diff --git a/de4dot.code/deobfuscators/CliSecure/CliSecureRtType.cs b/de4dot.code/deobfuscators/CliSecure/CliSecureRtType.cs index 8e36c7fc..388f6932 100644 --- a/de4dot.code/deobfuscators/CliSecure/CliSecureRtType.cs +++ b/de4dot.code/deobfuscators/CliSecure/CliSecureRtType.cs @@ -18,6 +18,7 @@ */ using System; +using System.Collections.Generic; using System.IO; using Mono.Cecil; using de4dot.blocks; @@ -57,6 +58,22 @@ namespace de4dot.code.deobfuscators.CliSecure { get { return loadMethod; } } + public IEnumerable DecryptModuleReferences { + get { + var list = new List(); + addModuleReference(list, "_Initialize"); + addModuleReference(list, "_Initialize64"); + return list; + } + } + + void addModuleReference(List list, string methodName) { + var method = DotNetUtils.getPInvokeMethod(cliSecureRtType, methodName); + if (method == null) + return; + list.Add(method.PInvokeInfo.Module); + } + public CliSecureRtType(ModuleDefinition module) { this.module = module; } diff --git a/de4dot.code/deobfuscators/CliSecure/Deobfuscator.cs b/de4dot.code/deobfuscators/CliSecure/Deobfuscator.cs index db4bc5d9..e345f10a 100644 --- a/de4dot.code/deobfuscators/CliSecure/Deobfuscator.cs +++ b/de4dot.code/deobfuscators/CliSecure/Deobfuscator.cs @@ -279,6 +279,7 @@ namespace de4dot.code.deobfuscators.CliSecure { } if (options.DecryptMethods) { addResources("Obfuscator protection files"); + addModuleReferencesToBeRemoved(cliSecureRtType.DecryptModuleReferences, "Obfuscator protection files"); addModuleReferences("Obfuscator protection files"); }