diff --git a/de4dot.code/deobfuscators/DeobfuscatorBase.cs b/de4dot.code/deobfuscators/DeobfuscatorBase.cs index 60ffc73e..3fe29753 100644 --- a/de4dot.code/deobfuscators/DeobfuscatorBase.cs +++ b/de4dot.code/deobfuscators/DeobfuscatorBase.cs @@ -304,6 +304,11 @@ namespace de4dot.code.deobfuscators { resourcesToRemove.Add(new RemoveInfo(resource, reason)); } + protected void addModuleReferencesToBeRemoved(IEnumerable modrefs, string reason) { + foreach (var modref in modrefs) + addModuleReferenceToBeRemoved(modref, reason); + } + protected void addModuleReferenceToBeRemoved(ModuleReference modref, string reason) { modrefsToRemove.Add(new RemoveInfo(modref, reason)); } diff --git a/de4dot.code/deobfuscators/dotNET_Reactor3/DecrypterType.cs b/de4dot.code/deobfuscators/dotNET_Reactor3/DecrypterType.cs index c20cb3b9..cee37502 100644 --- a/de4dot.code/deobfuscators/dotNET_Reactor3/DecrypterType.cs +++ b/de4dot.code/deobfuscators/dotNET_Reactor3/DecrypterType.cs @@ -31,6 +31,7 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor3 { MethodDefinition stringDecrypter1; MethodDefinition stringDecrypter2; List initMethods = new List(); + List moduleReferences = new List(); public bool Detected { get { return decrypterType != null; } @@ -52,6 +53,10 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor3 { get { return initMethods; } } + public List ModuleReferences { + get { return moduleReferences; } + } + public IEnumerable StringDecrypters { get { return new List { @@ -72,6 +77,7 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor3 { this.stringDecrypter2 = lookup(oldOne.stringDecrypter2, "Could not find stringDecrypter2"); foreach (var method in oldOne.initMethods) initMethods.Add(lookup(method, "Could not find initMethod")); + updateModuleReferences(); } T lookup(T def, string errorMessage) where T : MemberReference { @@ -90,10 +96,24 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor3 { if (DotNetUtils.isMethod(method, "System.Void", "()")) initMethods.Add(method); } + updateModuleReferences(); return; } } + void updateModuleReferences() { + foreach (var method in decrypterType.Methods) { + if (method.PInvokeInfo != null) { + switch (method.PInvokeInfo.EntryPoint) { + case "nr_nli": + case "nr_startup": + moduleReferences.Add(method.PInvokeInfo.Module); + break; + } + } + } + } + MethodDefinition addStringDecrypter(TypeDefinition type, string name) { var method = DotNetUtils.getMethod(type, name); if (method == null) diff --git a/de4dot.code/deobfuscators/dotNET_Reactor3/Deobfuscator.cs b/de4dot.code/deobfuscators/dotNET_Reactor3/Deobfuscator.cs index 10ff75ad..d5c46722 100644 --- a/de4dot.code/deobfuscators/dotNET_Reactor3/Deobfuscator.cs +++ b/de4dot.code/deobfuscators/dotNET_Reactor3/Deobfuscator.cs @@ -280,8 +280,10 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor3 { if (options.RestoreTypes) new TypesRestorer(module).deobfuscate(); - if (canRemoveDecrypterType && !isTypeCalled(decrypterType.Type)) + if (canRemoveDecrypterType && !isTypeCalled(decrypterType.Type)) { addTypeToBeRemoved(decrypterType.Type, "Decrypter type"); + addModuleReferencesToBeRemoved(decrypterType.ModuleReferences, "Native lib module references"); + } base.deobfuscateEnd(); }