diff --git a/blocks/DotNetUtils.cs b/blocks/DotNetUtils.cs index a4c96b08..946ef080 100644 --- a/blocks/DotNetUtils.cs +++ b/blocks/DotNetUtils.cs @@ -908,5 +908,17 @@ namespace de4dot.blocks { MetadataToken = new MetadataToken(TokenType.Event, nextTokenRid--), }; } + + public static bool findLdcI4Constant(MethodDefinition method, int constant) { + if (method == null || method.Body == null) + return false; + foreach (var instr in method.Body.Instructions) { + if (instr.OpCode.Code != Code.Ldc_I4) + continue; + if (constant == (int)instr.Operand) + return true; + } + return false; + } } } diff --git a/de4dot.code/deobfuscators/dotNET_Reactor/v4/Deobfuscator.cs b/de4dot.code/deobfuscators/dotNET_Reactor/v4/Deobfuscator.cs index fca680ac..251526fc 100644 --- a/de4dot.code/deobfuscators/dotNET_Reactor/v4/Deobfuscator.cs +++ b/de4dot.code/deobfuscators/dotNET_Reactor/v4/Deobfuscator.cs @@ -332,7 +332,7 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 { if (compileMethod == null) return DeobfuscatorInfo.THE_NAME + " < 4.0"; DeobfuscatedFile.deobfuscate(compileMethod); - bool compileMethodHasConstant_0x70000000 = findConstant(compileMethod, 0x70000000); // 4.0-4.1 + bool compileMethodHasConstant_0x70000000 = DotNetUtils.findLdcI4Constant(compileMethod, 0x70000000); // 4.0-4.1 DeobfuscatedFile.deobfuscate(methodsDecrypter.Method); bool hasCorEnableProfilingString = findString(methodsDecrypter.Method, "Cor_Enable_Profiling"); // 4.1-4.4 @@ -362,18 +362,6 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 { return false; } - static bool findConstant(MethodDefinition method, int constant) { - if (method == null || method.Body == null) - return false; - foreach (var instr in method.Body.Instructions) { - if (instr.OpCode.Code != Code.Ldc_I4) - continue; - if (constant == (int)instr.Operand) - return true; - } - return false; - } - public override bool getDecryptedModule(ref byte[] newFileData, ref Dictionary dumpedMethods) { fileData = ModuleBytes ?? DeobUtils.readModule(module); peImage = new PeImage(fileData);