From 790dc9f445f536cab84121d6f874935f43ff1769 Mon Sep 17 00:00:00 2001
From: de4dot <de4dot@gmail.com>
Date: Sun, 22 Apr 2012 21:24:32 +0200
Subject: [PATCH] codeOffs should not be file offset

---
 .../CliSecure/MethodsDecrypter.cs             | 28 ++++++++-----------
 1 file changed, 12 insertions(+), 16 deletions(-)

diff --git a/de4dot.code/deobfuscators/CliSecure/MethodsDecrypter.cs b/de4dot.code/deobfuscators/CliSecure/MethodsDecrypter.cs
index c60e1f22..9cc0cba2 100644
--- a/de4dot.code/deobfuscators/CliSecure/MethodsDecrypter.cs
+++ b/de4dot.code/deobfuscators/CliSecure/MethodsDecrypter.cs
@@ -67,19 +67,6 @@ namespace de4dot.code.deobfuscators.CliSecure {
 			MethodBodyHeader decrypt(MethodInfo methodInfo, out byte[] code, out byte[] extraSections);
 		}
 
-		class Decrypter40 : IDecrypter {
-			PeImage peImage;
-
-			public Decrypter40(PeImage peImage) {
-				this.peImage = peImage;
-			}
-
-			public MethodBodyHeader decrypt(MethodInfo methodInfo, out byte[] code, out byte[] extraSections) {
-				peImage.Reader.BaseStream.Position = methodInfo.codeOffs;
-				return MethodBodyParser.parseMethodBody(peImage.Reader, out code, out extraSections);
-			}
-		}
-
 		abstract class DecrypterBase : IDecrypter {
 			protected PeImage peImage;
 			protected CodeHeader codeHeader;
@@ -98,6 +85,17 @@ namespace de4dot.code.deobfuscators.CliSecure {
 			}
 		}
 
+		class Decrypter40 : DecrypterBase {
+			public Decrypter40(PeImage peImage, CodeHeader codeHeader)
+				: base(peImage, codeHeader) {
+			}
+
+			public override MethodBodyHeader decrypt(MethodInfo methodInfo, out byte[] code, out byte[] extraSections) {
+				peImage.Reader.BaseStream.Position = endOfMetadata + methodInfo.codeOffs;
+				return MethodBodyParser.parseMethodBody(peImage.Reader, out code, out extraSections);
+			}
+		}
+
 		// CS 4.5
 		class Decrypter45 : DecrypterBase {
 			public Decrypter45(PeImage peImage, CodeHeader codeHeader)
@@ -211,8 +209,6 @@ namespace de4dot.code.deobfuscators.CliSecure {
 				var methodInfos = new List<MethodInfo>((int)methodsDecrypter.codeHeader.numMethods);
 				for (int i = 0; i < (int)methodsDecrypter.codeHeader.numMethods; i++, offset += 4) {
 					uint codeOffs = methodsDecrypter.peImage.offsetReadUInt32(offset);
-					if (codeOffs != 0)
-						codeOffs += codeHeaderOffset;
 					methodInfos.Add(new MethodInfo(codeOffs, 0, 0, 0));
 				}
 				return methodInfos;
@@ -250,7 +246,7 @@ namespace de4dot.code.deobfuscators.CliSecure {
 			}
 
 			public override IDecrypter createDecrypter() {
-				return new Decrypter40(methodsDecrypter.peImage);
+				return new Decrypter40(methodsDecrypter.peImage, methodsDecrypter.codeHeader);
 			}
 
 			public override List<MethodInfo> getMethodInfos(uint codeHeaderOffset) {