monocul.us/de4dot-cex
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add option to rename new short DNR obfuscated names

Browse Source
This commit is contained in:
de4dot 2013-11-18 16:43:02 +01:00
parent ba29576cfb
commit 71e2724ebf
2 changed files with 13 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
de4dot.code/NameRegexes.cs
View File

@ -55,6 +55,10 @@ namespace de4dot.code {
public bool DefaultValue { get; set; } public bool DefaultValue { get; set; }
public const char regexSeparatorChar = '&'; public const char regexSeparatorChar = '&';
public IList<NameRegex> Regexes {
get { return regexes; }
}
public NameRegexes() public NameRegexes()
: this("") { : this("") {
} }

10
de4dot.code/deobfuscators/dotNET_Reactor/v4/Deobfuscator.cs
View File

@ -32,7 +32,8 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 {
public class DeobfuscatorInfo : DeobfuscatorInfoBase { public class DeobfuscatorInfo : DeobfuscatorInfoBase {
public const string THE_NAME = ".NET Reactor"; public const string THE_NAME = ".NET Reactor";
public const string THE_TYPE = "dr4"; public const string THE_TYPE = "dr4";
const string DEFAULT_REGEX = @"!^[A-Za-z0-9]{2,3}$&" + DeobfuscatorBase.DEFAULT_ASIAN_VALID_NAME_REGEX; public const string SHORT_NAME_REGEX = @"!^[A-Za-z0-9]{2,3}$";
const string DEFAULT_REGEX = DeobfuscatorBase.DEFAULT_ASIAN_VALID_NAME_REGEX;
BoolOption decryptMethods; BoolOption decryptMethods;
BoolOption decryptBools; BoolOption decryptBools;
BoolOption restoreTypes; BoolOption restoreTypes;
@ -42,6 +43,7 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 {
BoolOption decryptResources; BoolOption decryptResources;
BoolOption removeNamespaces; BoolOption removeNamespaces;
BoolOption removeAntiStrongName; BoolOption removeAntiStrongName;
BoolOption renameShort;
public DeobfuscatorInfo() public DeobfuscatorInfo()
: base(DEFAULT_REGEX) { : base(DEFAULT_REGEX) {
@ -54,6 +56,7 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 {
decryptResources = new BoolOption(null, MakeArgName("rsrc"), "Decrypt resources", true); decryptResources = new BoolOption(null, MakeArgName("rsrc"), "Decrypt resources", true);
removeNamespaces = new BoolOption(null, MakeArgName("ns1"), "Clear namespace if there's only one class in it", true); removeNamespaces = new BoolOption(null, MakeArgName("ns1"), "Clear namespace if there's only one class in it", true);
removeAntiStrongName = new BoolOption(null, MakeArgName("sn"), "Remove anti strong name code", true); removeAntiStrongName = new BoolOption(null, MakeArgName("sn"), "Remove anti strong name code", true);
renameShort = new BoolOption(null, MakeArgName("sname"), "Rename short names", false);
} }
public override string Name { public override string Name {
@ -76,6 +79,7 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 {
DecryptResources = decryptResources.Get(), DecryptResources = decryptResources.Get(),
RemoveNamespaces = removeNamespaces.Get(), RemoveNamespaces = removeNamespaces.Get(),
RemoveAntiStrongName = removeAntiStrongName.Get(), RemoveAntiStrongName = removeAntiStrongName.Get(),
RenameShort = renameShort.Get(),
}); });
} }
@ -90,6 +94,7 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 {
decryptResources, decryptResources,
removeNamespaces, removeNamespaces,
removeAntiStrongName, removeAntiStrongName,
renameShort,
}; };
} }
} }
@ -125,6 +130,7 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 {
public bool DecryptResources { get; set; } public bool DecryptResources { get; set; }
public bool RemoveNamespaces { get; set; } public bool RemoveNamespaces { get; set; }
public bool RemoveAntiStrongName { get; set; } public bool RemoveAntiStrongName { get; set; }
public bool RenameShort { get; set; }
} }
public override string Type { public override string Type {
@ -160,6 +166,8 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 {
this.RenamingOptions |= RenamingOptions.RemoveNamespaceIfOneType; this.RenamingOptions |= RenamingOptions.RemoveNamespaceIfOneType;
else else
this.RenamingOptions &= ~RenamingOptions.RemoveNamespaceIfOneType; this.RenamingOptions &= ~RenamingOptions.RemoveNamespaceIfOneType;
if (options.RenameShort)
options.ValidNameRegex.Regexes.Insert(0, new NameRegex(DeobfuscatorInfo.SHORT_NAME_REGEX));
} }
public override byte[] UnpackNativeFile(IPEImage peImage) { public override byte[] UnpackNativeFile(IPEImage peImage) {