monocul.us/de4dot-cex
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

codeOffs should not be file offset

Browse Source
This commit is contained in:
de4dot 2012-04-22 21:24:32 +02:00
parent c9fa7caf91
commit 790dc9f445
1 changed files with 12 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
de4dot.code/deobfuscators/CliSecure/MethodsDecrypter.cs
View File

@ -67,19 +67,6 @@ namespace de4dot.code.deobfuscators.CliSecure {
MethodBodyHeader decrypt(MethodInfo methodInfo, out byte[] code, out byte[] extraSections);
}
class Decrypter40 : IDecrypter {
PeImage peImage;
public Decrypter40(PeImage peImage) {
this.peImage = peImage;
}
public MethodBodyHeader decrypt(MethodInfo methodInfo, out byte[] code, out byte[] extraSections) {
peImage.Reader.BaseStream.Position = methodInfo.codeOffs;
return MethodBodyParser.parseMethodBody(peImage.Reader, out code, out extraSections);
}
}
abstract class DecrypterBase : IDecrypter {
protected PeImage peImage;
protected CodeHeader codeHeader;
@ -98,6 +85,17 @@ namespace de4dot.code.deobfuscators.CliSecure {
}
}
class Decrypter40 : DecrypterBase {
public Decrypter40(PeImage peImage, CodeHeader codeHeader)
: base(peImage, codeHeader) {
}
public override MethodBodyHeader decrypt(MethodInfo methodInfo, out byte[] code, out byte[] extraSections) {
peImage.Reader.BaseStream.Position = endOfMetadata + methodInfo.codeOffs;
return MethodBodyParser.parseMethodBody(peImage.Reader, out code, out extraSections);
}
}
// CS 4.5
class Decrypter45 : DecrypterBase {
public Decrypter45(PeImage peImage, CodeHeader codeHeader)
@ -211,8 +209,6 @@ namespace de4dot.code.deobfuscators.CliSecure {
var methodInfos = new List<MethodInfo>((int)methodsDecrypter.codeHeader.numMethods);
for (int i = 0; i < (int)methodsDecrypter.codeHeader.numMethods; i++, offset += 4) {
uint codeOffs = methodsDecrypter.peImage.offsetReadUInt32(offset);
if (codeOffs != 0)
codeOffs += codeHeaderOffset;
methodInfos.Add(new MethodInfo(codeOffs, 0, 0, 0));
}
return methodInfos;
@ -250,7 +246,7 @@ namespace de4dot.code.deobfuscators.CliSecure {
}
public override IDecrypter createDecrypter() {
return new Decrypter40(methodsDecrypter.peImage);
return new Decrypter40(methodsDecrypter.peImage, methodsDecrypter.codeHeader);
}
public override List<MethodInfo> getMethodInfos(uint codeHeaderOffset) {