Port .....
This commit is contained in:
parent
ee7826576c
commit
6f73696cc5
|
@ -38,29 +38,29 @@
|
||||||
<Compile Include="Block.cs" />
|
<Compile Include="Block.cs" />
|
||||||
<Compile Include="Blocks.cs" />
|
<Compile Include="Blocks.cs" />
|
||||||
<Compile Include="BlocksSorter.cs" />
|
<Compile Include="BlocksSorter.cs" />
|
||||||
<Compile Include="cflow\BlockCflowDeobfuscator.cs" />
|
<None Include="cflow\BlockCflowDeobfuscator.cs" />
|
||||||
<Compile Include="cflow\BlockDeobfuscator.cs" />
|
<None Include="cflow\BlockDeobfuscator.cs" />
|
||||||
<Compile Include="cflow\BranchEmulator.cs" />
|
<None Include="cflow\BlocksCflowDeobfuscator.cs" />
|
||||||
<Compile Include="cflow\CachedCflowDeobfuscator.cs" />
|
<None Include="cflow\BranchEmulator.cs" />
|
||||||
<Compile Include="cflow\CflowDeobfuscator.cs" />
|
<None Include="cflow\CachedCflowDeobfuscator.cs" />
|
||||||
<Compile Include="cflow\CflowUtils.cs" />
|
<None Include="cflow\CflowDeobfuscator.cs" />
|
||||||
<Compile Include="cflow\ConstantsFolder.cs" />
|
<None Include="cflow\CflowUtils.cs" />
|
||||||
<Compile Include="cflow\DeadCodeRemover.cs" />
|
<None Include="cflow\ConstantsFolder.cs" />
|
||||||
<Compile Include="cflow\DeadStoreRemover.cs" />
|
<None Include="cflow\DeadCodeRemover.cs" />
|
||||||
<Compile Include="cflow\IBlocksDeobfuscator.cs" />
|
<None Include="cflow\DeadStoreRemover.cs" />
|
||||||
<Compile Include="cflow\ICflowDeobfuscator.cs" />
|
<None Include="cflow\IBlocksDeobfuscator.cs" />
|
||||||
|
<None Include="cflow\ICflowDeobfuscator.cs" />
|
||||||
<Compile Include="cflow\InstructionEmulator.cs" />
|
<Compile Include="cflow\InstructionEmulator.cs" />
|
||||||
<Compile Include="cflow\Int32Value.cs" />
|
<Compile Include="cflow\Int32Value.cs" />
|
||||||
<Compile Include="cflow\Int64Value.cs" />
|
<Compile Include="cflow\Int64Value.cs" />
|
||||||
<Compile Include="cflow\MethodCallInliner.cs" />
|
<None Include="cflow\MethodCallInliner.cs" />
|
||||||
<Compile Include="cflow\MethodCallInlinerBase.cs" />
|
<None Include="cflow\MethodCallInlinerBase.cs" />
|
||||||
<Compile Include="cflow\Real8Value.cs" />
|
<Compile Include="cflow\Real8Value.cs" />
|
||||||
<Compile Include="cflow\StLdlocFixer.cs" />
|
<None Include="cflow\StLdlocFixer.cs" />
|
||||||
<Compile Include="cflow\SwitchCflowDeobfuscator.cs" />
|
<None Include="cflow\SwitchCflowDeobfuscator.cs" />
|
||||||
<Compile Include="cflow\Value.cs" />
|
<Compile Include="cflow\Value.cs" />
|
||||||
<Compile Include="cflow\ValueStack.cs" />
|
<Compile Include="cflow\ValueStack.cs" />
|
||||||
<Compile Include="CodeGenerator.cs" />
|
<Compile Include="CodeGenerator.cs" />
|
||||||
<Compile Include="cflow\BlocksCflowDeobfuscator.cs" />
|
|
||||||
<Compile Include="DeadBlocksRemover.cs" />
|
<Compile Include="DeadBlocksRemover.cs" />
|
||||||
<Compile Include="DotNetUtils.cs" />
|
<Compile Include="DotNetUtils.cs" />
|
||||||
<Compile Include="FilterHandlerBlock.cs" />
|
<Compile Include="FilterHandlerBlock.cs" />
|
||||||
|
@ -68,8 +68,8 @@
|
||||||
<Compile Include="HandlerBlock.cs" />
|
<Compile Include="HandlerBlock.cs" />
|
||||||
<Compile Include="Instr.cs" />
|
<Compile Include="Instr.cs" />
|
||||||
<Compile Include="InstructionListParser.cs" />
|
<Compile Include="InstructionListParser.cs" />
|
||||||
<Compile Include="MemberRefInstance.cs" />
|
|
||||||
<Compile Include="MemberReferenceHelper.cs" />
|
<Compile Include="MemberReferenceHelper.cs" />
|
||||||
|
<Compile Include="MemberRefInstance.cs" />
|
||||||
<Compile Include="MethodBlocks.cs" />
|
<Compile Include="MethodBlocks.cs" />
|
||||||
<Compile Include="PE\Cor20Header.cs" />
|
<Compile Include="PE\Cor20Header.cs" />
|
||||||
<Compile Include="PE\DataDirectory.cs" />
|
<Compile Include="PE\DataDirectory.cs" />
|
||||||
|
@ -99,6 +99,10 @@
|
||||||
<Project>{D68133BD-1E63-496E-9EDE-4FBDBF77B486}</Project>
|
<Project>{D68133BD-1E63-496E-9EDE-4FBDBF77B486}</Project>
|
||||||
<Name>Mono.Cecil</Name>
|
<Name>Mono.Cecil</Name>
|
||||||
</ProjectReference>
|
</ProjectReference>
|
||||||
|
<ProjectReference Include="..\dot10\src\dot10.csproj">
|
||||||
|
<Project>{FDFC1237-143F-4919-8318-4926901F4639}</Project>
|
||||||
|
<Name>dot10</Name>
|
||||||
|
</ProjectReference>
|
||||||
</ItemGroup>
|
</ItemGroup>
|
||||||
<ItemGroup>
|
<ItemGroup>
|
||||||
<Reference Include="System" />
|
<Reference Include="System" />
|
||||||
|
|
|
@ -19,39 +19,38 @@
|
||||||
|
|
||||||
using System;
|
using System;
|
||||||
using System.Collections.Generic;
|
using System.Collections.Generic;
|
||||||
using Mono.Cecil;
|
using dot10.DotNet;
|
||||||
using Mono.Cecil.Cil;
|
using dot10.DotNet.Emit;
|
||||||
using Mono.Cecil.Metadata;
|
|
||||||
|
|
||||||
namespace de4dot.blocks.cflow {
|
namespace de4dot.blocks.cflow {
|
||||||
public class InstructionEmulator {
|
public class InstructionEmulator {
|
||||||
ValueStack valueStack = new ValueStack();
|
ValueStack valueStack = new ValueStack();
|
||||||
Dictionary<Value, bool> protectedStackValues = new Dictionary<Value, bool>();
|
Dictionary<Value, bool> protectedStackValues = new Dictionary<Value, bool>();
|
||||||
IList<ParameterDefinition> parameterDefinitions;
|
IList<Parameter> parameterDefs;
|
||||||
IList<VariableDefinition> variableDefinitions;
|
IList<Local> localDefs;
|
||||||
List<Value> args = new List<Value>();
|
List<Value> args = new List<Value>();
|
||||||
List<Value> locals = new List<Value>();
|
List<Value> locals = new List<Value>();
|
||||||
int argBase;
|
|
||||||
|
|
||||||
MethodDefinition prev_method;
|
MethodDef prev_method;
|
||||||
List<Value> cached_args = new List<Value>();
|
List<Value> cached_args = new List<Value>();
|
||||||
List<Value> cached_locals = new List<Value>();
|
List<Value> cached_locals = new List<Value>();
|
||||||
int cached_argBase;
|
|
||||||
|
|
||||||
public InstructionEmulator() {
|
public InstructionEmulator() {
|
||||||
}
|
}
|
||||||
|
|
||||||
public InstructionEmulator(MethodDefinition method) {
|
public InstructionEmulator(MethodDef method) {
|
||||||
init(method);
|
init(method);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
#if PORT
|
||||||
public void init(Blocks blocks) {
|
public void init(Blocks blocks) {
|
||||||
init(blocks.Method);
|
init(blocks.Method);
|
||||||
}
|
}
|
||||||
|
#endif
|
||||||
|
|
||||||
public void init(MethodDefinition method) {
|
public void init(MethodDef method) {
|
||||||
this.parameterDefinitions = method.Parameters;
|
this.parameterDefs = method.Parameters;
|
||||||
this.variableDefinitions = method.Body.Variables;
|
this.localDefs = method.CilBody.LocalList;
|
||||||
valueStack.init();
|
valueStack.init();
|
||||||
protectedStackValues.Clear();
|
protectedStackValues.Clear();
|
||||||
|
|
||||||
|
@ -59,20 +58,14 @@ namespace de4dot.blocks.cflow {
|
||||||
prev_method = method;
|
prev_method = method;
|
||||||
|
|
||||||
cached_args.Clear();
|
cached_args.Clear();
|
||||||
cached_argBase = 0;
|
for (int i = 0; i < parameterDefs.Count; i++)
|
||||||
if (method.HasImplicitThis) {
|
cached_args.Add(getUnknownValue(parameterDefs[i].Type));
|
||||||
cached_argBase = 1;
|
|
||||||
cached_args.Add(new UnknownValue());
|
|
||||||
}
|
|
||||||
for (int i = 0; i < parameterDefinitions.Count; i++)
|
|
||||||
cached_args.Add(getUnknownValue(parameterDefinitions[i].ParameterType));
|
|
||||||
|
|
||||||
cached_locals.Clear();
|
cached_locals.Clear();
|
||||||
for (int i = 0; i < variableDefinitions.Count; i++)
|
for (int i = 0; i < localDefs.Count; i++)
|
||||||
cached_locals.Add(getUnknownValue(variableDefinitions[i].VariableType));
|
cached_locals.Add(getUnknownValue(localDefs[i].Type));
|
||||||
}
|
}
|
||||||
|
|
||||||
argBase = cached_argBase;
|
|
||||||
args.Clear();
|
args.Clear();
|
||||||
args.AddRange(cached_args);
|
args.AddRange(cached_args);
|
||||||
locals.Clear();
|
locals.Clear();
|
||||||
|
@ -83,10 +76,14 @@ namespace de4dot.blocks.cflow {
|
||||||
protectedStackValues[value] = true;
|
protectedStackValues[value] = true;
|
||||||
}
|
}
|
||||||
|
|
||||||
static Value getUnknownValue(TypeReference typeReference) {
|
static Value getUnknownValue(ITypeDefOrRef type) {
|
||||||
if (typeReference == null)
|
return getUnknownValue(type.ToTypeSig(false));
|
||||||
|
}
|
||||||
|
|
||||||
|
static Value getUnknownValue(TypeSig type) {
|
||||||
|
if (type == null)
|
||||||
return new UnknownValue();
|
return new UnknownValue();
|
||||||
switch (typeReference.EType) {
|
switch (type.ElementType) {
|
||||||
case ElementType.Boolean: return Int32Value.createUnknownBool();
|
case ElementType.Boolean: return Int32Value.createUnknownBool();
|
||||||
case ElementType.I1: return Int32Value.createUnknown();
|
case ElementType.I1: return Int32Value.createUnknown();
|
||||||
case ElementType.U1: return Int32Value.createUnknownUInt8();
|
case ElementType.U1: return Int32Value.createUnknownUInt8();
|
||||||
|
@ -100,13 +97,13 @@ namespace de4dot.blocks.cflow {
|
||||||
return new UnknownValue();
|
return new UnknownValue();
|
||||||
}
|
}
|
||||||
|
|
||||||
Value truncateValue(Value value, TypeReference typeReference) {
|
Value truncateValue(Value value, TypeSig type) {
|
||||||
if (typeReference == null)
|
if (type == null)
|
||||||
return value;
|
return value;
|
||||||
if (protectedStackValues.ContainsKey(value))
|
if (protectedStackValues.ContainsKey(value))
|
||||||
return value;
|
return value;
|
||||||
|
|
||||||
switch (typeReference.EType) {
|
switch (type.ElementType) {
|
||||||
case ElementType.Boolean:
|
case ElementType.Boolean:
|
||||||
if (value.isInt32())
|
if (value.isInt32())
|
||||||
return ((Int32Value)value).toBoolean();
|
return ((Int32Value)value).toBoolean();
|
||||||
|
@ -167,27 +164,22 @@ namespace de4dot.blocks.cflow {
|
||||||
return getValue(args, i);
|
return getValue(args, i);
|
||||||
}
|
}
|
||||||
|
|
||||||
int index(ParameterDefinition arg) {
|
public Value getArg(Parameter arg) {
|
||||||
return arg.Sequence;
|
return getArg(arg.Number);
|
||||||
}
|
}
|
||||||
|
|
||||||
public Value getArg(ParameterDefinition arg) {
|
TypeSig getArgType(int index) {
|
||||||
return getArg(index(arg));
|
if (0 <= index && index < parameterDefs.Count)
|
||||||
}
|
return parameterDefs[index].Type;
|
||||||
|
|
||||||
TypeReference getArgType(int index) {
|
|
||||||
index -= argBase;
|
|
||||||
if (0 <= index && index < parameterDefinitions.Count)
|
|
||||||
return parameterDefinitions[index].ParameterType;
|
|
||||||
return null;
|
return null;
|
||||||
}
|
}
|
||||||
|
|
||||||
public void setArg(ParameterDefinition arg, Value value) {
|
public void setArg(Parameter arg, Value value) {
|
||||||
setArg(index(arg), value);
|
setArg(arg.Number, value);
|
||||||
}
|
}
|
||||||
|
|
||||||
public void makeArgUnknown(ParameterDefinition arg) {
|
public void makeArgUnknown(Parameter arg) {
|
||||||
setArg(arg, getUnknownArg(index(arg)));
|
setArg(arg, getUnknownArg(arg.Number));
|
||||||
}
|
}
|
||||||
|
|
||||||
void setArg(int index, Value value) {
|
void setArg(int index, Value value) {
|
||||||
|
@ -203,26 +195,26 @@ namespace de4dot.blocks.cflow {
|
||||||
return getValue(locals, i);
|
return getValue(locals, i);
|
||||||
}
|
}
|
||||||
|
|
||||||
public Value getLocal(VariableDefinition local) {
|
public Value getLocal(Local local) {
|
||||||
return getLocal(local.Index);
|
return getLocal(local.Number);
|
||||||
}
|
}
|
||||||
|
|
||||||
public void setLocal(VariableDefinition local, Value value) {
|
public void setLocal(Local local, Value value) {
|
||||||
setLocal(local.Index, value);
|
setLocal(local.Number, value);
|
||||||
}
|
}
|
||||||
|
|
||||||
public void makeLocalUnknown(VariableDefinition local) {
|
public void makeLocalUnknown(Local local) {
|
||||||
setLocal(local.Index, getUnknownLocal(local.Index));
|
setLocal(local.Number, getUnknownLocal(local.Number));
|
||||||
}
|
}
|
||||||
|
|
||||||
void setLocal(int index, Value value) {
|
void setLocal(int index, Value value) {
|
||||||
if (0 <= index && index < locals.Count)
|
if (0 <= index && index < locals.Count)
|
||||||
locals[index] = truncateValue(value, variableDefinitions[index].VariableType);
|
locals[index] = truncateValue(value, localDefs[index].Type);
|
||||||
}
|
}
|
||||||
|
|
||||||
Value getUnknownLocal(int index) {
|
Value getUnknownLocal(int index) {
|
||||||
if (0 <= index && index < variableDefinitions.Count)
|
if (0 <= index && index < localDefs.Count)
|
||||||
return getUnknownValue(variableDefinitions[index].VariableType);
|
return getUnknownValue(localDefs[index].Type);
|
||||||
return new UnknownValue();
|
return new UnknownValue();
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -242,6 +234,7 @@ namespace de4dot.blocks.cflow {
|
||||||
return valueStack.peek();
|
return valueStack.peek();
|
||||||
}
|
}
|
||||||
|
|
||||||
|
#if PORT
|
||||||
public void emulate(IEnumerable<Instr> instructions) {
|
public void emulate(IEnumerable<Instr> instructions) {
|
||||||
foreach (var instr in instructions)
|
foreach (var instr in instructions)
|
||||||
emulate(instr.Instruction);
|
emulate(instr.Instruction);
|
||||||
|
@ -251,35 +244,36 @@ namespace de4dot.blocks.cflow {
|
||||||
for (int i = start; i < end; i++)
|
for (int i = start; i < end; i++)
|
||||||
emulate(instructions[i].Instruction);
|
emulate(instructions[i].Instruction);
|
||||||
}
|
}
|
||||||
|
#endif
|
||||||
|
|
||||||
public void emulate(Instruction instr) {
|
public void emulate(Instruction instr) {
|
||||||
switch (instr.OpCode.Code) {
|
switch (instr.OpCode.Code) {
|
||||||
case Code.Starg:
|
case Code.Starg:
|
||||||
case Code.Starg_S: emulate_Starg((ParameterDefinition)instr.Operand); break;
|
case Code.Starg_S: emulate_Starg((Parameter)instr.Operand); break;
|
||||||
case Code.Stloc:
|
case Code.Stloc:
|
||||||
case Code.Stloc_S: emulate_Stloc(((VariableDefinition)instr.Operand).Index); break;
|
case Code.Stloc_S: emulate_Stloc(((Local)instr.Operand).Number); break;
|
||||||
case Code.Stloc_0: emulate_Stloc(0); break;
|
case Code.Stloc_0: emulate_Stloc(0); break;
|
||||||
case Code.Stloc_1: emulate_Stloc(1); break;
|
case Code.Stloc_1: emulate_Stloc(1); break;
|
||||||
case Code.Stloc_2: emulate_Stloc(2); break;
|
case Code.Stloc_2: emulate_Stloc(2); break;
|
||||||
case Code.Stloc_3: emulate_Stloc(3); break;
|
case Code.Stloc_3: emulate_Stloc(3); break;
|
||||||
|
|
||||||
case Code.Ldarg:
|
case Code.Ldarg:
|
||||||
case Code.Ldarg_S: valueStack.push(getArg((ParameterDefinition)instr.Operand)); break;
|
case Code.Ldarg_S: valueStack.push(getArg((Parameter)instr.Operand)); break;
|
||||||
case Code.Ldarg_0: valueStack.push(getArg(0)); break;
|
case Code.Ldarg_0: valueStack.push(getArg(0)); break;
|
||||||
case Code.Ldarg_1: valueStack.push(getArg(1)); break;
|
case Code.Ldarg_1: valueStack.push(getArg(1)); break;
|
||||||
case Code.Ldarg_2: valueStack.push(getArg(2)); break;
|
case Code.Ldarg_2: valueStack.push(getArg(2)); break;
|
||||||
case Code.Ldarg_3: valueStack.push(getArg(3)); break;
|
case Code.Ldarg_3: valueStack.push(getArg(3)); break;
|
||||||
case Code.Ldloc:
|
case Code.Ldloc:
|
||||||
case Code.Ldloc_S: valueStack.push(getLocal((VariableDefinition)instr.Operand)); break;
|
case Code.Ldloc_S: valueStack.push(getLocal((Local)instr.Operand)); break;
|
||||||
case Code.Ldloc_0: valueStack.push(getLocal(0)); break;
|
case Code.Ldloc_0: valueStack.push(getLocal(0)); break;
|
||||||
case Code.Ldloc_1: valueStack.push(getLocal(1)); break;
|
case Code.Ldloc_1: valueStack.push(getLocal(1)); break;
|
||||||
case Code.Ldloc_2: valueStack.push(getLocal(2)); break;
|
case Code.Ldloc_2: valueStack.push(getLocal(2)); break;
|
||||||
case Code.Ldloc_3: valueStack.push(getLocal(3)); break;
|
case Code.Ldloc_3: valueStack.push(getLocal(3)); break;
|
||||||
|
|
||||||
case Code.Ldarga:
|
case Code.Ldarga:
|
||||||
case Code.Ldarga_S: emulate_Ldarga((ParameterDefinition)instr.Operand); break;
|
case Code.Ldarga_S: emulate_Ldarga((Parameter)instr.Operand); break;
|
||||||
case Code.Ldloca:
|
case Code.Ldloca:
|
||||||
case Code.Ldloca_S: emulate_Ldloca(((VariableDefinition)instr.Operand).Index); break;
|
case Code.Ldloca_S: emulate_Ldloca(((Local)instr.Operand).Number); break;
|
||||||
|
|
||||||
case Code.Dup: valueStack.copyTop(); break;
|
case Code.Dup: valueStack.copyTop(); break;
|
||||||
|
|
||||||
|
@ -369,7 +363,7 @@ namespace de4dot.blocks.cflow {
|
||||||
case Code.Ldelem_U1: valueStack.pop(2); valueStack.push(Int32Value.createUnknownUInt8()); break;
|
case Code.Ldelem_U1: valueStack.pop(2); valueStack.push(Int32Value.createUnknownUInt8()); break;
|
||||||
case Code.Ldelem_U2: valueStack.pop(2); valueStack.push(Int32Value.createUnknownUInt16()); break;
|
case Code.Ldelem_U2: valueStack.pop(2); valueStack.push(Int32Value.createUnknownUInt16()); break;
|
||||||
case Code.Ldelem_U4: valueStack.pop(2); valueStack.push(Int32Value.createUnknown()); break;
|
case Code.Ldelem_U4: valueStack.pop(2); valueStack.push(Int32Value.createUnknown()); break;
|
||||||
case Code.Ldelem_Any:valueStack.pop(2); valueStack.push(getUnknownValue(instr.Operand as TypeReference)); break;
|
case Code.Ldelem: valueStack.pop(2); valueStack.push(getUnknownValue(instr.Operand as ITypeDefOrRef)); break;
|
||||||
|
|
||||||
case Code.Ldind_I1: valueStack.pop(); valueStack.push(Int32Value.createUnknown()); break;
|
case Code.Ldind_I1: valueStack.pop(); valueStack.push(Int32Value.createUnknown()); break;
|
||||||
case Code.Ldind_I2: valueStack.pop(); valueStack.push(Int32Value.createUnknown()); break;
|
case Code.Ldind_I2: valueStack.pop(); valueStack.push(Int32Value.createUnknown()); break;
|
||||||
|
@ -457,7 +451,6 @@ namespace de4dot.blocks.cflow {
|
||||||
case Code.Mkrefany:
|
case Code.Mkrefany:
|
||||||
case Code.Newarr:
|
case Code.Newarr:
|
||||||
case Code.Newobj:
|
case Code.Newobj:
|
||||||
case Code.No:
|
|
||||||
case Code.Nop:
|
case Code.Nop:
|
||||||
case Code.Pop:
|
case Code.Pop:
|
||||||
case Code.Readonly:
|
case Code.Readonly:
|
||||||
|
@ -465,7 +458,7 @@ namespace de4dot.blocks.cflow {
|
||||||
case Code.Refanyval:
|
case Code.Refanyval:
|
||||||
case Code.Ret:
|
case Code.Ret:
|
||||||
case Code.Rethrow:
|
case Code.Rethrow:
|
||||||
case Code.Stelem_Any:
|
case Code.Stelem:
|
||||||
case Code.Stelem_I:
|
case Code.Stelem_I:
|
||||||
case Code.Stelem_I1:
|
case Code.Stelem_I1:
|
||||||
case Code.Stelem_I2:
|
case Code.Stelem_I2:
|
||||||
|
@ -486,7 +479,7 @@ namespace de4dot.blocks.cflow {
|
||||||
case Code.Stobj:
|
case Code.Stobj:
|
||||||
case Code.Stsfld:
|
case Code.Stsfld:
|
||||||
case Code.Switch:
|
case Code.Switch:
|
||||||
case Code.Tail:
|
case Code.Tailcall:
|
||||||
case Code.Throw:
|
case Code.Throw:
|
||||||
case Code.Unaligned:
|
case Code.Unaligned:
|
||||||
case Code.Volatile:
|
case Code.Volatile:
|
||||||
|
@ -498,7 +491,7 @@ namespace de4dot.blocks.cflow {
|
||||||
|
|
||||||
void updateStack(Instruction instr) {
|
void updateStack(Instruction instr) {
|
||||||
int pushes, pops;
|
int pushes, pops;
|
||||||
DotNetUtils.calculateStackUsage(instr, false, out pushes, out pops);
|
instr.CalculateStackUsage(out pushes, out pops);
|
||||||
if (pops == -1)
|
if (pops == -1)
|
||||||
valueStack.clear();
|
valueStack.clear();
|
||||||
else {
|
else {
|
||||||
|
@ -847,15 +840,15 @@ namespace de4dot.blocks.cflow {
|
||||||
valueStack.pushUnknown();
|
valueStack.pushUnknown();
|
||||||
}
|
}
|
||||||
|
|
||||||
void emulate_Starg(ParameterDefinition arg) {
|
void emulate_Starg(Parameter arg) {
|
||||||
setArg(index(arg), valueStack.pop());
|
setArg(arg.Number, valueStack.pop());
|
||||||
}
|
}
|
||||||
|
|
||||||
void emulate_Stloc(int index) {
|
void emulate_Stloc(int index) {
|
||||||
setLocal(index, valueStack.pop());
|
setLocal(index, valueStack.pop());
|
||||||
}
|
}
|
||||||
|
|
||||||
void emulate_Ldarga(ParameterDefinition arg) {
|
void emulate_Ldarga(Parameter arg) {
|
||||||
valueStack.pushUnknown();
|
valueStack.pushUnknown();
|
||||||
makeArgUnknown(arg);
|
makeArgUnknown(arg);
|
||||||
}
|
}
|
||||||
|
@ -866,19 +859,19 @@ namespace de4dot.blocks.cflow {
|
||||||
}
|
}
|
||||||
|
|
||||||
void emulate_Call(Instruction instr) {
|
void emulate_Call(Instruction instr) {
|
||||||
emulate_Call(instr, (MethodReference)instr.Operand);
|
emulate_Call(instr, (IMethod)instr.Operand);
|
||||||
}
|
}
|
||||||
|
|
||||||
void emulate_Callvirt(Instruction instr) {
|
void emulate_Callvirt(Instruction instr) {
|
||||||
emulate_Call(instr, (MethodReference)instr.Operand);
|
emulate_Call(instr, (IMethod)instr.Operand);
|
||||||
}
|
}
|
||||||
|
|
||||||
void emulate_Call(Instruction instr, MethodReference method) {
|
void emulate_Call(Instruction instr, IMethod method) {
|
||||||
int pushes, pops;
|
int pushes, pops;
|
||||||
DotNetUtils.calculateStackUsage(instr, false, out pushes, out pops);
|
instr.CalculateStackUsage(out pushes, out pops);
|
||||||
valueStack.pop(pops);
|
valueStack.pop(pops);
|
||||||
if (pushes == 1)
|
if (pushes == 1)
|
||||||
valueStack.push(getUnknownValue(method.MethodReturnType.ReturnType));
|
valueStack.push(getUnknownValue(method.MethodSig.RetType));
|
||||||
else
|
else
|
||||||
valueStack.push(pushes);
|
valueStack.push(pushes);
|
||||||
}
|
}
|
||||||
|
@ -903,16 +896,16 @@ namespace de4dot.blocks.cflow {
|
||||||
|
|
||||||
void emulate_Ldfld(Instruction instr) {
|
void emulate_Ldfld(Instruction instr) {
|
||||||
var val1 = valueStack.pop();
|
var val1 = valueStack.pop();
|
||||||
emulateLoadField(instr.Operand as FieldReference);
|
emulateLoadField(instr.Operand as IField);
|
||||||
}
|
}
|
||||||
|
|
||||||
void emulate_Ldsfld(Instruction instr) {
|
void emulate_Ldsfld(Instruction instr) {
|
||||||
emulateLoadField(instr.Operand as FieldReference);
|
emulateLoadField(instr.Operand as IField);
|
||||||
}
|
}
|
||||||
|
|
||||||
void emulateLoadField(FieldReference fieldReference) {
|
void emulateLoadField(IField field) {
|
||||||
if (fieldReference != null)
|
if (field != null)
|
||||||
valueStack.push(getUnknownValue(fieldReference.FieldType));
|
valueStack.push(getUnknownValue(field.FieldSig.Type));
|
||||||
else
|
else
|
||||||
valueStack.pushUnknown();
|
valueStack.pushUnknown();
|
||||||
}
|
}
|
||||||
|
|
|
@ -527,14 +527,18 @@ namespace de4dot.code {
|
||||||
|
|
||||||
Log.v("Deobfuscating methods");
|
Log.v("Deobfuscating methods");
|
||||||
var methodPrinter = new MethodPrinter();
|
var methodPrinter = new MethodPrinter();
|
||||||
|
#if PORT
|
||||||
var cflowDeobfuscator = new BlocksCflowDeobfuscator(deob.BlocksDeobfuscators);
|
var cflowDeobfuscator = new BlocksCflowDeobfuscator(deob.BlocksDeobfuscators);
|
||||||
|
#endif
|
||||||
foreach (var method in getAllMethods()) {
|
foreach (var method in getAllMethods()) {
|
||||||
Log.v("Deobfuscating {0} ({1:X8})", Utils.removeNewlines(method), method.MetadataToken.ToUInt32());
|
Log.v("Deobfuscating {0} ({1:X8})", Utils.removeNewlines(method), method.MetadataToken.ToUInt32());
|
||||||
Log.indent();
|
Log.indent();
|
||||||
|
|
||||||
int oldIndentLevel = Log.indentLevel;
|
int oldIndentLevel = Log.indentLevel;
|
||||||
try {
|
try {
|
||||||
|
#if PORT
|
||||||
deobfuscate(method, cflowDeobfuscator, methodPrinter);
|
deobfuscate(method, cflowDeobfuscator, methodPrinter);
|
||||||
|
#endif
|
||||||
}
|
}
|
||||||
catch (ApplicationException) {
|
catch (ApplicationException) {
|
||||||
throw;
|
throw;
|
||||||
|
@ -569,6 +573,7 @@ namespace de4dot.code {
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
#if PORT
|
||||||
void deobfuscate(MethodDefinition method, BlocksCflowDeobfuscator cflowDeobfuscator, MethodPrinter methodPrinter) {
|
void deobfuscate(MethodDefinition method, BlocksCflowDeobfuscator cflowDeobfuscator, MethodPrinter methodPrinter) {
|
||||||
if (!hasNonEmptyBody(method))
|
if (!hasNonEmptyBody(method))
|
||||||
return;
|
return;
|
||||||
|
@ -613,6 +618,7 @@ namespace de4dot.code {
|
||||||
Log.deIndent();
|
Log.deIndent();
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
#endif
|
||||||
|
|
||||||
bool hasNonEmptyBody(MethodDefinition method) {
|
bool hasNonEmptyBody(MethodDefinition method) {
|
||||||
return method.HasBody && method.Body.Instructions.Count > 0;
|
return method.HasBody && method.Body.Instructions.Count > 0;
|
||||||
|
@ -726,9 +732,11 @@ namespace de4dot.code {
|
||||||
return;
|
return;
|
||||||
|
|
||||||
deobfuscate(method, "Deobfuscating control flow", (blocks) => {
|
deobfuscate(method, "Deobfuscating control flow", (blocks) => {
|
||||||
|
#if PORT
|
||||||
var cflowDeobfuscator = new BlocksCflowDeobfuscator(deob.BlocksDeobfuscators);
|
var cflowDeobfuscator = new BlocksCflowDeobfuscator(deob.BlocksDeobfuscators);
|
||||||
cflowDeobfuscator.init(blocks);
|
cflowDeobfuscator.init(blocks);
|
||||||
cflowDeobfuscator.deobfuscate();
|
cflowDeobfuscator.deobfuscate();
|
||||||
|
#endif
|
||||||
});
|
});
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
@ -57,166 +57,166 @@
|
||||||
<Compile Include="AssemblyResolver.cs" />
|
<Compile Include="AssemblyResolver.cs" />
|
||||||
<Compile Include="DeobfuscatorContext.cs" />
|
<Compile Include="DeobfuscatorContext.cs" />
|
||||||
<Compile Include="deobfuscators\ArrayFinder.cs" />
|
<Compile Include="deobfuscators\ArrayFinder.cs" />
|
||||||
<Compile Include="deobfuscators\Babel_NET\AssemblyResolver.cs" />
|
<None Include="deobfuscators\Babel_NET\AssemblyResolver.cs" />
|
||||||
<Compile Include="deobfuscators\Babel_NET\BabelInflater.cs" />
|
<None Include="deobfuscators\Babel_NET\BabelInflater.cs" />
|
||||||
<Compile Include="deobfuscators\Babel_NET\BabelMethodCallInliner.cs" />
|
<None Include="deobfuscators\Babel_NET\BabelMethodCallInliner.cs" />
|
||||||
<Compile Include="deobfuscators\Babel_NET\BabelUtils.cs" />
|
<None Include="deobfuscators\Babel_NET\BabelUtils.cs" />
|
||||||
<Compile Include="deobfuscators\Babel_NET\ConstantsDecrypter.cs" />
|
<None Include="deobfuscators\Babel_NET\ConstantsDecrypter.cs" />
|
||||||
<Compile Include="deobfuscators\Babel_NET\Deobfuscator.cs" />
|
<None Include="deobfuscators\Babel_NET\Deobfuscator.cs" />
|
||||||
<Compile Include="deobfuscators\Babel_NET\ImageReader.cs" />
|
<None Include="deobfuscators\Babel_NET\ImageReader.cs" />
|
||||||
<Compile Include="deobfuscators\Babel_NET\InflaterCreator.cs" />
|
<None Include="deobfuscators\Babel_NET\InflaterCreator.cs" />
|
||||||
<Compile Include="deobfuscators\Babel_NET\MemberReferenceConverter.cs" />
|
<None Include="deobfuscators\Babel_NET\MemberReferenceConverter.cs" />
|
||||||
<Compile Include="deobfuscators\Babel_NET\MethodBodyReader.cs" />
|
<None Include="deobfuscators\Babel_NET\MethodBodyReader.cs" />
|
||||||
<Compile Include="deobfuscators\Babel_NET\MethodReferenceReader.cs" />
|
<None Include="deobfuscators\Babel_NET\MethodReferenceReader.cs" />
|
||||||
<Compile Include="deobfuscators\Babel_NET\MethodsDecrypter.cs" />
|
<None Include="deobfuscators\Babel_NET\MethodsDecrypter.cs" />
|
||||||
<Compile Include="deobfuscators\Babel_NET\ProxyCallFixer.cs" />
|
<None Include="deobfuscators\Babel_NET\ProxyCallFixer.cs" />
|
||||||
<Compile Include="deobfuscators\Babel_NET\ResourceDecrypter.cs" />
|
<None Include="deobfuscators\Babel_NET\ResourceDecrypter.cs" />
|
||||||
<Compile Include="deobfuscators\Babel_NET\ResourceResolver.cs" />
|
<None Include="deobfuscators\Babel_NET\ResourceResolver.cs" />
|
||||||
<Compile Include="deobfuscators\Babel_NET\StringDecrypter.cs" />
|
<None Include="deobfuscators\Babel_NET\StringDecrypter.cs" />
|
||||||
<Compile Include="deobfuscators\Blowfish.cs" />
|
<Compile Include="deobfuscators\Blowfish.cs" />
|
||||||
<Compile Include="deobfuscators\CliSecure\CliSecureRtType.cs" />
|
<None Include="deobfuscators\CliSecure\CliSecureRtType.cs" />
|
||||||
<Compile Include="deobfuscators\CliSecure\CsBlowfish.cs" />
|
<None Include="deobfuscators\CliSecure\CsBlowfish.cs" />
|
||||||
<Compile Include="deobfuscators\CliSecure\Deobfuscator.cs" />
|
<None Include="deobfuscators\CliSecure\Deobfuscator.cs" />
|
||||||
<Compile Include="deobfuscators\CliSecure\MethodsDecrypter.cs" />
|
<None Include="deobfuscators\CliSecure\MethodsDecrypter.cs" />
|
||||||
<Compile Include="deobfuscators\CliSecure\ProxyCallFixer.cs" />
|
<None Include="deobfuscators\CliSecure\ProxyCallFixer.cs" />
|
||||||
<Compile Include="deobfuscators\CliSecure\ResourceDecrypter.cs" />
|
<None Include="deobfuscators\CliSecure\ResourceDecrypter.cs" />
|
||||||
<Compile Include="deobfuscators\CliSecure\StackFrameHelper.cs" />
|
<None Include="deobfuscators\CliSecure\StackFrameHelper.cs" />
|
||||||
<Compile Include="deobfuscators\CliSecure\StringDecrypter.cs" />
|
<None Include="deobfuscators\CliSecure\StringDecrypter.cs" />
|
||||||
<Compile Include="deobfuscators\CliSecure\vm\CilOperandInstructionRestorer.cs" />
|
<None Include="deobfuscators\CliSecure\vm\CilOperandInstructionRestorer.cs" />
|
||||||
<Compile Include="deobfuscators\CliSecure\vm\Csvm.cs" />
|
<None Include="deobfuscators\CliSecure\vm\Csvm.cs" />
|
||||||
<Compile Include="deobfuscators\CliSecure\vm\CsvmDataReader.cs" />
|
<None Include="deobfuscators\CliSecure\vm\CsvmDataReader.cs" />
|
||||||
<Compile Include="deobfuscators\CliSecure\vm\CsvmMethodData.cs" />
|
<None Include="deobfuscators\CliSecure\vm\CsvmMethodData.cs" />
|
||||||
<Compile Include="deobfuscators\CliSecure\vm\CsvmToCilMethodConverter.cs" />
|
<None Include="deobfuscators\CliSecure\vm\CsvmToCilMethodConverter.cs" />
|
||||||
<Compile Include="deobfuscators\CliSecure\vm\FieldsInfo.cs" />
|
<None Include="deobfuscators\CliSecure\vm\FieldsInfo.cs" />
|
||||||
<Compile Include="deobfuscators\CliSecure\vm\OpCodeHandler.cs" />
|
<None Include="deobfuscators\CliSecure\vm\OpCodeHandler.cs" />
|
||||||
<Compile Include="deobfuscators\CliSecure\vm\OpCodeHandlers.cs" />
|
<None Include="deobfuscators\CliSecure\vm\OpCodeHandlers.cs" />
|
||||||
<Compile Include="deobfuscators\CliSecure\vm\UnknownHandlerInfo.cs" />
|
<None Include="deobfuscators\CliSecure\vm\UnknownHandlerInfo.cs" />
|
||||||
<Compile Include="deobfuscators\CliSecure\vm\VmOpCodeHandlerDetector.cs" />
|
<None Include="deobfuscators\CliSecure\vm\VmOpCodeHandlerDetector.cs" />
|
||||||
<Compile Include="deobfuscators\CliSecure\vm\VmOperands.cs" />
|
<None Include="deobfuscators\CliSecure\vm\VmOperands.cs" />
|
||||||
<Compile Include="deobfuscators\CodeFort\AssemblyData.cs" />
|
<None Include="deobfuscators\CodeFort\AssemblyData.cs" />
|
||||||
<Compile Include="deobfuscators\CodeFort\AssemblyDecrypter.cs" />
|
<None Include="deobfuscators\CodeFort\AssemblyDecrypter.cs" />
|
||||||
<Compile Include="deobfuscators\CodeFort\CfMethodCallInliner.cs" />
|
<None Include="deobfuscators\CodeFort\CfMethodCallInliner.cs" />
|
||||||
<Compile Include="deobfuscators\CodeFort\Deobfuscator.cs" />
|
<None Include="deobfuscators\CodeFort\Deobfuscator.cs" />
|
||||||
<Compile Include="deobfuscators\CodeFort\PasswordFinder.cs" />
|
<None Include="deobfuscators\CodeFort\PasswordFinder.cs" />
|
||||||
<Compile Include="deobfuscators\CodeFort\ProxyCallFixer.cs" />
|
<None Include="deobfuscators\CodeFort\ProxyCallFixer.cs" />
|
||||||
<Compile Include="deobfuscators\CodeFort\StringDecrypter.cs" />
|
<None Include="deobfuscators\CodeFort\StringDecrypter.cs" />
|
||||||
<Compile Include="deobfuscators\CodeVeil\AssemblyResolver.cs" />
|
<None Include="deobfuscators\CodeVeil\AssemblyResolver.cs" />
|
||||||
<Compile Include="deobfuscators\CodeVeil\Deobfuscator.cs" />
|
<None Include="deobfuscators\CodeVeil\Deobfuscator.cs" />
|
||||||
<Compile Include="deobfuscators\CodeVeil\ErexResourceReader.cs" />
|
<None Include="deobfuscators\CodeVeil\ErexResourceReader.cs" />
|
||||||
<Compile Include="deobfuscators\CodeVeil\InvalidDataException.cs" />
|
<None Include="deobfuscators\CodeVeil\InvalidDataException.cs" />
|
||||||
<Compile Include="deobfuscators\CodeVeil\InvalidMethodsFinder.cs" />
|
<None Include="deobfuscators\CodeVeil\InvalidMethodsFinder.cs" />
|
||||||
<Compile Include="deobfuscators\CodeVeil\MainType.cs" />
|
<None Include="deobfuscators\CodeVeil\MainType.cs" />
|
||||||
<Compile Include="deobfuscators\CodeVeil\MethodsDecrypter.cs" />
|
<None Include="deobfuscators\CodeVeil\MethodsDecrypter.cs" />
|
||||||
<Compile Include="deobfuscators\CodeVeil\ObfuscatorVersion.cs" />
|
<None Include="deobfuscators\CodeVeil\ObfuscatorVersion.cs" />
|
||||||
<Compile Include="deobfuscators\CodeVeil\ProxyCallFixer.cs" />
|
<None Include="deobfuscators\CodeVeil\ProxyCallFixer.cs" />
|
||||||
<Compile Include="deobfuscators\CodeVeil\ResourceConverter.cs" />
|
<None Include="deobfuscators\CodeVeil\ResourceConverter.cs" />
|
||||||
<Compile Include="deobfuscators\CodeVeil\ResourceDecrypter.cs" />
|
<None Include="deobfuscators\CodeVeil\ResourceDecrypter.cs" />
|
||||||
<Compile Include="deobfuscators\CodeVeil\ResourceInfo.cs" />
|
<None Include="deobfuscators\CodeVeil\ResourceInfo.cs" />
|
||||||
<Compile Include="deobfuscators\CodeVeil\ResourceReader.cs" />
|
<None Include="deobfuscators\CodeVeil\ResourceReader.cs" />
|
||||||
<Compile Include="deobfuscators\CodeVeil\StringDecrypter.cs" />
|
<None Include="deobfuscators\CodeVeil\StringDecrypter.cs" />
|
||||||
<Compile Include="deobfuscators\CodeVeil\TamperDetection.cs" />
|
<None Include="deobfuscators\CodeVeil\TamperDetection.cs" />
|
||||||
<Compile Include="deobfuscators\CodeWall\AssemblyDecrypter.cs" />
|
<None Include="deobfuscators\CodeWall\AssemblyDecrypter.cs" />
|
||||||
<Compile Include="deobfuscators\CodeWall\Deobfuscator.cs" />
|
<None Include="deobfuscators\CodeWall\Deobfuscator.cs" />
|
||||||
<Compile Include="deobfuscators\CodeWall\KeyGenerator.cs" />
|
<None Include="deobfuscators\CodeWall\KeyGenerator.cs" />
|
||||||
<Compile Include="deobfuscators\CodeWall\MethodsDecrypter.cs" />
|
<None Include="deobfuscators\CodeWall\MethodsDecrypter.cs" />
|
||||||
<Compile Include="deobfuscators\CodeWall\randomc\CRandomMersenne.cs" />
|
<None Include="deobfuscators\CodeWall\randomc\CRandomMersenne.cs" />
|
||||||
<Compile Include="deobfuscators\CodeWall\randomc\CRandomMother.cs" />
|
<None Include="deobfuscators\CodeWall\randomc\CRandomMother.cs" />
|
||||||
<Compile Include="deobfuscators\CodeWall\StringDecrypter.cs" />
|
<None Include="deobfuscators\CodeWall\StringDecrypter.cs" />
|
||||||
<Compile Include="deobfuscators\ConstantsReader.cs" />
|
<Compile Include="deobfuscators\ConstantsReader.cs" />
|
||||||
<Compile Include="deobfuscators\CryptoObfuscator\AntiDebugger.cs" />
|
<None Include="deobfuscators\CryptoObfuscator\AntiDebugger.cs" />
|
||||||
<Compile Include="deobfuscators\CryptoObfuscator\AssemblyResolver.cs" />
|
<None Include="deobfuscators\CryptoObfuscator\AssemblyResolver.cs" />
|
||||||
<Compile Include="deobfuscators\CryptoObfuscator\ConstantsDecrypter.cs" />
|
<None Include="deobfuscators\CryptoObfuscator\ConstantsDecrypter.cs" />
|
||||||
<Compile Include="deobfuscators\CryptoObfuscator\CoUtils.cs" />
|
<None Include="deobfuscators\CryptoObfuscator\CoUtils.cs" />
|
||||||
<Compile Include="deobfuscators\CryptoObfuscator\Deobfuscator.cs" />
|
<None Include="deobfuscators\CryptoObfuscator\Deobfuscator.cs" />
|
||||||
<Compile Include="deobfuscators\CryptoObfuscator\MethodBodyReader.cs" />
|
<None Include="deobfuscators\CryptoObfuscator\MethodBodyReader.cs" />
|
||||||
<Compile Include="deobfuscators\CryptoObfuscator\MethodsDecrypter.cs" />
|
<None Include="deobfuscators\CryptoObfuscator\MethodsDecrypter.cs" />
|
||||||
<Compile Include="deobfuscators\CryptoObfuscator\ProxyCallFixer.cs" />
|
<None Include="deobfuscators\CryptoObfuscator\ProxyCallFixer.cs" />
|
||||||
<Compile Include="deobfuscators\CryptoObfuscator\ResourceDecrypter.cs" />
|
<None Include="deobfuscators\CryptoObfuscator\ResourceDecrypter.cs" />
|
||||||
<Compile Include="deobfuscators\CryptoObfuscator\ResourceResolver.cs" />
|
<None Include="deobfuscators\CryptoObfuscator\ResourceResolver.cs" />
|
||||||
<Compile Include="deobfuscators\CryptoObfuscator\StringDecrypter.cs" />
|
<None Include="deobfuscators\CryptoObfuscator\StringDecrypter.cs" />
|
||||||
<Compile Include="deobfuscators\CryptoObfuscator\TamperDetection.cs" />
|
<None Include="deobfuscators\CryptoObfuscator\TamperDetection.cs" />
|
||||||
<Compile Include="deobfuscators\DeepSea\ArrayBlockDeobfuscator.cs" />
|
<None Include="deobfuscators\DeepSea\ArrayBlockDeobfuscator.cs" />
|
||||||
<Compile Include="deobfuscators\DeepSea\ArrayBlockState.cs" />
|
<None Include="deobfuscators\DeepSea\ArrayBlockState.cs" />
|
||||||
<Compile Include="deobfuscators\DeepSea\AssemblyResolver.cs" />
|
<None Include="deobfuscators\DeepSea\AssemblyResolver.cs" />
|
||||||
<Compile Include="deobfuscators\DeepSea\CastDeobfuscator.cs" />
|
<None Include="deobfuscators\DeepSea\CastDeobfuscator.cs" />
|
||||||
<Compile Include="deobfuscators\DeepSea\Deobfuscator.cs" />
|
<None Include="deobfuscators\DeepSea\Deobfuscator.cs" />
|
||||||
<Compile Include="deobfuscators\DeepSea\DsConstantsReader.cs" />
|
<None Include="deobfuscators\DeepSea\DsConstantsReader.cs" />
|
||||||
<Compile Include="deobfuscators\DeepSea\DsInlinedMethodsFinder.cs" />
|
<None Include="deobfuscators\DeepSea\DsInlinedMethodsFinder.cs" />
|
||||||
<Compile Include="deobfuscators\DeepSea\DsMethodCallInliner.cs" />
|
<None Include="deobfuscators\DeepSea\DsMethodCallInliner.cs" />
|
||||||
<Compile Include="deobfuscators\DeepSea\DsUtils.cs" />
|
<None Include="deobfuscators\DeepSea\DsUtils.cs" />
|
||||||
<Compile Include="deobfuscators\DeepSea\FieldsRestorer.cs" />
|
<None Include="deobfuscators\DeepSea\FieldsRestorer.cs" />
|
||||||
<Compile Include="deobfuscators\DeepSea\ResolverBase.cs" />
|
<None Include="deobfuscators\DeepSea\ResolverBase.cs" />
|
||||||
<Compile Include="deobfuscators\DeepSea\ResourceResolver.cs" />
|
<None Include="deobfuscators\DeepSea\ResourceResolver.cs" />
|
||||||
<Compile Include="deobfuscators\DeepSea\StringDecrypter.cs" />
|
<None Include="deobfuscators\DeepSea\StringDecrypter.cs" />
|
||||||
<Compile Include="deobfuscators\DeobfuscatorBase.cs" />
|
<Compile Include="deobfuscators\DeobfuscatorBase.cs" />
|
||||||
<Compile Include="deobfuscators\DeobfuscatorInfoBase.cs" />
|
<Compile Include="deobfuscators\DeobfuscatorInfoBase.cs" />
|
||||||
<Compile Include="deobfuscators\DeobUtils.cs" />
|
<Compile Include="deobfuscators\DeobUtils.cs" />
|
||||||
<Compile Include="deobfuscators\Dotfuscator\Deobfuscator.cs" />
|
<None Include="deobfuscators\Dotfuscator\Deobfuscator.cs" />
|
||||||
<Compile Include="deobfuscators\Dotfuscator\StringDecrypter.cs" />
|
<None Include="deobfuscators\Dotfuscator\StringDecrypter.cs" />
|
||||||
<Compile Include="deobfuscators\dotNET_Reactor\v3\AntiStrongName.cs" />
|
<None Include="deobfuscators\dotNET_Reactor\v3\AntiStrongName.cs" />
|
||||||
<Compile Include="deobfuscators\dotNET_Reactor\v3\ApplicationModeDecrypter.cs" />
|
<None Include="deobfuscators\dotNET_Reactor\v3\ApplicationModeDecrypter.cs" />
|
||||||
<Compile Include="deobfuscators\dotNET_Reactor\v3\ApplicationModeUnpacker.cs" />
|
<None Include="deobfuscators\dotNET_Reactor\v3\ApplicationModeUnpacker.cs" />
|
||||||
<Compile Include="deobfuscators\dotNET_Reactor\v3\AssemblyResolver.cs" />
|
<None Include="deobfuscators\dotNET_Reactor\v3\AssemblyResolver.cs" />
|
||||||
<Compile Include="deobfuscators\dotNET_Reactor\v3\DecrypterType.cs" />
|
<None Include="deobfuscators\dotNET_Reactor\v3\DecrypterType.cs" />
|
||||||
<Compile Include="deobfuscators\dotNET_Reactor\v3\DecryptMethod.cs" />
|
<None Include="deobfuscators\dotNET_Reactor\v3\DecryptMethod.cs" />
|
||||||
<Compile Include="deobfuscators\dotNET_Reactor\v3\Deobfuscator.cs" />
|
<None Include="deobfuscators\dotNET_Reactor\v3\Deobfuscator.cs" />
|
||||||
<Compile Include="deobfuscators\dotNET_Reactor\v3\LibAssemblyResolver.cs" />
|
<None Include="deobfuscators\dotNET_Reactor\v3\LibAssemblyResolver.cs" />
|
||||||
<Compile Include="deobfuscators\dotNET_Reactor\v3\MemoryPatcher.cs" />
|
<None Include="deobfuscators\dotNET_Reactor\v3\MemoryPatcher.cs" />
|
||||||
<Compile Include="deobfuscators\dotNET_Reactor\v3\NativeLibSaver.cs" />
|
<None Include="deobfuscators\dotNET_Reactor\v3\NativeLibSaver.cs" />
|
||||||
<Compile Include="deobfuscators\dotNET_Reactor\v4\AntiStrongName.cs" />
|
<None Include="deobfuscators\dotNET_Reactor\v4\AntiStrongName.cs" />
|
||||||
<Compile Include="deobfuscators\dotNET_Reactor\v4\AssemblyResolver.cs" />
|
<None Include="deobfuscators\dotNET_Reactor\v4\AssemblyResolver.cs" />
|
||||||
<Compile Include="deobfuscators\dotNET_Reactor\v4\BooleanDecrypter.cs" />
|
<None Include="deobfuscators\dotNET_Reactor\v4\BooleanDecrypter.cs" />
|
||||||
<Compile Include="deobfuscators\dotNET_Reactor\v4\Deobfuscator.cs" />
|
<None Include="deobfuscators\dotNET_Reactor\v4\Deobfuscator.cs" />
|
||||||
<Compile Include="deobfuscators\dotNET_Reactor\v4\EmptyClass.cs" />
|
<None Include="deobfuscators\dotNET_Reactor\v4\EmptyClass.cs" />
|
||||||
<Compile Include="deobfuscators\dotNET_Reactor\v4\EncryptedResource.cs" />
|
<None Include="deobfuscators\dotNET_Reactor\v4\EncryptedResource.cs" />
|
||||||
<Compile Include="deobfuscators\dotNET_Reactor\v4\MetadataTokenObfuscator.cs" />
|
<None Include="deobfuscators\dotNET_Reactor\v4\MetadataTokenObfuscator.cs" />
|
||||||
<Compile Include="deobfuscators\dotNET_Reactor\v4\MethodsDecrypter.cs" />
|
<None Include="deobfuscators\dotNET_Reactor\v4\MethodsDecrypter.cs" />
|
||||||
<Compile Include="deobfuscators\dotNET_Reactor\v4\NativeFileDecrypter.cs" />
|
<None Include="deobfuscators\dotNET_Reactor\v4\NativeFileDecrypter.cs" />
|
||||||
<Compile Include="deobfuscators\dotNET_Reactor\v4\NativeImageUnpacker.cs" />
|
<None Include="deobfuscators\dotNET_Reactor\v4\NativeImageUnpacker.cs" />
|
||||||
<Compile Include="deobfuscators\dotNET_Reactor\v4\ProxyCallFixer.cs" />
|
<None Include="deobfuscators\dotNET_Reactor\v4\ProxyCallFixer.cs" />
|
||||||
<Compile Include="deobfuscators\dotNET_Reactor\v4\ResourceResolver.cs" />
|
<None Include="deobfuscators\dotNET_Reactor\v4\ResourceResolver.cs" />
|
||||||
<Compile Include="deobfuscators\dotNET_Reactor\v4\StringDecrypter.cs" />
|
<None Include="deobfuscators\dotNET_Reactor\v4\StringDecrypter.cs" />
|
||||||
<Compile Include="deobfuscators\Eazfuscator_NET\AssemblyResolver.cs" />
|
<None Include="deobfuscators\Eazfuscator_NET\AssemblyResolver.cs" />
|
||||||
<Compile Include="deobfuscators\Eazfuscator_NET\CodeCompilerMethodCallRestorer.cs" />
|
<None Include="deobfuscators\Eazfuscator_NET\CodeCompilerMethodCallRestorer.cs" />
|
||||||
<Compile Include="deobfuscators\Eazfuscator_NET\DecrypterType.cs" />
|
<None Include="deobfuscators\Eazfuscator_NET\DecrypterType.cs" />
|
||||||
<Compile Include="deobfuscators\Eazfuscator_NET\Deobfuscator.cs" />
|
<None Include="deobfuscators\Eazfuscator_NET\Deobfuscator.cs" />
|
||||||
<Compile Include="deobfuscators\Eazfuscator_NET\EfConstantsReader.cs" />
|
<None Include="deobfuscators\Eazfuscator_NET\EfConstantsReader.cs" />
|
||||||
<Compile Include="deobfuscators\Eazfuscator_NET\EfUtils.cs" />
|
<None Include="deobfuscators\Eazfuscator_NET\EfUtils.cs" />
|
||||||
<Compile Include="deobfuscators\Eazfuscator_NET\ResourceMethodsRestorer.cs" />
|
<None Include="deobfuscators\Eazfuscator_NET\ResourceMethodsRestorer.cs" />
|
||||||
<Compile Include="deobfuscators\Eazfuscator_NET\ResourceResolver.cs" />
|
<None Include="deobfuscators\Eazfuscator_NET\ResourceResolver.cs" />
|
||||||
<Compile Include="deobfuscators\Eazfuscator_NET\StringDecrypter.cs" />
|
<None Include="deobfuscators\Eazfuscator_NET\StringDecrypter.cs" />
|
||||||
<Compile Include="deobfuscators\Eazfuscator_NET\VersionDetector.cs" />
|
<None Include="deobfuscators\Eazfuscator_NET\VersionDetector.cs" />
|
||||||
<Compile Include="deobfuscators\ExceptionLoggerRemover.cs" />
|
<Compile Include="deobfuscators\ExceptionLoggerRemover.cs" />
|
||||||
<Compile Include="deobfuscators\Goliath_NET\ArrayDecrypter.cs" />
|
<None Include="deobfuscators\Goliath_NET\ArrayDecrypter.cs" />
|
||||||
<Compile Include="deobfuscators\Goliath_NET\ArrayValueInliner.cs" />
|
<None Include="deobfuscators\Goliath_NET\ArrayValueInliner.cs" />
|
||||||
<Compile Include="deobfuscators\Goliath_NET\DecrypterBase.cs" />
|
<None Include="deobfuscators\Goliath_NET\DecrypterBase.cs" />
|
||||||
<Compile Include="deobfuscators\Goliath_NET\Deobfuscator.cs" />
|
<None Include="deobfuscators\Goliath_NET\Deobfuscator.cs" />
|
||||||
<Compile Include="deobfuscators\Goliath_NET\IntegerDecrypter.cs" />
|
<None Include="deobfuscators\Goliath_NET\IntegerDecrypter.cs" />
|
||||||
<Compile Include="deobfuscators\Goliath_NET\LocalsRestorer.cs" />
|
<None Include="deobfuscators\Goliath_NET\LocalsRestorer.cs" />
|
||||||
<Compile Include="deobfuscators\Goliath_NET\LogicalExpressionFixer.cs" />
|
<None Include="deobfuscators\Goliath_NET\LogicalExpressionFixer.cs" />
|
||||||
<Compile Include="deobfuscators\Goliath_NET\ProxyCallFixer.cs" />
|
<None Include="deobfuscators\Goliath_NET\ProxyCallFixer.cs" />
|
||||||
<Compile Include="deobfuscators\Goliath_NET\StringDecrypter.cs" />
|
<None Include="deobfuscators\Goliath_NET\StringDecrypter.cs" />
|
||||||
<Compile Include="deobfuscators\Goliath_NET\StrongNameChecker.cs" />
|
<None Include="deobfuscators\Goliath_NET\StrongNameChecker.cs" />
|
||||||
<Compile Include="deobfuscators\IDeobfuscatedFile.cs" />
|
<Compile Include="deobfuscators\IDeobfuscatedFile.cs" />
|
||||||
<Compile Include="deobfuscators\IDeobfuscator.cs" />
|
<Compile Include="deobfuscators\IDeobfuscator.cs" />
|
||||||
<Compile Include="deobfuscators\IDeobfuscatorInfo.cs" />
|
<Compile Include="deobfuscators\IDeobfuscatorInfo.cs" />
|
||||||
<Compile Include="deobfuscators\ILProtector\Deobfuscator.cs" />
|
<None Include="deobfuscators\ILProtector\Deobfuscator.cs" />
|
||||||
<Compile Include="deobfuscators\ILProtector\MainType.cs" />
|
<None Include="deobfuscators\ILProtector\MainType.cs" />
|
||||||
<Compile Include="deobfuscators\ILProtector\MethodReader.cs" />
|
<None Include="deobfuscators\ILProtector\MethodReader.cs" />
|
||||||
<Compile Include="deobfuscators\ILProtector\MethodsDecrypter.cs" />
|
<None Include="deobfuscators\ILProtector\MethodsDecrypter.cs" />
|
||||||
<Compile Include="deobfuscators\InitializedDataCreator.cs" />
|
<Compile Include="deobfuscators\InitializedDataCreator.cs" />
|
||||||
<Compile Include="deobfuscators\InlinedMethodsFinder.cs" />
|
<Compile Include="deobfuscators\InlinedMethodsFinder.cs" />
|
||||||
<Compile Include="deobfuscators\ISimpleDeobfuscator.cs" />
|
<Compile Include="deobfuscators\ISimpleDeobfuscator.cs" />
|
||||||
<Compile Include="deobfuscators\MaxtoCode\CryptDecrypter.cs" />
|
<None Include="deobfuscators\MaxtoCode\CryptDecrypter.cs" />
|
||||||
<Compile Include="deobfuscators\MaxtoCode\Decrypter6.cs" />
|
<None Include="deobfuscators\MaxtoCode\Decrypter6.cs" />
|
||||||
<Compile Include="deobfuscators\MaxtoCode\DecrypterInfo.cs" />
|
<None Include="deobfuscators\MaxtoCode\DecrypterInfo.cs" />
|
||||||
<Compile Include="deobfuscators\MaxtoCode\Deobfuscator.cs" />
|
<None Include="deobfuscators\MaxtoCode\Deobfuscator.cs" />
|
||||||
<Compile Include="deobfuscators\MaxtoCode\EncryptionInfos.cs" />
|
<None Include="deobfuscators\MaxtoCode\EncryptionInfos.cs" />
|
||||||
<Compile Include="deobfuscators\MaxtoCode\MainType.cs" />
|
<None Include="deobfuscators\MaxtoCode\MainType.cs" />
|
||||||
<Compile Include="deobfuscators\MaxtoCode\McKey.cs" />
|
<None Include="deobfuscators\MaxtoCode\McKey.cs" />
|
||||||
<Compile Include="deobfuscators\MaxtoCode\MethodsDecrypter.cs" />
|
<None Include="deobfuscators\MaxtoCode\MethodsDecrypter.cs" />
|
||||||
<Compile Include="deobfuscators\MaxtoCode\PeHeader.cs" />
|
<None Include="deobfuscators\MaxtoCode\PeHeader.cs" />
|
||||||
<Compile Include="deobfuscators\MaxtoCode\StringDecrypter.cs" />
|
<None Include="deobfuscators\MaxtoCode\StringDecrypter.cs" />
|
||||||
<Compile Include="deobfuscators\MemberReferenceBuilder.cs" />
|
<Compile Include="deobfuscators\MemberReferenceBuilder.cs" />
|
||||||
<Compile Include="deobfuscators\MethodBodyParser.cs" />
|
<Compile Include="deobfuscators\MethodBodyParser.cs" />
|
||||||
<Compile Include="deobfuscators\MethodBodyReaderBase.cs" />
|
<Compile Include="deobfuscators\MethodBodyReaderBase.cs" />
|
||||||
|
@ -224,46 +224,46 @@
|
||||||
<Compile Include="deobfuscators\MethodCollection.cs" />
|
<Compile Include="deobfuscators\MethodCollection.cs" />
|
||||||
<Compile Include="deobfuscators\MethodsDecrypter.cs" />
|
<Compile Include="deobfuscators\MethodsDecrypter.cs" />
|
||||||
<Compile Include="deobfuscators\MethodStack.cs" />
|
<Compile Include="deobfuscators\MethodStack.cs" />
|
||||||
<Compile Include="deobfuscators\MPRESS\Deobfuscator.cs" />
|
<None Include="deobfuscators\MPRESS\Deobfuscator.cs" />
|
||||||
<Compile Include="deobfuscators\MPRESS\Lzmat.cs" />
|
<None Include="deobfuscators\MPRESS\Lzmat.cs" />
|
||||||
<Compile Include="deobfuscators\Operations.cs" />
|
<Compile Include="deobfuscators\Operations.cs" />
|
||||||
<Compile Include="deobfuscators\ProxyCallFixerBase.cs" />
|
<Compile Include="deobfuscators\ProxyCallFixerBase.cs" />
|
||||||
<Compile Include="deobfuscators\QuickLZ.cs" />
|
<Compile Include="deobfuscators\QuickLZ.cs" />
|
||||||
<Compile Include="deobfuscators\RandomNameChecker.cs" />
|
<Compile Include="deobfuscators\RandomNameChecker.cs" />
|
||||||
<Compile Include="deobfuscators\Rummage\Deobfuscator.cs" />
|
<None Include="deobfuscators\Rummage\Deobfuscator.cs" />
|
||||||
<Compile Include="deobfuscators\Rummage\StringDecrypter.cs" />
|
<None Include="deobfuscators\Rummage\StringDecrypter.cs" />
|
||||||
<Compile Include="deobfuscators\Skater_NET\Deobfuscator.cs" />
|
<None Include="deobfuscators\Skater_NET\Deobfuscator.cs" />
|
||||||
<Compile Include="deobfuscators\Skater_NET\EnumClassFinder.cs" />
|
<None Include="deobfuscators\Skater_NET\EnumClassFinder.cs" />
|
||||||
<Compile Include="deobfuscators\Skater_NET\StringDecrypter.cs" />
|
<None Include="deobfuscators\Skater_NET\StringDecrypter.cs" />
|
||||||
<Compile Include="deobfuscators\SmartAssembly\AssemblyResolver.cs" />
|
<None Include="deobfuscators\SmartAssembly\AssemblyResolver.cs" />
|
||||||
<Compile Include="deobfuscators\SmartAssembly\AssemblyResolverInfo.cs" />
|
<None Include="deobfuscators\SmartAssembly\AssemblyResolverInfo.cs" />
|
||||||
<Compile Include="deobfuscators\SmartAssembly\AutomatedErrorReportingFinder.cs" />
|
<None Include="deobfuscators\SmartAssembly\AutomatedErrorReportingFinder.cs" />
|
||||||
<Compile Include="deobfuscators\SmartAssembly\Deobfuscator.cs" />
|
<None Include="deobfuscators\SmartAssembly\Deobfuscator.cs" />
|
||||||
<Compile Include="deobfuscators\SmartAssembly\MemoryManagerInfo.cs" />
|
<None Include="deobfuscators\SmartAssembly\MemoryManagerInfo.cs" />
|
||||||
<Compile Include="deobfuscators\SmartAssembly\ProxyCallFixer.cs" />
|
<None Include="deobfuscators\SmartAssembly\ProxyCallFixer.cs" />
|
||||||
<Compile Include="deobfuscators\SmartAssembly\ResolverInfoBase.cs" />
|
<None Include="deobfuscators\SmartAssembly\ResolverInfoBase.cs" />
|
||||||
<Compile Include="deobfuscators\SmartAssembly\ResourceDecrypter.cs" />
|
<None Include="deobfuscators\SmartAssembly\ResourceDecrypter.cs" />
|
||||||
<Compile Include="deobfuscators\SmartAssembly\ResourceDecrypterInfo.cs" />
|
<None Include="deobfuscators\SmartAssembly\ResourceDecrypterInfo.cs" />
|
||||||
<Compile Include="deobfuscators\SmartAssembly\ResourceResolver.cs" />
|
<None Include="deobfuscators\SmartAssembly\ResourceResolver.cs" />
|
||||||
<Compile Include="deobfuscators\SmartAssembly\ResourceResolverInfo.cs" />
|
<None Include="deobfuscators\SmartAssembly\ResourceResolverInfo.cs" />
|
||||||
<Compile Include="deobfuscators\SmartAssembly\SimpleZipInfo.cs" />
|
<None Include="deobfuscators\SmartAssembly\SimpleZipInfo.cs" />
|
||||||
<Compile Include="deobfuscators\SmartAssembly\StringDecrypter.cs" />
|
<None Include="deobfuscators\SmartAssembly\StringDecrypter.cs" />
|
||||||
<Compile Include="deobfuscators\SmartAssembly\StringDecrypterInfo.cs" />
|
<None Include="deobfuscators\SmartAssembly\StringDecrypterInfo.cs" />
|
||||||
<Compile Include="deobfuscators\SmartAssembly\StringEncoderClassFinder.cs" />
|
<None Include="deobfuscators\SmartAssembly\StringEncoderClassFinder.cs" />
|
||||||
<Compile Include="deobfuscators\SmartAssembly\TamperProtectionRemover.cs" />
|
<None Include="deobfuscators\SmartAssembly\TamperProtectionRemover.cs" />
|
||||||
<Compile Include="deobfuscators\Spices_Net\Deobfuscator.cs" />
|
<None Include="deobfuscators\Spices_Net\Deobfuscator.cs" />
|
||||||
<Compile Include="deobfuscators\Spices_Net\QclzDecompressor.cs" />
|
<None Include="deobfuscators\Spices_Net\QclzDecompressor.cs" />
|
||||||
<Compile Include="deobfuscators\Spices_Net\ResourceNamesRestorer.cs" />
|
<None Include="deobfuscators\Spices_Net\ResourceNamesRestorer.cs" />
|
||||||
<Compile Include="deobfuscators\Spices_Net\SpicesMethodCallInliner.cs" />
|
<None Include="deobfuscators\Spices_Net\SpicesMethodCallInliner.cs" />
|
||||||
<Compile Include="deobfuscators\Spices_Net\StringDecrypter.cs" />
|
<None Include="deobfuscators\Spices_Net\StringDecrypter.cs" />
|
||||||
<Compile Include="deobfuscators\StringCounts.cs" />
|
<Compile Include="deobfuscators\StringCounts.cs" />
|
||||||
<Compile Include="deobfuscators\TypesRestorer.cs" />
|
<Compile Include="deobfuscators\TypesRestorer.cs" />
|
||||||
<Compile Include="deobfuscators\Unknown\Deobfuscator.cs" />
|
<Compile Include="deobfuscators\Unknown\Deobfuscator.cs" />
|
||||||
<Compile Include="deobfuscators\UnpackedFile.cs" />
|
<Compile Include="deobfuscators\UnpackedFile.cs" />
|
||||||
<Compile Include="deobfuscators\UnusedMethodsFinder.cs" />
|
<Compile Include="deobfuscators\UnusedMethodsFinder.cs" />
|
||||||
<Compile Include="deobfuscators\ValueInlinerBase.cs" />
|
<Compile Include="deobfuscators\ValueInlinerBase.cs" />
|
||||||
<Compile Include="deobfuscators\Xenocode\Deobfuscator.cs" />
|
<None Include="deobfuscators\Xenocode\Deobfuscator.cs" />
|
||||||
<Compile Include="deobfuscators\Xenocode\StringDecrypter.cs" />
|
<None Include="deobfuscators\Xenocode\StringDecrypter.cs" />
|
||||||
<Compile Include="ExternalAssemblies.cs" />
|
<Compile Include="ExternalAssemblies.cs" />
|
||||||
<Compile Include="IDeobfuscatorContext.cs" />
|
<Compile Include="IDeobfuscatorContext.cs" />
|
||||||
<Compile Include="IObfuscatedFile.cs" />
|
<Compile Include="IObfuscatedFile.cs" />
|
||||||
|
@ -341,6 +341,10 @@
|
||||||
<Project>{5C93C5E2-196F-4877-BF65-96FEBFCEFCA1}</Project>
|
<Project>{5C93C5E2-196F-4877-BF65-96FEBFCEFCA1}</Project>
|
||||||
<Name>de4dot.mdecrypt</Name>
|
<Name>de4dot.mdecrypt</Name>
|
||||||
</ProjectReference>
|
</ProjectReference>
|
||||||
|
<ProjectReference Include="..\dot10\src\dot10.csproj">
|
||||||
|
<Project>{FDFC1237-143F-4919-8318-4926901F4639}</Project>
|
||||||
|
<Name>dot10</Name>
|
||||||
|
</ProjectReference>
|
||||||
</ItemGroup>
|
</ItemGroup>
|
||||||
<Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
|
<Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
|
||||||
<PropertyGroup>
|
<PropertyGroup>
|
||||||
|
|
|
@ -18,26 +18,26 @@
|
||||||
*/
|
*/
|
||||||
|
|
||||||
using System.Collections.Generic;
|
using System.Collections.Generic;
|
||||||
using Mono.Cecil;
|
using dot10.DotNet;
|
||||||
using Mono.Cecil.Cil;
|
using dot10.DotNet.Emit;
|
||||||
using de4dot.blocks;
|
using de4dot.blocks;
|
||||||
using de4dot.blocks.cflow;
|
using de4dot.blocks.cflow;
|
||||||
|
|
||||||
namespace de4dot.code.deobfuscators {
|
namespace de4dot.code.deobfuscators {
|
||||||
static class ArrayFinder {
|
static class ArrayFinder {
|
||||||
public static List<byte[]> getArrays(MethodDefinition method) {
|
public static List<byte[]> getArrays(MethodDef method) {
|
||||||
return getArrays(method, null);
|
return getArrays(method, null);
|
||||||
}
|
}
|
||||||
|
|
||||||
public static List<byte[]> getArrays(MethodDefinition method, TypeReference arrayElemntType) {
|
public static List<byte[]> getArrays(MethodDef method, IType arrayElementType) {
|
||||||
var arrays = new List<byte[]>();
|
var arrays = new List<byte[]>();
|
||||||
var instrs = method.Body.Instructions;
|
var instrs = method.CilBody.Instructions;
|
||||||
for (int i = 0; i < instrs.Count; i++) {
|
for (int i = 0; i < instrs.Count; i++) {
|
||||||
TypeReference type;
|
IType type;
|
||||||
var ary = getArray(instrs, ref i, out type);
|
var ary = getArray(instrs, ref i, out type);
|
||||||
if (ary == null)
|
if (ary == null)
|
||||||
break;
|
break;
|
||||||
if (arrayElemntType != null && !MemberReferenceHelper.compareTypes(type, arrayElemntType))
|
if (arrayElementType != null && !new SigComparer().Equals(type, arrayElementType))
|
||||||
continue;
|
continue;
|
||||||
|
|
||||||
arrays.Add(ary);
|
arrays.Add(ary);
|
||||||
|
@ -45,7 +45,7 @@ namespace de4dot.code.deobfuscators {
|
||||||
return arrays;
|
return arrays;
|
||||||
}
|
}
|
||||||
|
|
||||||
public static byte[] getArray(IList<Instruction> instrs, ref int index, out TypeReference type) {
|
public static byte[] getArray(IList<Instruction> instrs, ref int index, out IType type) {
|
||||||
for (int i = index; i < instrs.Count - 2; i++) {
|
for (int i = index; i < instrs.Count - 2; i++) {
|
||||||
var newarr = instrs[i++];
|
var newarr = instrs[i++];
|
||||||
if (newarr.OpCode.Code != Code.Newarr)
|
if (newarr.OpCode.Code != Code.Newarr)
|
||||||
|
@ -57,12 +57,12 @@ namespace de4dot.code.deobfuscators {
|
||||||
var ldtoken = instrs[i++];
|
var ldtoken = instrs[i++];
|
||||||
if (ldtoken.OpCode.Code != Code.Ldtoken)
|
if (ldtoken.OpCode.Code != Code.Ldtoken)
|
||||||
continue;
|
continue;
|
||||||
var field = ldtoken.Operand as FieldDefinition;
|
var field = ldtoken.Operand as FieldDef;
|
||||||
if (field == null || field.InitialValue == null)
|
if (field == null || field.InitialValue == null)
|
||||||
continue;
|
continue;
|
||||||
|
|
||||||
index = i - 3;
|
index = i - 3;
|
||||||
type = newarr.Operand as TypeReference;
|
type = newarr.Operand as IType;
|
||||||
return field.InitialValue;
|
return field.InitialValue;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -71,14 +71,14 @@ namespace de4dot.code.deobfuscators {
|
||||||
return null;
|
return null;
|
||||||
}
|
}
|
||||||
|
|
||||||
public static byte[] getInitializedByteArray(MethodDefinition method, int arraySize) {
|
public static byte[] getInitializedByteArray(MethodDef method, int arraySize) {
|
||||||
int newarrIndex = findNewarr(method, arraySize);
|
int newarrIndex = findNewarr(method, arraySize);
|
||||||
if (newarrIndex < 0)
|
if (newarrIndex < 0)
|
||||||
return null;
|
return null;
|
||||||
return getInitializedByteArray(arraySize, method, ref newarrIndex);
|
return getInitializedByteArray(arraySize, method, ref newarrIndex);
|
||||||
}
|
}
|
||||||
|
|
||||||
public static byte[] getInitializedByteArray(int arraySize, MethodDefinition method, ref int newarrIndex) {
|
public static byte[] getInitializedByteArray(int arraySize, MethodDef method, ref int newarrIndex) {
|
||||||
var resultValueArray = getInitializedArray(arraySize, method, ref newarrIndex, Code.Stelem_I1);
|
var resultValueArray = getInitializedArray(arraySize, method, ref newarrIndex, Code.Stelem_I1);
|
||||||
|
|
||||||
var resultArray = new byte[resultValueArray.Length];
|
var resultArray = new byte[resultValueArray.Length];
|
||||||
|
@ -91,7 +91,7 @@ namespace de4dot.code.deobfuscators {
|
||||||
return resultArray;
|
return resultArray;
|
||||||
}
|
}
|
||||||
|
|
||||||
public static short[] getInitializedInt16Array(int arraySize, MethodDefinition method, ref int newarrIndex) {
|
public static short[] getInitializedInt16Array(int arraySize, MethodDef method, ref int newarrIndex) {
|
||||||
var resultValueArray = getInitializedArray(arraySize, method, ref newarrIndex, Code.Stelem_I2);
|
var resultValueArray = getInitializedArray(arraySize, method, ref newarrIndex, Code.Stelem_I2);
|
||||||
|
|
||||||
var resultArray = new short[resultValueArray.Length];
|
var resultArray = new short[resultValueArray.Length];
|
||||||
|
@ -104,7 +104,7 @@ namespace de4dot.code.deobfuscators {
|
||||||
return resultArray;
|
return resultArray;
|
||||||
}
|
}
|
||||||
|
|
||||||
public static int[] getInitializedInt32Array(int arraySize, MethodDefinition method, ref int newarrIndex) {
|
public static int[] getInitializedInt32Array(int arraySize, MethodDef method, ref int newarrIndex) {
|
||||||
var resultValueArray = getInitializedArray(arraySize, method, ref newarrIndex, Code.Stelem_I4);
|
var resultValueArray = getInitializedArray(arraySize, method, ref newarrIndex, Code.Stelem_I4);
|
||||||
|
|
||||||
var resultArray = new int[resultValueArray.Length];
|
var resultArray = new int[resultValueArray.Length];
|
||||||
|
@ -117,7 +117,7 @@ namespace de4dot.code.deobfuscators {
|
||||||
return resultArray;
|
return resultArray;
|
||||||
}
|
}
|
||||||
|
|
||||||
public static uint[] getInitializedUInt32Array(int arraySize, MethodDefinition method, ref int newarrIndex) {
|
public static uint[] getInitializedUInt32Array(int arraySize, MethodDef method, ref int newarrIndex) {
|
||||||
var resultArray = getInitializedInt32Array(arraySize, method, ref newarrIndex);
|
var resultArray = getInitializedInt32Array(arraySize, method, ref newarrIndex);
|
||||||
if (resultArray == null)
|
if (resultArray == null)
|
||||||
return null;
|
return null;
|
||||||
|
@ -128,14 +128,14 @@ namespace de4dot.code.deobfuscators {
|
||||||
return ary;
|
return ary;
|
||||||
}
|
}
|
||||||
|
|
||||||
public static Value[] getInitializedArray(int arraySize, MethodDefinition method, ref int newarrIndex, Code stelemOpCode) {
|
public static Value[] getInitializedArray(int arraySize, MethodDef method, ref int newarrIndex, Code stelemOpCode) {
|
||||||
var resultValueArray = new Value[arraySize];
|
var resultValueArray = new Value[arraySize];
|
||||||
|
|
||||||
var emulator = new InstructionEmulator(method);
|
var emulator = new InstructionEmulator(method);
|
||||||
var theArray = new UnknownValue();
|
var theArray = new UnknownValue();
|
||||||
emulator.push(theArray);
|
emulator.push(theArray);
|
||||||
|
|
||||||
var instructions = method.Body.Instructions;
|
var instructions = method.CilBody.Instructions;
|
||||||
int i;
|
int i;
|
||||||
for (i = newarrIndex + 1; i < instructions.Count; i++) {
|
for (i = newarrIndex + 1; i < instructions.Count; i++) {
|
||||||
var instr = instructions[i];
|
var instr = instructions[i];
|
||||||
|
@ -183,7 +183,7 @@ done:
|
||||||
return resultValueArray;
|
return resultValueArray;
|
||||||
}
|
}
|
||||||
|
|
||||||
static int findNewarr(MethodDefinition method, int arraySize) {
|
static int findNewarr(MethodDef method, int arraySize) {
|
||||||
for (int i = 0; ; i++) {
|
for (int i = 0; ; i++) {
|
||||||
int size;
|
int size;
|
||||||
if (!findNewarr(method, ref i, out size))
|
if (!findNewarr(method, ref i, out size))
|
||||||
|
@ -193,17 +193,17 @@ done:
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
public static bool findNewarr(MethodDefinition method, ref int i, out int size) {
|
public static bool findNewarr(MethodDef method, ref int i, out int size) {
|
||||||
var instructions = method.Body.Instructions;
|
var instructions = method.CilBody.Instructions;
|
||||||
for (; i < instructions.Count; i++) {
|
for (; i < instructions.Count; i++) {
|
||||||
var instr = instructions[i];
|
var instr = instructions[i];
|
||||||
if (instr.OpCode.Code != Code.Newarr || i < 1)
|
if (instr.OpCode.Code != Code.Newarr || i < 1)
|
||||||
continue;
|
continue;
|
||||||
var ldci4 = instructions[i - 1];
|
var ldci4 = instructions[i - 1];
|
||||||
if (!DotNetUtils.isLdcI4(ldci4))
|
if (!ldci4.IsLdcI4())
|
||||||
continue;
|
continue;
|
||||||
|
|
||||||
size = DotNetUtils.getLdcI4Value(ldci4);
|
size = ldci4.GetLdcI4Value();
|
||||||
return true;
|
return true;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
@ -95,6 +95,7 @@ namespace de4dot.code.deobfuscators {
|
||||||
get { return Operations.DecryptStrings != OpDecryptString.None && staticStringInliner.InlinedAllCalls; }
|
get { return Operations.DecryptStrings != OpDecryptString.None && staticStringInliner.InlinedAllCalls; }
|
||||||
}
|
}
|
||||||
|
|
||||||
|
#if PORT
|
||||||
public virtual IEnumerable<IBlocksDeobfuscator> BlocksDeobfuscators {
|
public virtual IEnumerable<IBlocksDeobfuscator> BlocksDeobfuscators {
|
||||||
get {
|
get {
|
||||||
var list = new List<IBlocksDeobfuscator>();
|
var list = new List<IBlocksDeobfuscator>();
|
||||||
|
@ -103,6 +104,7 @@ namespace de4dot.code.deobfuscators {
|
||||||
return list;
|
return list;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
#endif
|
||||||
|
|
||||||
public DeobfuscatorBase(OptionsBase optionsBase) {
|
public DeobfuscatorBase(OptionsBase optionsBase) {
|
||||||
this.optionsBase = optionsBase;
|
this.optionsBase = optionsBase;
|
||||||
|
@ -821,7 +823,7 @@ namespace de4dot.code.deobfuscators {
|
||||||
return false;
|
return false;
|
||||||
}
|
}
|
||||||
|
|
||||||
public static int toInt32(bool b) {
|
protected static int toInt32(bool b) {
|
||||||
return b ? 1 : 0;
|
return b ? 1 : 0;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
|
@ -62,7 +62,9 @@ namespace de4dot.code.deobfuscators {
|
||||||
StringFeatures StringFeatures { get; }
|
StringFeatures StringFeatures { get; }
|
||||||
RenamingOptions RenamingOptions { get; }
|
RenamingOptions RenamingOptions { get; }
|
||||||
DecrypterType DefaultDecrypterType { get; }
|
DecrypterType DefaultDecrypterType { get; }
|
||||||
|
#if PORT
|
||||||
IEnumerable<IBlocksDeobfuscator> BlocksDeobfuscators { get; }
|
IEnumerable<IBlocksDeobfuscator> BlocksDeobfuscators { get; }
|
||||||
|
#endif
|
||||||
|
|
||||||
// This is non-null only in detect() and deobfuscateBegin().
|
// This is non-null only in detect() and deobfuscateBegin().
|
||||||
IDeobfuscatedFile DeobfuscatedFile { get; set; }
|
IDeobfuscatedFile DeobfuscatedFile { get; set; }
|
||||||
|
|
|
@ -37,6 +37,7 @@ namespace de4dot.cui {
|
||||||
static IList<IDeobfuscatorInfo> createDeobfuscatorInfos() {
|
static IList<IDeobfuscatorInfo> createDeobfuscatorInfos() {
|
||||||
return new List<IDeobfuscatorInfo> {
|
return new List<IDeobfuscatorInfo> {
|
||||||
new de4dot.code.deobfuscators.Unknown.DeobfuscatorInfo(),
|
new de4dot.code.deobfuscators.Unknown.DeobfuscatorInfo(),
|
||||||
|
#if PORT
|
||||||
new de4dot.code.deobfuscators.Babel_NET.DeobfuscatorInfo(),
|
new de4dot.code.deobfuscators.Babel_NET.DeobfuscatorInfo(),
|
||||||
new de4dot.code.deobfuscators.CliSecure.DeobfuscatorInfo(),
|
new de4dot.code.deobfuscators.CliSecure.DeobfuscatorInfo(),
|
||||||
new de4dot.code.deobfuscators.CodeFort.DeobfuscatorInfo(),
|
new de4dot.code.deobfuscators.CodeFort.DeobfuscatorInfo(),
|
||||||
|
@ -57,6 +58,7 @@ namespace de4dot.cui {
|
||||||
new de4dot.code.deobfuscators.SmartAssembly.DeobfuscatorInfo(),
|
new de4dot.code.deobfuscators.SmartAssembly.DeobfuscatorInfo(),
|
||||||
new de4dot.code.deobfuscators.Spices_Net.DeobfuscatorInfo(),
|
new de4dot.code.deobfuscators.Spices_Net.DeobfuscatorInfo(),
|
||||||
new de4dot.code.deobfuscators.Xenocode.DeobfuscatorInfo(),
|
new de4dot.code.deobfuscators.Xenocode.DeobfuscatorInfo(),
|
||||||
|
#endif
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
2
dot10
2
dot10
|
@ -1 +1 @@
|
||||||
Subproject commit 80ac6ba43c0ec9a044f850422415e3d2ad795d28
|
Subproject commit c7a83ee87964d694a1e87ed9feb6cbc054226295
|
Loading…
Reference in New Issue
Block a user