monocul.us/de4dot-cex
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add getModuleTypeCctor() method

Browse Source
This commit is contained in:
de4dot 2012-01-22 11:15:14 +01:00
parent fde26c0bd2
commit 7962de961c
6 changed files with 9 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
blocks/DotNetUtils.cs
View File

@ -294,6 +294,10 @@ namespace de4dot.blocks {
return module.Types[0]; return module.Types[0];
} }
public static MethodDefinition getModuleTypeCctor(ModuleDefinition module) {
return getMethod(getModuleType(module), ".cctor");
}
public static bool isEmpty(MethodDefinition method) { public static bool isEmpty(MethodDefinition method) {
if (method.Body == null) if (method.Body == null)
return false; return false;

2
de4dot.code/deobfuscators/CryptoObfuscator/AntiDebugger.cs
View File

@ -45,7 +45,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
public void find() { public void find() {
if (find(module.EntryPoint)) if (find(module.EntryPoint))
return; return;
if (find(DotNetUtils.getMethod(DotNetUtils.getModuleType(module), ".cctor"))) if (find(DotNetUtils.getModuleTypeCctor(module)))
return; return;
} }

2
de4dot.code/deobfuscators/CryptoObfuscator/TamperDetection.cs
View File

@ -45,7 +45,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
public void find() { public void find() {
if (find(module.EntryPoint)) if (find(module.EntryPoint))
return; return;
if (find(DotNetUtils.getMethod(DotNetUtils.getModuleType(module), ".cctor"))) if (find(DotNetUtils.getModuleTypeCctor(module)))
return; return;
} }

2
de4dot.code/deobfuscators/SmartAssembly/MemoryManagerInfo.cs
View File

@ -43,7 +43,7 @@ namespace de4dot.code.deobfuscators.SmartAssembly {
} }
public bool find() { public bool find() {
if (checkCalledMethods(DotNetUtils.getMethod(DotNetUtils.getModuleType(module), ".cctor"))) if (checkCalledMethods(DotNetUtils.getModuleTypeCctor(module)))
return true; return true;
if (checkCalledMethods(module.EntryPoint)) if (checkCalledMethods(module.EntryPoint))
return true; return true;

2
de4dot.code/deobfuscators/SmartAssembly/ResolverInfoBase.cs
View File

@ -58,7 +58,7 @@ namespace de4dot.code.deobfuscators.SmartAssembly {
if (resolverType != null) if (resolverType != null)
return true; return true;
if (findTypes(DotNetUtils.getMethod(DotNetUtils.getModuleType(module), ".cctor"))) if (findTypes(DotNetUtils.getModuleTypeCctor(module)))
return true; return true;
if (findTypes(module.EntryPoint)) if (findTypes(module.EntryPoint))
return true; return true;

2
de4dot.code/deobfuscators/dotNET_Reactor/v3/NativeLibSaver.cs
View File

@ -65,7 +65,7 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v3 {
} }
public void find() { public void find() {
foreach (var info in DotNetUtils.getCalledMethods(module, DotNetUtils.getMethod(DotNetUtils.getModuleType(module), ".cctor"))) { foreach (var info in DotNetUtils.getCalledMethods(module, DotNetUtils.getModuleTypeCctor(module))) {
if (!DotNetUtils.isMethod(info.Item2, "System.Void", "()")) if (!DotNetUtils.isMethod(info.Item2, "System.Void", "()"))
continue; continue;
if (info.Item1.FullName != "<PrivateImplementationDetails>{F1C5056B-0AFC-4423-9B83-D13A26B48869}") if (info.Item1.FullName != "<PrivateImplementationDetails>{F1C5056B-0AFC-4423-9B83-D13A26B48869}")