Speed up finding V5 methods decrypter type
This commit is contained in:
parent
1076218a81
commit
776fd7f69f
|
@ -61,7 +61,18 @@ namespace de4dot.code.deobfuscators.CodeVeil {
|
||||||
if (cctor == null)
|
if (cctor == null)
|
||||||
return;
|
return;
|
||||||
|
|
||||||
var instrs = cctor.Body.Instructions;
|
// V3-V4 calls string decrypter init method in <Module>::.cctor().
|
||||||
|
if (find(cctor))
|
||||||
|
return;
|
||||||
|
|
||||||
|
find_V5(cctor);
|
||||||
|
}
|
||||||
|
|
||||||
|
bool find(MethodDefinition method) {
|
||||||
|
if (method == null || method.Body == null || !method.IsStatic)
|
||||||
|
return false;
|
||||||
|
|
||||||
|
var instrs = method.Body.Instructions;
|
||||||
for (int i = 0; i < instrs.Count; i++) {
|
for (int i = 0; i < instrs.Count; i++) {
|
||||||
var call = instrs[i];
|
var call = instrs[i];
|
||||||
if (call.OpCode.Code != Code.Call)
|
if (call.OpCode.Code != Code.Call)
|
||||||
|
@ -76,40 +87,32 @@ namespace de4dot.code.deobfuscators.CodeVeil {
|
||||||
|
|
||||||
decrypterType = initMethodTmp.DeclaringType;
|
decrypterType = initMethodTmp.DeclaringType;
|
||||||
initMethod = initMethodTmp;
|
initMethod = initMethodTmp;
|
||||||
break;
|
return true;
|
||||||
}
|
}
|
||||||
|
|
||||||
find2();
|
return false;
|
||||||
}
|
}
|
||||||
|
|
||||||
void find2() {
|
// The main decrypter type calls the string decrypter init method inside its init method
|
||||||
foreach (var type in module.Types) {
|
void find_V5(MethodDefinition method) {
|
||||||
if (!checkType(type))
|
var instrs = method.Body.Instructions;
|
||||||
|
for (int i = 0; i < instrs.Count; i++) {
|
||||||
|
var call = instrs[i];
|
||||||
|
if (call.OpCode.Code != Code.Call)
|
||||||
continue;
|
continue;
|
||||||
var initMethodTmp = findInitMethod(type);
|
var mainTypeInitMethod = call.Operand as MethodDefinition;
|
||||||
if (initMethodTmp == null)
|
if (mainTypeInitMethod == null || mainTypeInitMethod.Body == null || !mainTypeInitMethod.IsStatic)
|
||||||
|
continue;
|
||||||
|
if (!DotNetUtils.isMethod(mainTypeInitMethod, "System.Void", "(System.Boolean,System.Boolean)"))
|
||||||
continue;
|
continue;
|
||||||
|
|
||||||
decrypterType = type;
|
foreach (var info in DotNetUtils.getCalledMethods(module, mainTypeInitMethod)) {
|
||||||
initMethod = initMethodTmp;
|
if (find(info.Item2))
|
||||||
return;
|
return;
|
||||||
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
MethodDefinition findInitMethod(TypeDefinition type) {
|
|
||||||
foreach (var method in type.Methods) {
|
|
||||||
if (!method.IsStatic || method.Body == null)
|
|
||||||
continue;
|
|
||||||
var key = getKey(method);
|
|
||||||
if (key == null)
|
|
||||||
continue;
|
|
||||||
|
|
||||||
return method;
|
|
||||||
}
|
|
||||||
|
|
||||||
return null;
|
|
||||||
}
|
|
||||||
|
|
||||||
bool checkType(TypeDefinition type) {
|
bool checkType(TypeDefinition type) {
|
||||||
if (!type.HasNestedTypes)
|
if (!type.HasNestedTypes)
|
||||||
return false;
|
return false;
|
||||||
|
|
Loading…
Reference in New Issue
Block a user