobfuscators\CodeVeil\InvalidDataException.cs" />
|
||||
<Compile Include="deobfuscators\CodeVeil\InvalidMethodsFinder.cs" />
|
||||
<Compile Include="deobfuscators\CodeVeil\MainType.cs" />
|
||||
<Compile Include="deobfuscators\CodeVeil\MethodsDecrypter.cs" />
|
||||
<Compile Include="deobfuscators\CodeVeil\ObfuscatorVersion.cs" />
|
||||
<Compile Include="deobfuscators\CodeVeil\ProxyCallFixer.cs" />
|
||||
<Compile Include="deobfuscators\CodeVeil\ResourceConverter.cs" />
|
||||
<Compile Include="deobfuscators\CodeVeil\ResourceDecrypter.cs" />
|
||||
<Compile Include="deobfuscators\CodeVeil\ResourceInfo.cs" />
|
||||
<Compile Include="deobfuscators\CodeVeil\ResourceReader.cs" />
|
||||
<Compile Include="deobfuscators\CodeVeil\StringDecrypter.cs" />
|
||||
<Compile Include="deobfuscators\CodeVeil\TamperDetection.cs" />
|
||||
<Compile Include="deobfuscators\CodeWall\AssemblyDecrypter.cs" />
|
||||
<Compile Include="deobfuscators\CodeWall\Deobfuscator.cs" />
|
||||
<Compile Include="deobfuscators\CodeWall\KeyGenerator.cs" />
|
||||
<Compile Include="deobfuscators\CodeWall\MethodsDecrypter.cs" />
|
||||
<Compile Include="deobfuscators\CodeWall\randomc\CRandomMersenne.cs" />
|
||||
<Compile Include="deobfuscators\CodeWall\randomc\CRandomMother.cs" />
|
||||
<Compile Include="deobfuscators\CodeWall\StringDecrypter.cs" />
|
||||
<None Include="deobfuscators\CliSecure\CliSecureRtType.cs" />
|
||||
<None Include="deobfuscators\CliSecure\CsBlowfish.cs" />
|
||||
<None Include="deobfuscators\CliSecure\Deobfuscator.cs" />
|
||||
<None Include="deobfuscators\CliSecure\MethodsDecrypter.cs" />
|
||||
<None Include="deobfuscators\CliSecure\ProxyCallFixer.cs" />
|
||||
<None Include="deobfuscators\CliSecure\ResourceDecrypter.cs" />
|
||||
<None Include="deobfuscators\CliSecure\StackFrameHelper.cs" />
|
||||
<None Include="deobfuscators\CliSecure\StringDecrypter.cs" />
|
||||
<None Include="deobfuscators\CliSecure\vm\CilOperandInstructionRestorer.cs" />
|
||||
<None Include="deobfuscators\CliSecure\vm\Csvm.cs" />
|
||||
<None Include="deobfuscators\CliSecure\vm\CsvmDataReader.cs" />
|
||||
<None Include="deobfuscators\CliSecure\vm\CsvmMethodData.cs" />
|
||||
<None Include="deobfuscators\CliSecure\vm\CsvmToCilMethodConverter.cs" />
|
||||
<None Include="deobfuscators\CliSecure\vm\FieldsInfo.cs" />
|
||||
<None Include="deobfuscators\CliSecure\vm\OpCodeHandler.cs" />
|
||||
<None Include="deobfuscators\CliSecure\vm\OpCodeHandlers.cs" />
|
||||
<None Include="deobfuscators\CliSecure\vm\UnknownHandlerInfo.cs" />
|
||||
<None Include="deobfuscators\CliSecure\vm\VmOpCodeHandlerDetector.cs" />
|
||||
<None Include="deobfuscators\CliSecure\vm\VmOperands.cs" />
|
||||
<None Include="deobfuscators\CodeFort\AssemblyData.cs" />
|
||||
<None Include="deobfuscators\CodeFort\AssemblyDecrypter.cs" />
|
||||
<None Include="deobfuscators\CodeFort\CfMethodCallInliner.cs" />
|
||||
<None Include="deobfuscators\CodeFort\Deobfuscator.cs" />
|
||||
<None Include="deobfuscators\CodeFort\PasswordFinder.cs" />
|
||||
<None Include="deobfuscators\CodeFort\ProxyCallFixer.cs" />
|
||||
<None Include="deobfuscators\CodeFort\StringDecrypter.cs" />
|
||||
<None Include="deobfuscators\CodeVeil\AssemblyResolver.cs" />
|
||||
<None Include="deobfuscators\CodeVeil\Deobfuscator.cs" />
|
||||
<None Include="deobfuscators\CodeVeil\ErexResourceReader.cs" />
|
||||
<None Include="deobfuscators\CodeVeil\InvalidDataException.cs" />
|
||||
<None Include="deobfuscators\CodeVeil\InvalidMethodsFinder.cs" />
|
||||
<None Include="deobfuscators\CodeVeil\MainType.cs" />
|
||||
<None Include="deobfuscators\CodeVeil\MethodsDecrypter.cs" />
|
||||
<None Include="deobfuscators\CodeVeil\ObfuscatorVersion.cs" />
|
||||
<None Include="deobfuscators\CodeVeil\ProxyCallFixer.cs" />
|
||||
<None Include="deobfuscators\CodeVeil\ResourceConverter.cs" />
|
||||
<None Include="deobfuscators\CodeVeil\ResourceDecrypter.cs" />
|
||||
<None Include="deobfuscators\CodeVeil\ResourceInfo.cs" />
|
||||
<None Include="deobfuscators\CodeVeil\ResourceReader.cs" />
|
||||
<None Include="deobfuscators\CodeVeil\StringDecrypter.cs" />
|
||||
<None Include="deobfuscators\CodeVeil\TamperDetection.cs" />
|
||||
<None Include="deobfuscators\CodeWall\AssemblyDecrypter.cs" />
|
||||
<None Include="deobfuscators\CodeWall\Deobfuscator.cs" />
|
||||
<None Include="deobfuscators\CodeWall\KeyGenerator.cs" />
|
||||
<None Include="deobfuscators\CodeWall\MethodsDecrypter.cs" />
|
||||
<None Include="deobfuscators\CodeWall\randomc\CRandomMersenne.cs" />
|
||||
<None Include="deobfuscators\CodeWall\randomc\CRandomMother.cs" />
|
||||
<None Include="deobfuscators\CodeWall\StringDecrypter.cs" />
|
||||
<Compile Include="deobfuscators\ConstantsReader.cs" />
|
||||
<Compile Include="deobfuscators\CryptoObfuscator\AntiDebugger.cs" />
|
||||
<Compile Include="deobfuscators\CryptoObfuscator\AssemblyResolver.cs" />
|
||||
<Compile Include="deobfuscators\CryptoObfuscator\ConstantsDecrypter.cs" />
|
||||
<Compile Include="deobfuscators\CryptoObfuscator\CoUtils.cs" />
|
||||
<Compile Include="deobfuscators\CryptoObfuscator\Deobfuscator.cs" />
|
||||
<Compile Include="deobfuscators\CryptoObfuscator\MethodBodyReader.cs" />
|
||||
<Compile Include="deobfuscators\CryptoObfuscator\MethodsDecrypter.cs" />
|
||||
<Compile Include="deobfuscators\CryptoObfuscator\ProxyCallFixer.cs" />
|
||||
<Compile Include="deobfuscators\CryptoObfuscator\ResourceDecrypter.cs" />
|
||||
<Compile Include="deobfuscators\CryptoObfuscator\ResourceResolver.cs" />
|
||||
<Compile Include="deobfuscators\CryptoObfuscator\StringDecrypter.cs" />
|
||||
<Compile Include="deobfuscators\CryptoObfuscator\TamperDetection.cs" />
|
||||
<Compile Include="deobfuscators\DeepSea\ArrayBlockDeobfuscator.cs" />
|
||||
<Compile Include="deobfuscators\DeepSea\ArrayBlockState.cs" />
|
||||
<Compile Include="deobfuscators\DeepSea\AssemblyResolver.cs" />
|
||||
<Compile Include="deobfuscators\DeepSea\CastDeobfuscator.cs" />
|
||||
<Compile Include="deobfuscators\DeepSea\Deobfuscator.cs" />
|
||||
<Compile Include="deobfuscators\DeepSea\DsConstantsReader.cs" />
|
||||
<Compile Include="deobfuscators\DeepSea\DsInlinedMethodsFinder.cs" />
|
||||
<Compile Include="deobfuscators\DeepSea\DsMethodCallInliner.cs" />
|
||||
<Compile Include="deobfuscators\DeepSea\DsUtils.cs" />
|
||||
<Compile Include="deobfuscators\DeepSea\FieldsRestorer.cs" />
|
||||
<Compile Include="deobfuscators\DeepSea\ResolverBase.cs" />
|
||||
<Compile Include="deobfuscators\DeepSea\ResourceResolver.cs" />
|
||||
<Compile Include="deobfuscators\DeepSea\StringDecrypter.cs" />
|
||||
<None Include="deobfuscators\CryptoObfuscator\AntiDebugger.cs" />
|
||||
<None Include="deobfuscators\CryptoObfuscator\AssemblyResolver.cs" />
|
||||
<None Include="deobfuscators\CryptoObfuscator\ConstantsDecrypter.cs" />
|
||||
<None Include="deobfuscators\CryptoObfuscator\CoUtils.cs" />
|
||||
<None Include="deobfuscators\CryptoObfuscator\Deobfuscator.cs" />
|
||||
<None Include="deobfuscators\CryptoObfuscator\MethodBodyReader.cs" />
|
||||
<None Include="deobfuscators\CryptoObfuscator\MethodsDecrypter.cs" />
|
||||
<None Include="deobfuscators\CryptoObfuscator\ProxyCallFixer.cs" />
|
||||
<None Include="deobfuscators\CryptoObfuscator\ResourceDecrypter.cs" />
|
||||
<None Include="deobfuscators\CryptoObfuscator\ResourceResolver.cs" />
|
||||
<None Include="deobfuscators\CryptoObfuscator\StringDecrypter.cs" />
|
||||
<None Include="deobfuscators\CryptoObfuscator\TamperDetection.cs" />
|
||||
<None Include="deobfuscators\DeepSea\ArrayBlockDeobfuscator.cs" />
|
||||
<None Include="deobfuscators\DeepSea\ArrayBlockState.cs" />
|
||||
<None Include="deobfuscators\DeepSea\AssemblyResolver.cs" />
|
||||
<None Include="deobfuscators\DeepSea\CastDeobfuscator.cs" />
|
||||
<None Include="deobfuscators\DeepSea\Deobfuscator.cs" />
|
||||
<None Include="deobfuscators\DeepSea\DsConstantsReader.cs" />
|
||||
<None Include="deobfuscators\DeepSea\DsInlinedMethodsFinder.cs" />
|
||||
<None Include="deobfuscators\DeepSea\DsMethodCallInliner.cs" />
|
||||
<None Include="deobfuscators\DeepSea\DsUtils.cs" />
|
||||
<None Include="deobfuscators\DeepSea\FieldsRestorer.cs" />
|
||||
<None Include="deobfuscators\DeepSea\ResolverBase.cs" />
|
||||
<None Include="deobfuscators\DeepSea\ResourceResolver.cs" />
|
||||
<None Include="deobfuscators\DeepSea\StringDecrypter.cs" />
|
||||
<Compile Include="deobfuscators\DeobfuscatorBase.cs" />
|
||||
<Compile Include="deobfuscators\DeobfuscatorInfoBase.cs" />
|
||||
<Compile Include="deobfuscators\DeobUtils.cs" />
|
||||
<Compile Include="deobfuscators\Dotfuscator\Deobfuscator.cs" />
|
||||
<Compile Include="deobfuscators\Dotfuscator\StringDecrypter.cs" />
|
||||
<Compile Include="deobfuscators\dotNET_Reactor\v3\AntiStrongName.cs" />
|
||||
<Compile Include="deobfuscators\dotNET_Reactor\v3\ApplicationModeDecrypter.cs" />
|
||||
<Compile Include="deobfuscators\dotNET_Reactor\v3\ApplicationModeUnpacker.cs" />
|
||||
<Compile Include="deobfuscators\dotNET_Reactor\v3\AssemblyResolver.cs" />
|
||||
<Compile Include="deobfuscators\dotNET_Reactor\v3\DecrypterType.cs" />
|
||||
<Compile Include="deobfuscators\dotNET_Reactor\v3\DecryptMethod.cs" />
|
||||
<Compile Include="deobfuscators\dotNET_Reactor\v3\Deobfuscator.cs" />
|
||||
<Compile Include="deobfuscators\dotNET_Reactor\v3\LibAssemblyResolver.cs" />
|
||||
<Compile Include="deobfuscators\dotNET_Reactor\v3\MemoryPatcher.cs" />
|
||||
<Compile Include="deobfuscators\dotNET_Reactor\v3\NativeLibSaver.cs" />
|
||||
<Compile Include="deobfuscators\dotNET_Reactor\v4\AntiStrongName.cs" />
|
||||
<Compile Include="deobfuscators\dotNET_Reactor\v4\AssemblyResolver.cs" />
|
||||
<Compile Include="deobfuscators\dotNET_Reactor\v4\BooleanDecrypter.cs" />
|
||||
<Compile Include="deobfuscators\dotNET_Reactor\v4\Deobfuscator.cs" />
|
||||
<Compile Include="deobfuscators\dotNET_Reactor\v4\EmptyClass.cs" />
|
||||
<Compile Include="deobfuscators\dotNET_Reactor\v4\EncryptedResource.cs" />
|
||||
<Compile Include="deobfuscators\dotNET_Reactor\v4\MetadataTokenObfuscator.cs" />
|
||||
<Compile Include="deobfuscators\dotNET_Reactor\v4\MethodsDecrypter.cs" />
|
||||
<Compile Include="deobfuscators\dotNET_Reactor\v4\NativeFileDecrypter.cs" />
|
||||
<Compile Include="deobfuscators\dotNET_Reactor\v4\NativeImageUnpacker.cs" />
|
||||
<Compile Include="deobfuscators\dotNET_Reactor\v4\ProxyCallFixer.cs" />
|
||||
<Compile Include="deobfuscators\dotNET_Reactor\v4\ResourceResolver.cs" />
|
||||
<Compile Include="deobfuscators\dotNET_Reactor\v4\StringDecrypter.cs" />
|
||||
<Compile Include="deobfuscators\Eazfuscator_NET\AssemblyResolver.cs" />
|
||||
<Compile Include="deobfuscators\Eazfuscator_NET\CodeCompilerMethodCallRestorer.cs" />
|
||||
<Compile Include="deobfuscators\Eazfuscator_NET\DecrypterType.cs" />
|
||||
<Compile Include="deobfuscators\Eazfuscator_NET\Deobfuscator.cs" />
|
||||
<Compile Include="deobfuscators\Eazfuscator_NET\EfConstantsReader.cs" />
|
||||
<Compile Include="deobfuscators\Eazfuscator_NET\EfUtils.cs" />
|
||||
<Compile Include="deobfuscators\Eazfuscator_NET\ResourceMethodsRestorer.cs" />
|
||||
<Compile Include="deobfuscators\Eazfuscator_NET\ResourceResolver.cs" />
|
||||
<Compile Include="deobfuscators\Eazfuscator_NET\StringDecrypter.cs" />
|
||||
<Compile Include="deobfuscators\Eazfuscator_NET\VersionDetector.cs" />
|
||||
<None Include="deobfuscators\Dotfuscator\Deobfuscator.cs" />
|
||||
<None Include="deobfuscators\Dotfuscator\StringDecrypter.cs" />
|
||||
<None Include="deobfuscators\dotNET_Reactor\v3\AntiStrongName.cs" />
|
||||
<None Include="deobfuscators\dotNET_Reactor\v3\ApplicationModeDecrypter.cs" />
|
||||
<None Include="deobfuscators\dotNET_Reactor\v3\ApplicationModeUnpacker.cs" />
|
||||
<None Include="deobfuscators\dotNET_Reactor\v3\AssemblyResolver.cs" />
|
||||
<None Include="deobfuscators\dotNET_Reactor\v3\DecrypterType.cs" />
|
||||
<None Include="deobfuscators\dotNET_Reactor\v3\DecryptMethod.cs" />
|
||||
<None Include="deobfuscators\dotNET_Reactor\v3\Deobfuscator.cs" />
|
||||
<None Include="deobfuscators\dotNET_Reactor\v3\LibAssemblyResolver.cs" />
|
||||
<None Include="deobfuscators\dotNET_Reactor\v3\MemoryPatcher.cs" />
|
||||
<None Include="deobfuscators\dotNET_Reactor\v3\NativeLibSaver.cs" />
|
||||
<None Include="deobfuscators\dotNET_Reactor\v4\AntiStrongName.cs" />
|
||||
<None Include="deobfuscators\dotNET_Reactor\v4\AssemblyResolver.cs" />
|
||||
<None Include="deobfuscators\dotNET_Reactor\v4\BooleanDecrypter.cs" />
|
||||
<None Include="deobfuscators\dotNET_Reactor\v4\Deobfuscator.cs" />
|
||||
<None Include="deobfuscators\dotNET_Reactor\v4\EmptyClass.cs" />
|
||||
<None Include="deobfuscators\dotNET_Reactor\v4\EncryptedResource.cs" />
|
||||
<None Include="deobfuscators\dotNET_Reactor\v4\MetadataTokenObfuscator.cs" />
|
||||
<None Include="deobfuscators\dotNET_Reactor\v4\MethodsDecrypter.cs" />
|
||||
<None Include="deobfuscators\dotNET_Reactor\v4\NativeFileDecrypter.cs" />
|
||||
<None Include="deobfuscators\dotNET_Reactor\v4\NativeImageUnpacker.cs" />
|
||||
<None Include="deobfuscators\dotNET_Reactor\v4\ProxyCallFixer.cs" />
|
||||
<None Include="deobfuscators\dotNET_Reactor\v4\ResourceResolver.cs" />
|
||||
<None Include="deobfuscators\dotNET_Reactor\v4\StringDecrypter.cs" />
|
||||
<None Include="deobfuscators\Eazfuscator_NET\AssemblyResolver.cs" />
|
||||
<None Include="deobfuscators\Eazfuscator_NET\CodeCompilerMethodCallRestorer.cs" />
|
||||
<None Include="deobfuscators\Eazfuscator_NET\DecrypterType.cs" />
|
||||
<None Include="deobfuscators\Eazfuscator_NET\Deobfuscator.cs" />
|
||||
<None Include="deobfuscators\Eazfuscator_NET\EfConstantsReader.cs" />
|
||||
<None Include="deobfuscators\Eazfuscator_NET\EfUtils.cs" />
|
||||
<None Include="deobfuscators\Eazfuscator_NET\ResourceMethodsRestorer.cs" />
|
||||
<None Include="deobfuscators\Eazfuscator_NET\ResourceResolver.cs" />
|
||||
<None Include="deobfuscators\Eazfuscator_NET\StringDecrypter.cs" />
|
||||
<None Include="deobfuscators\Eazfuscator_NET\VersionDetector.cs" />
|
||||
<Compile Include="deobfuscators\ExceptionLoggerRemover.cs" />
|
||||
<Compile Include="deobfuscators\Goliath_NET\ArrayDecrypter.cs" />
|
||||
<Compile Include="deobfuscators\Goliath_NET\ArrayValueInliner.cs" />
|
||||
<Compile Include="deobfuscators\Goliath_NET\DecrypterBase.cs" />
|
||||
<Compile Include="deobfuscators\Goliath_NET\Deobfuscator.cs" />
|
||||
<Compile Include="deobfuscators\Goliath_NET\IntegerDecrypter.cs" />
|
||||
<Compile Include="deobfuscators\Goliath_NET\LocalsRestorer.cs" />
|
||||
<Compile Include="deobfuscators\Goliath_NET\LogicalExpressionFixer.cs" />
|
||||
<Compile Include="deobfuscators\Goliath_NET\ProxyCallFixer.cs" />
|
||||
<Compile Include="deobfuscators\Goliath_NET\StringDecrypter.cs" />
|
||||
<Compile Include="deobfuscators\Goliath_NET\StrongNameChecker.cs" />
|
||||
<None Include="deobfuscators\Goliath_NET\ArrayDecrypter.cs" />
|
||||
<None Include="deobfuscators\Goliath_NET\ArrayValueInliner.cs" />
|
||||
<None Include="deobfuscators\Goliath_NET\DecrypterBase.cs" />
|
||||
<None Include="deobfuscators\Goliath_NET\Deobfuscator.cs" />
|
||||
<None Include="deobfuscators\Goliath_NET\IntegerDecrypter.cs" />
|
||||
<None Include="deobfuscators\Goliath_NET\LocalsRestorer.cs" />
|
||||
<None Include="deobfuscators\Goliath_NET\LogicalExpressionFixer.cs" />
|
||||
<None Include="deobfuscators\Goliath_NET\ProxyCallFixer.cs" />
|
||||
<None Include="deobfuscators\Goliath_NET\StringDecrypter.cs" />
|
||||
<None Include="deobfuscators\Goliath_NET\StrongNameChecker.cs" />
|
||||
<Compile Include="deobfuscators\IDeobfuscatedFile.cs" />
|
||||
<Compile Include="deobfuscators\IDeobfuscator.cs" />
|
||||
<Compile Include="deobfuscators\IDeobfuscatorInfo.cs" />
|
||||
<Compile Include="deobfuscators\ILProtector\Deobfuscator.cs" />
|
||||
<Compile Include="deobfuscators\ILProtector\MainType.cs" />
|
||||
<Compile Include="deobfuscators\ILProtector\MethodReader.cs" />
|
||||
<Compile Include="deobfuscators\ILProtector\MethodsDecrypter.cs" />
|
||||
<None Include="deobfuscators\ILProtector\Deobfuscator.cs" />
|
||||
<None Include="deobfuscators\ILProtector\MainType.cs" />
|
||||
<None Include="deobfuscators\ILProtector\MethodReader.cs" />
|
||||
<None Include="deobfuscators\ILProtector\MethodsDecrypter.cs" />
|
||||
<Compile Include="deobfuscators\InitializedDataCreator.cs" />
|
||||
<Compile Include="deobfuscators\InlinedMethodsFinder.cs" />
|
||||
<Compile Include="deobfuscators\ISimpleDeobfuscator.cs" />
|
||||
<Compile Include="deobfuscators\MaxtoCode\CryptDecrypter.cs" />
|
||||
<Compile Include="deobfuscators\MaxtoCode\Decrypter6.cs" />
|
||||
<Compile Include="deobfuscators\MaxtoCode\DecrypterInfo.cs" />
|
||||
<Compile Include="deobfuscators\MaxtoCode\Deobfuscator.cs" />
|
||||
<Compile Include="deobfuscators\MaxtoCode\EncryptionInfos.cs" />
|
||||
<Compile Include="deobfuscators\MaxtoCode\MainType.cs" />
|
||||
<Compile Include="deobfuscators\MaxtoCode\McKey.cs" />
|
||||
<Compile Include="deobfuscators\MaxtoCode\MethodsDecrypter.cs" />
|
||||
<Compile Include="deobfuscators\MaxtoCode\PeHeader.cs" />
|
||||
<Compile Include="deobfuscators\MaxtoCode\StringDecrypter.cs" />
|
||||
<None Include="deobfuscators\MaxtoCode\CryptDecrypter.cs" />
|
||||
<None Include="deobfuscators\MaxtoCode\Decrypter6.cs" />
|
||||
<None Include="deobfuscators\MaxtoCode\DecrypterInfo.cs" />
|
||||
<None Include="deobfuscators\MaxtoCode\Deobfuscator.cs" />
|
||||
<None Include="deobfuscators\MaxtoCode\EncryptionInfos.cs" />
|
||||
<None Include="deobfuscators\MaxtoCode\MainType.cs" />
|
||||
<None Include="deobfuscators\MaxtoCode\McKey.cs" />
|
||||
<None Include="deobfuscators\MaxtoCode\MethodsDecrypter.cs" />
|
||||
<None Include="deobfuscators\MaxtoCode\PeHeader.cs" />
|
||||
<None Include="deobfuscators\MaxtoCode\StringDecrypter.cs" />
|
||||
<Compile Include="deobfuscators\MemberReferenceBuilder.cs" />
|
||||
<Compile Include="deobfuscators\MethodBodyParser.cs" />
|
||||
<Compile Include="deobfuscators\MethodBodyReaderBase.cs" />
|
||||
|
|
@ -224,46 +224,46 @@
|
|||
<Compile Include="deobfuscators\MethodCollection.cs" />
|
||||
<Compile Include="deobfuscators\MethodsDecrypter.cs" />
|
||||
<Compile Include="deobfuscators\MethodStack.cs" />
|
||||
<Compile Include="deobfuscators\MPRESS\Deobfuscator.cs" />
|
||||
<Compile Include="deobfuscators\MPRESS\Lzmat.cs" />
|
||||
<None Include="deobfuscators\MPRESS\Deobfuscator.cs" />
|
||||
<None Include="deobfuscators\MPRESS\Lzmat.cs" />
|
||||
<Compile Include="deobfuscators\Operations.cs" />
|
||||
<Compile Include="deobfuscators\ProxyCallFixerBase.cs" />
|
||||
<Compile Include="deobfuscators\QuickLZ.cs" />
|
||||
<Compile Include="deobfuscators\RandomNameChecker.cs" />
|
||||
<Compile Include="deobfuscators\Rummage\Deobfuscator.cs" />
|
||||
<Compile Include="deobfuscators\Rummage\StringDecrypter.cs" />
|
||||
<Compile Include="deobfuscators\Skater_NET\Deobfuscator.cs" />
|
||||
<Compile Include="deobfuscators\Skater_NET\EnumClassFinder.cs" />
|
||||
<Compile Include="deobfuscators\Skater_NET\StringDecrypter.cs" />
|
||||
<Compile Include="deobfuscators\SmartAssembly\AssemblyResolver.cs" />
|
||||
<Compile Include="deobfuscators\SmartAssembly\AssemblyResolverInfo.cs" />
|
||||
<Compile Include="deobfuscators\SmartAssembly\AutomatedErrorReportingFinder.cs" />
|
||||
<Compile Include="deobfuscators\SmartAssembly\Deobfuscator.cs" />
|
||||
<Compile Include="deobfuscators\SmartAssembly\MemoryManagerInfo.cs" />
|
||||
<Compile Include="deobfuscators\SmartAssembly\ProxyCallFixer.cs" />
|
||||
<Compile Include="deobfuscators\SmartAssembly\ResolverInfoBase.cs" />
|
||||
<Compile Include="deobfuscators\SmartAssembly\ResourceDecrypter.cs" />
|
||||
<Compile Include="deobfuscators\SmartAssembly\ResourceDecrypterInfo.cs" />
|
||||
<Compile Include="deobfuscators\SmartAssembly\ResourceResolver.cs" />
|
||||
<Compile Include="deobfuscators\SmartAssembly\ResourceResolverInfo.cs" />
|
||||
<Compile Include="deobfuscators\SmartAssembly\SimpleZipInfo.cs" />
|
||||
<Compile Include="deobfuscators\SmartAssembly\StringDecrypter.cs" />
|
||||
<Compile Include="deobfuscators\SmartAssembly\StringDecrypterInfo.cs" />
|
||||
<Compile Include="deobfuscators\SmartAssembly\StringEncoderClassFinder.cs" />
|
||||
<Compile Include="deobfuscators\SmartAssembly\TamperProtectionRemover.cs" />
|
||||
<Compile Include="deobfuscators\Spices_Net\Deobfuscator.cs" />
|
||||
<Compile Include="deobfuscators\Spices_Net\QclzDecompressor.cs" />
|
||||
<Compile Include="deobfuscators\Spices_Net\ResourceNamesRestorer.cs" />
|
||||
<Compile Include="deobfuscators\Spices_Net\SpicesMethodCallInliner.cs" />
|
||||
<Compile Include="deobfuscators\Spices_Net\StringDecrypter.cs" />
|
||||
<None Include="deobfuscators\Rummage\Deobfuscator.cs" />
|
||||
<None Include="deobfuscators\Rummage\StringDecrypter.cs" />
|
||||
<None Include="deobfuscators\Skater_NET\Deobfuscator.cs" />
|
||||
<None Include="deobfuscators\Skater_NET\EnumClassFinder.cs" />
|
||||
<None Include="deobfuscators\Skater_NET\StringDecrypter.cs" />
|
||||
<None Include="deobfuscators\SmartAssembly\AssemblyResolver.cs" />
|
||||
<None Include="deobfuscators\SmartAssembly\AssemblyResolverInfo.cs" />
|
||||
<None Include="deobfuscators\SmartAssembly\AutomatedErrorReportingFinder.cs" />
|
||||
<None Include="deobfuscators\SmartAssembly\Deobfuscator.cs" />
|
||||
<None Include="deobfuscators\SmartAssembly\MemoryManagerInfo.cs" />
|
||||
<None Include="deobfuscators\SmartAssembly\ProxyCallFixer.cs" />
|
||||
<None Include="deobfuscators\SmartAssembly\ResolverInfoBase.cs" />
|
||||
<None Include="deobfuscators\SmartAssembly\ResourceDecrypter.cs" />
|
||||
<None Include="deobfuscators\SmartAssembly\ResourceDecrypterInfo.cs" />
|
||||
<None Include="deobfuscators\SmartAssembly\ResourceResolver.cs" />
|
||||
<None Include="deobfuscators\SmartAssembly\ResourceResolverInfo.cs" />
|
||||
<None Include="deobfuscators\SmartAssembly\SimpleZipInfo.cs" />
|
||||
<None Include="deobfuscators\SmartAssembly\StringDecrypter.cs" />
|
||||
<None Include="deobfuscators\SmartAssembly\StringDecrypterInfo.cs" />
|
||||
<None Include="deobfuscators\SmartAssembly\StringEncoderClassFinder.cs" />
|
||||
<None Include="deobfuscators\SmartAssembly\TamperProtectionRemover.cs" />
|
||||
<None Include="deobfuscators\Spices_Net\Deobfuscator.cs" />
|
||||
<None Include="deobfuscators\Spices_Net\QclzDecompressor.cs" />
|
||||
<None Include="deobfuscators\Spices_Net\ResourceNamesRestorer.cs" />
|
||||
<None Include="deobfuscators\Spices_Net\SpicesMethodCallInliner.cs" />
|
||||
<None Include="deobfuscators\Spices_Net\StringDecrypter.cs" />
|
||||
<Compile Include="deobfuscators\StringCounts.cs" />
|
||||
<Compile Include="deobfuscators\TypesRestorer.cs" />
|
||||
<Compile Include="deobfuscators\Unknown\Deobfuscator.cs" />
|
||||
<Compile Include="deobfuscators\UnpackedFile.cs" />
|
||||
<Compile Include="deobfuscators\UnusedMethodsFinder.cs" />
|
||||
<Compile Include="deobfuscators\ValueInlinerBase.cs" />
|
||||
<Compile Include="deobfuscators\Xenocode\Deobfuscator.cs" />
|
||||
<Compile Include="deobfuscators\Xenocode\StringDecrypter.cs" />
|
||||
<None Include="deobfuscators\Xenocode\Deobfuscator.cs" />
|
||||
<None Include="deobfuscators\Xenocode\StringDecrypter.cs" />
|
||||
<Compile Include="ExternalAssemblies.cs" />
|
||||
<Compile Include="IDeobfuscatorContext.cs" />
|
||||
<Compile Include="IObfuscatedFile.cs" />
|
||||
|
|
@ -341,6 +341,10 @@
|
|||
<Project>{5C93C5E2-196F-4877-BF65-96FEBFCEFCA1}</Project>
|
||||
<Name>de4dot.mdecrypt</Name>
|
||||
</ProjectReference>
|
||||
<ProjectReference Include="..\dot10\src\dot10.csproj">
|
||||
<Project>{FDFC1237-143F-4919-8318-4926901F4639}</Project>
|
||||
<Name>dot10</Name>
|
||||
</ProjectReference>
|
||||
</ItemGroup>
|
||||
<Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
|
||||
<PropertyGroup>
|
||||
|
|
|
|||
|
|
@ -18,26 +18,26 @@
|
|||
*/
|
||||
|
||||
using System.Collections.Generic;
|
||||
using Mono.Cecil;
|
||||
using Mono.Cecil.Cil;
|
||||
using dot10.DotNet;
|
||||
using dot10.DotNet.Emit;
|
||||
using de4dot.blocks;
|
||||
using de4dot.blocks.cflow;
|
||||
|
||||
namespace de4dot.code.deobfuscators {
|
||||
static class ArrayFinder {
|
||||
public static List<byte[]> getArrays(MethodDefinition method) {
|
||||
public static List<byte[]> getArrays(MethodDef method) {
|
||||
return getArrays(method, null);
|
||||
}
|
||||
|
||||
public static List<byte[]> getArrays(MethodDefinition method, TypeReference arrayElemntType) {
|
||||
public static List<byte[]> getArrays(MethodDef method, IType arrayElementType) {
|
||||
var arrays = new List<byte[]>();
|
||||
var instrs = method.Body.Instructions;
|
||||
var instrs = method.CilBody.Instructions;
|
||||
for (int i = 0; i < instrs.Count; i++) {
|
||||
TypeReference type;
|
||||
IType type;
|
||||
var ary = getArray(instrs, ref i, out type);
|
||||
if (ary == null)
|
||||
break;
|
||||
if (arrayElemntType != null && !MemberReferenceHelper.compareTypes(type, arrayElemntType))
|
||||
if (arrayElementType != null && !new SigComparer().Equals(type, arrayElementType))
|
||||
continue;
|
||||
|
||||
arrays.Add(ary);
|
||||
|
|
@ -45,7 +45,7 @@ namespace de4dot.code.deobfuscators {
|
|||
return arrays;
|
||||
}
|
||||
|
||||
public static byte[] getArray(IList<Instruction> instrs, ref int index, out TypeReference type) {
|
||||
public static byte[] getArray(IList<Instruction> instrs, ref int index, out IType type) {
|
||||
for (int i = index; i < instrs.Count - 2; i++) {
|
||||
var newarr = instrs[i++];
|
||||
if (newarr.OpCode.Code != Code.Newarr)
|
||||
|
|
@ -57,12 +57,12 @@ namespace de4dot.code.deobfuscators {
|
|||
var ldtoken = instrs[i++];
|
||||
if (ldtoken.OpCode.Code != Code.Ldtoken)
|
||||
continue;
|
||||
var field = ldtoken.Operand as FieldDefinition;
|
||||
var field = ldtoken.Operand as FieldDef;
|
||||
if (field == null || field.InitialValue == null)
|
||||
continue;
|
||||
|
||||
index = i - 3;
|
||||
type = newarr.Operand as TypeReference;
|
||||
type = newarr.Operand as IType;
|
||||
return field.InitialValue;
|
||||
}
|
||||
|
||||
|
|
@ -71,14 +71,14 @@ namespace de4dot.code.deobfuscators {
|
|||
return null;
|
||||
}
|
||||
|
||||
public static byte[] getInitializedByteArray(MethodDefinition method, int arraySize) {
|
||||
public static byte[] getInitializedByteArray(MethodDef method, int arraySize) {
|
||||
int newarrIndex = findNewarr(method, arraySize);
|
||||
if (newarrIndex < 0)
|
||||
return null;
|
||||
return getInitializedByteArray(arraySize, method, ref newarrIndex);
|
||||
}
|
||||
|
||||
public static byte[] getInitializedByteArray(int arraySize, MethodDefinition method, ref int newarrIndex) {
|
||||
public static byte[] getInitializedByteArray(int arraySize, MethodDef method, ref int newarrIndex) {
|
||||
var resultValueArray = getInitializedArray(arraySize, method, ref newarrIndex, Code.Stelem_I1);
|
||||
|
||||
var resultArray = new byte[resultValueArray.Length];
|
||||
|
|
@ -91,7 +91,7 @@ namespace de4dot.code.deobfuscators {
|
|||
return resultArray;
|
||||
}
|
||||
|
||||
public static short[] getInitializedInt16Array(int arraySize, MethodDefinition method, ref int newarrIndex) {
|
||||
public static short[] getInitializedInt16Array(int arraySize, MethodDef method, ref int newarrIndex) {
|
||||
var resultValueArray = getInitializedArray(arraySize, method, ref newarrIndex, Code.Stelem_I2);
|
||||
|
||||
var resultArray = new short[resultValueArray.Length];
|
||||
|
|
@ -104,7 +104,7 @@ namespace de4dot.code.deobfuscators {
|
|||
return resultArray;
|
||||
}
|
||||
|
||||
public static int[] getInitializedInt32Array(int arraySize, MethodDefinition method, ref int newarrIndex) {
|
||||
public static int[] getInitializedInt32Array(int arraySize, MethodDef method, ref int newarrIndex) {
|
||||
var resultValueArray = getInitializedArray(arraySize, method, ref newarrIndex, Code.Stelem_I4);
|
||||
|
||||
var resultArray = new int[resultValueArray.Length];
|
||||
|
|
@ -117,7 +117,7 @@ namespace de4dot.code.deobfuscators {
|
|||
return resultArray;
|
||||
}
|
||||
|
||||
public static uint[] getInitializedUInt32Array(int arraySize, MethodDefinition method, ref int newarrIndex) {
|
||||
public static uint[] getInitializedUInt32Array(int arraySize, MethodDef method, ref int newarrIndex) {
|
||||
var resultArray = getInitializedInt32Array(arraySize, method, ref newarrIndex);
|
||||
if (resultArray == null)
|
||||
return null;
|
||||
|
|
@ -128,14 +128,14 @@ namespace de4dot.code.deobfuscators {
|
|||
return ary;
|
||||
}
|
||||
|
||||
public static Value[] getInitializedArray(int arraySize, MethodDefinition method, ref int newarrIndex, Code stelemOpCode) {
|
||||
public static Value[] getInitializedArray(int arraySize, MethodDef method, ref int newarrIndex, Code stelemOpCode) {
|
||||
var resultValueArray = new Value[arraySize];
|
||||
|
||||
var emulator = new InstructionEmulator(method);
|
||||
var theArray = new UnknownValue();
|
||||
emulator.push(theArray);
|
||||
|
||||
var instructions = method.Body.Instructions;
|
||||
var instructions = method.CilBody.Instructions;
|
||||
int i;
|
||||
for (i = newarrIndex + 1; i < instructions.Count; i++) {
|
||||
var instr = instructions[i];
|
||||
|
|
@ -183,7 +183,7 @@ done:
|
|||
return resultValueArray;
|
||||
}
|
||||
|
||||
static int findNewarr(MethodDefinition method, int arraySize) {
|
||||
static int findNewarr(MethodDef method, int arraySize) {
|
||||
for (int i = 0; ; i++) {
|
||||
int size;
|
||||
if (!findNewarr(method, ref i, out size))
|
||||
|
|
@ -193,17 +193,17 @@ done:
|
|||
}
|
||||
}
|
||||
|
||||
public static bool findNewarr(MethodDefinition method, ref int i, out int size) {
|
||||
var instructions = method.Body.Instructions;
|
||||
public static bool findNewarr(MethodDef method, ref int i, out int size) {
|
||||
var instructions = method.CilBody.Instructions;
|
||||
for (; i < instructions.Count; i++) {
|
||||
var instr = instructions[i];
|
||||
if (instr.OpCode.Code != Code.Newarr || i < 1)
|
||||
continue;
|
||||
var ldci4 = instructions[i - 1];
|
||||
if (!DotNetUtils.isLdcI4(ldci4))
|
||||
if (!ldci4.IsLdcI4())
|
||||
continue;
|
||||
|
||||
size = DotNetUtils.getLdcI4Value(ldci4);
|
||||
size = ldci4.GetLdcI4Value();
|
||||
return true;
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -95,6 +95,7 @@ namespace de4dot.code.deobfuscators {
|
|||
get { return Operations.DecryptStrings != OpDecryptString.None && staticStringInliner.InlinedAllCalls; }
|
||||
}
|
||||
|
||||
#if PORT
|
||||
public virtual IEnumerable<IBlocksDeobfuscator> BlocksDeobfuscators {
|
||||
get {
|
||||
var list = new List<IBlocksDeobfuscator>();
|
||||
|
|
@ -103,6 +104,7 @@ namespace de4dot.code.deobfuscators {
|
|||
return list;
|
||||
}
|
||||
}
|
||||
#endif
|
||||
|
||||
public DeobfuscatorBase(OptionsBase optionsBase) {
|
||||
this.optionsBase = optionsBase;
|
||||
|
|
@ -821,7 +823,7 @@ namespace de4dot.code.deobfuscators {
|
|||
return false;
|
||||
}
|
||||
|
||||
public static int toInt32(bool b) {
|
||||
protected static int toInt32(bool b) {
|
||||
return b ? 1 : 0;
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -62,7 +62,9 @@ namespace de4dot.code.deobfuscators {
|
|||
StringFeatures StringFeatures { get; }
|
||||
RenamingOptions RenamingOptions { get; }
|
||||
DecrypterType DefaultDecrypterType { get; }
|
||||
#if PORT
|
||||
IEnumerable<IBlocksDeobfuscator> BlocksDeobfuscators { get; }
|
||||
#endif
|
||||
|
||||
// This is non-null only in detect() and deobfuscateBegin().
|
||||
IDeobfuscatedFile DeobfuscatedFile { get; set; }
|
||||
|
|
|
|||
|
|
@ -37,6 +37,7 @@ namespace de4dot.cui {
|
|||
static IList<IDeobfuscatorInfo> createDeobfuscatorInfos() {
|
||||
return new List<IDeobfuscatorInfo> {
|
||||
new de4dot.code.deobfuscators.Unknown.DeobfuscatorInfo(),
|
||||
#if PORT
|
||||
new de4dot.code.deobfuscators.Babel_NET.DeobfuscatorInfo(),
|
||||
new de4dot.code.deobfuscators.CliSecure.DeobfuscatorInfo(),
|
||||
new de4dot.code.deobfuscators.CodeFort.DeobfuscatorInfo(),
|
||||
|
|
@ -57,6 +58,7 @@ namespace de4dot.cui {
|
|||
new de4dot.code.deobfuscators.SmartAssembly.DeobfuscatorInfo(),
|
||||
new de4dot.code.deobfuscators.Spices_Net.DeobfuscatorInfo(),
|
||||
new de4dot.code.deobfuscators.Xenocode.DeobfuscatorInfo(),
|
||||
#endif
|
||||
};
|
||||
}
|
||||
|
||||
|
|
|
|||
2
dot10
2
dot10
|
|
@ -1 +1 @@
|
|||
Subproject commit 80ac6ba43c0ec9a044f850422415e3d2ad795d28
|
||||
Subproject commit c7a83ee87964d694a1e87ed9feb6cbc054226295
|
||||
Loading…
Reference in New Issue
Block a user