Add Confuser proxy fixer

de4dot.code/de4dot.code.csproj

@@ -71,6 +71,8 @@
     <Compile Include="deobfuscators\Confuser\ConstantsFolder.cs" />
     <Compile Include="deobfuscators\Confuser\Deobfuscator.cs" />
     <Compile Include="deobfuscators\Confuser\JitMethodsDecrypter.cs" />
+    <Compile Include="deobfuscators\Confuser\ProxyCallFixer.cs" />
+    <Compile Include="deobfuscators\Confuser\x86Emulator.cs" />
     <Compile Include="deobfuscators\dotNET_Reactor\v4\ProxyCallFixer.cs" />
     <Compile Include="deobfuscators\ILProtector\MethodReader.cs" />
     <Compile Include="deobfuscators\ILProtector\MethodsDecrypter.cs" />

de4dot.code/deobfuscators/Confuser/Deobfuscator.cs

@@ -59,6 +59,7 @@ namespace de4dot.code.deobfuscators.Confuser {
 		string obfuscatorName = DeobfuscatorInfo.THE_NAME;
 
 		JitMethodsDecrypter jitMethodsDecrypter;
+		ProxyCallFixer proxyCallFixer;
 
 		internal class Options : OptionsBase {
 		}
@@ -91,7 +92,8 @@ namespace de4dot.code.deobfuscators.Confuser {
 		protected override int detectInternal() {
 			int val = 0;
 
-			int sum = toInt32(jitMethodsDecrypter.Detected);
+			int sum = toInt32(jitMethodsDecrypter.Detected) +
+					toInt32(proxyCallFixer != null ? proxyCallFixer.Detected : false);
 			if (sum > 0)
 				val += 100 + 10 * (sum - 1);
 
@@ -101,13 +103,27 @@ namespace de4dot.code.deobfuscators.Confuser {
 		protected override void scanForObfuscator() {
 			jitMethodsDecrypter = new JitMethodsDecrypter(module, DeobfuscatedFile);
 			jitMethodsDecrypter.find();
+			if (jitMethodsDecrypter.Detected)
+				return;
+			initTheRest();
+		}
+
+		void initTheRest() {
+			proxyCallFixer = new ProxyCallFixer(module, getFileData(), DeobfuscatedFile);
+			proxyCallFixer.findDelegateCreator();
+		}
+
+		byte[] getFileData() {
+			if (ModuleBytes != null)
+				return ModuleBytes;
+			return ModuleBytes = DeobUtils.readModule(module);
 		}
 
 		public override bool getDecryptedModule(int count, ref byte[] newFileData, ref DumpedMethods dumpedMethods) {
 			if (count != 0 || !jitMethodsDecrypter.Detected)
 				return false;
 
-			byte[] fileData = ModuleBytes ?? DeobUtils.readModule(module);
+			byte[] fileData = getFileData();
 			var peImage = new PeImage(fileData);
 
 			if (jitMethodsDecrypter.Detected) {
@@ -124,13 +140,29 @@ namespace de4dot.code.deobfuscators.Confuser {
 
 		public override IDeobfuscator moduleReloaded(ModuleDefinition module) {
 			var newOne = new Deobfuscator(options);
+			newOne.DeobfuscatedFile = DeobfuscatedFile;
 			newOne.setModule(module);
 			newOne.jitMethodsDecrypter = new JitMethodsDecrypter(module, jitMethodsDecrypter);
+			newOne.initTheRest();
+			newOne.ModuleBytes = ModuleBytes;
 			return newOne;
 		}
 
 		public override void deobfuscateBegin() {
 			base.deobfuscateBegin();
+
+			proxyCallFixer.find();
+		}
+
+		public override void deobfuscateMethodEnd(Blocks blocks) {
+			proxyCallFixer.deobfuscate(blocks);
+			base.deobfuscateMethodEnd(blocks);
+		}
+
+		public override void deobfuscateEnd() {
+			removeProxyDelegates(proxyCallFixer);
+
+			base.deobfuscateEnd();
 		}
 
 		public override IEnumerable<int> getStringDecrypterMethods() {

de4dot.code/deobfuscators/Confuser/ProxyCallFixer.cs

@@ -0,0 +1,265 @@
+/*
+    Copyright (C) 2011-2012 de4dot@gmail.com
+
+    This file is part of de4dot.
+
+    de4dot is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    de4dot is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with de4dot.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+using System;
+using System.Collections.Generic;
+using Mono.Cecil;
+using Mono.Cecil.Cil;
+using de4dot.blocks;
+using de4dot.PE;
+
+namespace de4dot.code.deobfuscators.Confuser {
+	class ProxyCallFixer : ProxyCallFixer2 {
+		byte[] fileData;
+		ISimpleDeobfuscator simpleDeobfuscator;
+		MethodDefinitionAndDeclaringTypeDict<ProxyCreatorInfo> methodToInfo = new MethodDefinitionAndDeclaringTypeDict<ProxyCreatorInfo>();
+		FieldDefinitionAndDeclaringTypeDict<MethodDefinition> fieldToMethod = new FieldDefinitionAndDeclaringTypeDict<MethodDefinition>();
+		x86Emulator x86emu;
+
+		enum ProxyCreatorType {
+			None,
+			CallOrCallvirt,
+			Newobj,
+		}
+
+		class ProxyCreatorInfo {
+			public readonly MethodDefinition creatorMethod;
+			public readonly ProxyCreatorType proxyCreatorType;
+			public uint? key;
+			public MethodDefinition nativeMethod;
+			public ushort callvirtChar;
+
+			public ProxyCreatorInfo(MethodDefinition creatorMethod, ProxyCreatorType proxyCreatorType) {
+				this.creatorMethod = creatorMethod;
+				this.proxyCreatorType = proxyCreatorType;
+			}
+		}
+
+		public override IEnumerable<Tuple<MethodDefinition, string>> OtherMethods {
+			get {
+				var list = new List<Tuple<MethodDefinition, string>>();
+				foreach (var info in methodToInfo.getValues()) {
+					list.Add(new Tuple<MethodDefinition, string> {
+						Item1 = info.creatorMethod,
+						Item2 = "Delegate creator method",
+					});
+					list.Add(new Tuple<MethodDefinition, string> {
+						Item1 = info.nativeMethod,
+						Item2 = "Calculate RID native method",
+					});
+				}
+				return list;
+			}
+		}
+
+		public ProxyCallFixer(ModuleDefinition module, byte[] fileData, ISimpleDeobfuscator simpleDeobfuscator)
+			: base(module) {
+			this.fileData = fileData;
+			this.simpleDeobfuscator = simpleDeobfuscator;
+		}
+
+		protected override object checkCctor(TypeDefinition type, MethodDefinition cctor) {
+			var instrs = cctor.Body.Instructions;
+			object retVal = null;
+			for (int i = 0; i < instrs.Count - 1; i++) {
+				var ldtoken = instrs[i];
+				if (ldtoken.OpCode.Code != Code.Ldtoken)
+					continue;
+				var field = ldtoken.Operand as FieldDefinition;
+				if (field == null)
+					continue;
+
+				var call = instrs[i + 1];
+				if (call.OpCode.Code != Code.Call)
+					continue;
+				var calledMethod = call.Operand as MethodDefinition;
+				if (!isDelegateCreatorMethod(calledMethod))
+					continue;
+
+				fieldToMethod.add(field, calledMethod);
+				retVal = this;
+			}
+			return retVal;
+		}
+
+		protected override void getCallInfo(object context, FieldDefinition field, out MethodReference calledMethod, out OpCode callOpcode) {
+			var info = getProxyCreatorInfo(field);
+			var sig = module.GetSignatureBlob(field);
+			int len = sig.Length;
+			uint magic = (uint)((sig[len - 2] << 24) | (sig[len - 3] << 16) | (sig[len - 5] << 8) | sig[len - 6]);
+			uint rid = getRid(info, magic);
+			int token = (sig[len - 7] << 24) | (int)rid;
+			calledMethod = module.LookupToken(token) as MethodReference;
+			callOpcode = getCallOpCode(info, field);
+		}
+
+		OpCode getCallOpCode(ProxyCreatorInfo info, FieldDefinition field) {
+			switch (info.proxyCreatorType) {
+			case ProxyCreatorType.CallOrCallvirt:
+				if (field.Name.Length > 0 && field.Name[0] == info.callvirtChar)
+					return OpCodes.Callvirt;
+				return OpCodes.Call;
+
+			case ProxyCreatorType.Newobj:
+				return OpCodes.Newobj;
+
+			default: throw new NotSupportedException();
+			}
+		}
+
+		ProxyCreatorInfo getProxyCreatorInfo(FieldReference field) {
+			return methodToInfo.find(fieldToMethod.find(field));
+		}
+
+		uint getRid(ProxyCreatorInfo info, uint magic) {
+			if (info.key != null)
+				return magic ^ info.key.Value;
+
+			if (info.nativeMethod != null) {
+				if (x86emu == null)
+					x86emu = new x86Emulator(new PeImage(fileData));
+				return x86emu.emulate((uint)info.nativeMethod.RVA, magic);
+			}
+
+			throw new NotImplementedException();
+		}
+
+		public void findDelegateCreator() {
+			var type = DotNetUtils.getModuleType(module);
+			if (type == null)
+				return;
+			foreach (var method in type.Methods) {
+				if (!method.IsStatic || method.Body == null)
+					continue;
+				if (!DotNetUtils.isMethod(method, "System.Void", "(System.RuntimeFieldHandle)"))
+					continue;
+				var creatorType = getProxyCreatorType(method);
+				if (creatorType == ProxyCreatorType.None)
+					continue;
+
+				methodToInfo.add(method, createProxyCreatorInfo(method, creatorType));
+				setDelegateCreatorMethod(method);
+			}
+		}
+
+		ProxyCreatorType getProxyCreatorType(MethodDefinition method) {
+			foreach (var instr in method.Body.Instructions) {
+				var field = instr.Operand as FieldReference;
+				if (field == null)
+					continue;
+				switch (field.FullName) {
+				case "System.Reflection.Emit.OpCode System.Reflection.Emit.OpCodes::Call":
+				case "System.Reflection.Emit.OpCode System.Reflection.Emit.OpCodes::Callvirt":
+					return ProxyCreatorType.CallOrCallvirt;
+
+				case "System.Reflection.Emit.OpCode System.Reflection.Emit.OpCodes::Newobj":
+					return ProxyCreatorType.Newobj;
+				}
+			}
+			return ProxyCreatorType.None;
+		}
+
+		ProxyCreatorInfo createProxyCreatorInfo(MethodDefinition creatorMethod, ProxyCreatorType proxyCreatorType) {
+			simpleDeobfuscator.deobfuscate(creatorMethod, true);
+			var info = new ProxyCreatorInfo(creatorMethod, proxyCreatorType);
+
+			if (!initializeKey(info))
+				throw new NotSupportedException("Couldn't find decryption key");
+
+			if (info.proxyCreatorType == ProxyCreatorType.CallOrCallvirt) {
+				if (!initializeCallvirtChar(info))
+					throw new ApplicationException("Couldn't find callvirt char");
+			}
+
+			return info;
+		}
+
+		bool initializeKey(ProxyCreatorInfo info) {
+			var instrs = info.creatorMethod.Body.Instructions;
+			for (int index = 0; index < instrs.Count; index++) {
+				index = ConfuserUtils.findCallMethod(instrs, index, Code.Callvirt, "System.Reflection.Module System.Reflection.MemberInfo::get_Module()");
+				if (index < 0)
+					break;
+
+				uint key;
+				if (getKey(instrs, index + 1, out key)) {
+					info.key = key;
+					return true;
+				}
+
+				var nativeMethod = getNativeMethod(instrs, index + 1);
+				if (nativeMethod != null) {
+					info.nativeMethod = nativeMethod;
+					return true;
+				}
+			}
+			return false;
+		}
+
+		static bool getKey(IList<Instruction> instrs, int index, out uint key) {
+			key = 0;
+			if (index + 2 >= instrs.Count)
+				return false;
+			if (!DotNetUtils.isLdloc(instrs[index++]))
+				return false;
+			var ldci4 = instrs[index++];
+			if (!DotNetUtils.isLdcI4(ldci4))
+				return false;
+			if (instrs[index++].OpCode.Code != Code.Xor)
+				return false;
+
+			key = (uint)DotNetUtils.getLdcI4Value(ldci4);
+			throw new NotSupportedException("TODO: Test this method, then return true");
+		}
+
+		static MethodDefinition getNativeMethod(IList<Instruction> instrs, int index) {
+			if (index + 1 >= instrs.Count)
+				return null;
+			if (!DotNetUtils.isLdloc(instrs[index++]))
+				return null;
+			var call = instrs[index++];
+			if (call.OpCode.Code != Code.Call)
+				return null;
+			var calledMethod = call.Operand as MethodDefinition;
+			if (calledMethod == null || calledMethod.Body != null || !calledMethod.IsNative)
+				return null;
+			return calledMethod;
+		}
+
+		bool initializeCallvirtChar(ProxyCreatorInfo info) {
+			var instrs = info.creatorMethod.Body.Instructions;
+			for (int index = 0; index < instrs.Count; index++) {
+				index = ConfuserUtils.findCallMethod(instrs, index, Code.Callvirt, "System.Char System.String::get_Chars(System.Int32)");
+				if (index < 0)
+					break;
+
+				index++;
+				if (index >= instrs.Count)
+					break;
+
+				var ldci4 = instrs[index];
+				if (!DotNetUtils.isLdcI4(ldci4))
+					continue;
+				info.callvirtChar = (ushort)DotNetUtils.getLdcI4Value(ldci4);
+				return true;
+			}
+			return false;
+		}
+	}
+}

de4dot.code/deobfuscators/Confuser/x86Emulator.cs

@@ -0,0 +1,289 @@
+/*
+    Copyright (C) 2011-2012 de4dot@gmail.com
+
+    This file is part of de4dot.
+
+    de4dot is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    de4dot is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with de4dot.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using de4dot.PE;
+
+namespace de4dot.code.deobfuscators.Confuser {
+	class x86Emulator {
+		static readonly byte[] prolog = new byte[] {
+			0x89, 0xE0, 0x53, 0x57, 0x56, 0x29, 0xE0, 0x83,
+			0xF8, 0x18, 0x74, 0x07, 0x8B, 0x44, 0x24, 0x10,
+			0x50, 0xEB, 0x01, 0x51,
+		};
+		static readonly byte[] epilog = new byte[] {
+			0x5E, 0x5F, 0x5B, 0xC3,
+		};
+
+		PeImage peImage;
+		BinaryReader reader;
+		uint[] args;
+		int nextArgIndex;
+		uint[] regs = new uint[8];
+		byte modRM, mod, reg, rm;
+
+		enum OpCode {
+			Add_RI,
+			Add_RR,
+			Mov_RI,
+			Mov_RR,
+			Neg_R,
+			Not_R,
+			Pop_R,
+			Sub_RI,
+			Sub_RR,
+			Xor_RI,
+			Xor_RR,
+		}
+
+		interface IOperand {
+		}
+
+		class RegOperand : IOperand {
+			static readonly string[] names = new string[8] {
+				"eax", "ecx", "edx", "ebx", "esp", "ebp", "esi", "edi",
+			};
+			public readonly int reg;
+
+			public RegOperand(int reg) {
+				this.reg = reg;
+			}
+
+			public override string ToString() {
+				return names[reg];
+			}
+		}
+
+		class ImmOperand : IOperand {
+			public readonly int imm;
+
+			public ImmOperand(int imm) {
+				this.imm = imm;
+			}
+
+			public override string ToString() {
+				return string.Format("{0:X2}h", imm);
+			}
+		}
+
+		class Instruction {
+			public readonly OpCode opCode;
+			public IOperand op1;
+			public IOperand op2;
+
+			public Instruction(OpCode opCode)
+				: this(opCode, null, null) {
+			}
+
+			public Instruction(OpCode opCode, IOperand op1)
+				: this(opCode, op1, null) {
+			}
+
+			public Instruction(OpCode opCode, IOperand op1, IOperand op2) {
+				this.opCode = opCode;
+				this.op1 = op1;
+				this.op2 = op2;
+			}
+
+			public override string ToString() {
+				if (op1 != null && op2 != null)
+					return string.Format("{0} {1},{2}", opCode, op1, op2);
+				if (op1 != null)
+					return string.Format("{0} {1}", opCode, op1);
+				return string.Format("{0}", opCode);
+			}
+		}
+
+		public x86Emulator(PeImage peImage) {
+			this.peImage = peImage;
+			this.reader = peImage.Reader;
+		}
+
+		public uint emulate(uint rva, uint arg) {
+			return emulate(rva, new uint[] { arg });
+		}
+
+		public uint emulate(uint rva, uint[] args) {
+			initialize(args);
+
+			reader.BaseStream.Position = peImage.rvaToOffset(rva);
+			if (!isBytes(prolog))
+				throw new ApplicationException(string.Format("Missing epilog @ RVA {0:X8}", rva));
+			reader.BaseStream.Position += prolog.Length;
+
+			while (!isBytes(epilog))
+				emulate();
+
+			return regs[0];
+		}
+
+		void initialize(uint[] args) {
+			this.args = args;
+			nextArgIndex = 0;
+			for (int i = 0; i < regs.Length; i++)
+				regs[i] = 0;
+		}
+
+		bool isBytes(IList<byte> bytes) {
+			long oldPos = reader.BaseStream.Position;
+			bool result = true;
+			for (int i = 0; i < bytes.Count; i++) {
+				if (bytes[i] != reader.ReadByte()) {
+					result = false;
+					break;
+				}
+			}
+			reader.BaseStream.Position = oldPos;
+			return result;
+		}
+
+		void emulate() {
+			var instr = decode();
+			switch (instr.opCode) {
+			case OpCode.Add_RI:
+			case OpCode.Add_RR:
+				writeReg(instr.op1, readOp(instr.op1) + readOp(instr.op2));
+				break;
+
+			case OpCode.Mov_RI:
+			case OpCode.Mov_RR:
+				writeReg(instr.op1, readOp(instr.op2));
+				break;
+
+			case OpCode.Neg_R:
+				writeReg(instr.op1, (uint)-(int)readOp(instr.op1));
+				break;
+
+			case OpCode.Not_R:
+				writeReg(instr.op1, ~readOp(instr.op1));
+				break;
+
+			case OpCode.Pop_R:
+				writeReg(instr.op1, getNextArg());
+				break;
+
+			case OpCode.Sub_RI:
+			case OpCode.Sub_RR:
+				writeReg(instr.op1, readOp(instr.op1) - readOp(instr.op2));
+				break;
+
+			case OpCode.Xor_RI:
+			case OpCode.Xor_RR:
+				writeReg(instr.op1, readOp(instr.op1) ^ readOp(instr.op2));
+				break;
+
+			default: throw new NotSupportedException();
+			}
+		}
+
+		uint getNextArg() {
+			if (nextArgIndex >= args.Length)
+				throw new ApplicationException("No more args");
+			return args[nextArgIndex++];
+		}
+
+		void writeReg(IOperand op, uint val) {
+			var regOp = (RegOperand)op;
+			regs[regOp.reg] = val;
+		}
+
+		uint readOp(IOperand op) {
+			var regOp = op as RegOperand;
+			if (regOp != null)
+				return regs[regOp.reg];
+
+			var immOp = op as ImmOperand;
+			if (immOp != null)
+				return (uint)immOp.imm;
+
+			throw new NotSupportedException();
+		}
+
+		Instruction decode() {
+			byte opc = reader.ReadByte();
+			switch (opc) {
+			case 0x01:	// ADD Ed,Gd
+				parseModRM();
+				return new Instruction(OpCode.Add_RR, new RegOperand(rm), new RegOperand(reg));
+
+			case 0x29:	// SUB Ed,Gd
+				parseModRM();
+				return new Instruction(OpCode.Sub_RR, new RegOperand(rm), new RegOperand(reg));
+
+			case 0x31:	// XOR Ed,Gd
+				parseModRM();
+				return new Instruction(OpCode.Xor_RR, new RegOperand(rm), new RegOperand(reg));
+
+			case 0x58:	// POP EAX
+			case 0x59:	// POP ECX
+			case 0x5A:	// POP EDX
+			case 0x5B:	// POP EBX
+			case 0x5C:	// POP ESP
+			case 0x5D:	// POP EBP
+			case 0x5E:	// POP ESI
+			case 0x5F:	// POP EDI
+				return new Instruction(OpCode.Pop_R, new RegOperand(opc - 0x58));
+
+			case 0x81:	// Grp1 Ed,Id
+				parseModRM();
+				switch (reg) {
+				case 0: return new Instruction(OpCode.Add_RI, new RegOperand(rm), new ImmOperand(reader.ReadInt32()));
+				case 5: return new Instruction(OpCode.Sub_RI, new RegOperand(rm), new ImmOperand(reader.ReadInt32()));
+				case 6: return new Instruction(OpCode.Xor_RI, new RegOperand(rm), new ImmOperand(reader.ReadInt32()));
+				default: throw new NotSupportedException();
+				}
+
+			case 0x89:	// MOV Ed,Gd
+				parseModRM();
+				return new Instruction(OpCode.Mov_RR, new RegOperand(rm), new RegOperand(reg));
+
+			case 0xB8:	// MOV EAX,Id
+			case 0xB9:	// MOV ECX,Id
+			case 0xBA:	// MOV EDX,Id
+			case 0xBB:	// MOV EBX,Id
+			case 0xBC:	// MOV ESP,Id
+			case 0xBD:	// MOV EBP,Id
+			case 0xBE:	// MOV ESI,Id
+			case 0xBF:	// MOV EDI,Id
+				return new Instruction(OpCode.Mov_RI, new RegOperand(opc - 0xB8), new ImmOperand(reader.ReadInt32()));
+
+			case 0xF7:	// Grp3 Ev
+				parseModRM();
+				switch (reg) {
+				case 2: return new Instruction(OpCode.Not_R, new RegOperand(rm));
+				case 3: return new Instruction(OpCode.Neg_R, new RegOperand(rm));
+				default: throw new NotSupportedException();
+				}
+
+			default: throw new NotSupportedException(string.Format("Invalid opcode: {0:X2}", opc));
+			}
+		}
+
+		void parseModRM() {
+			modRM = reader.ReadByte();
+			mod = (byte)((modRM >> 6) & 7);
+			reg = (byte)((modRM >> 3) & 7);
+			rm = (byte)(modRM & 7);
+			if (mod != 3)
+				throw new ApplicationException("Memory operand");
+		}
+	}
+}