diff --git a/de4dot.code/deobfuscators/SmartAssembly/StringDecrypterInfo.cs b/de4dot.code/deobfuscators/SmartAssembly/StringDecrypterInfo.cs index 95715589..04e74ae6 100644 --- a/de4dot.code/deobfuscators/SmartAssembly/StringDecrypterInfo.cs +++ b/de4dot.code/deobfuscators/SmartAssembly/StringDecrypterInfo.cs @@ -92,11 +92,11 @@ namespace de4dot.code.deobfuscators.SmartAssembly { "System.Int32", }; StringDecrypterVersion guessVersion(MethodDefinition cctor) { - if (cctor == null) - return StringDecrypterVersion.V1; var fieldTypes = new FieldTypes(stringsEncodingClass); if (fieldTypes.exactly(fields2x)) return StringDecrypterVersion.V2; + if (cctor == null) + return StringDecrypterVersion.V1; if (fieldTypes.exactly(fields3x)) return StringDecrypterVersion.V3; return StringDecrypterVersion.Unknown; diff --git a/de4dot.code/deobfuscators/SmartAssembly/StringEncoderClassFinder.cs b/de4dot.code/deobfuscators/SmartAssembly/StringEncoderClassFinder.cs index 424eddff..1a50bcdb 100644 --- a/de4dot.code/deobfuscators/SmartAssembly/StringEncoderClassFinder.cs +++ b/de4dot.code/deobfuscators/SmartAssembly/StringEncoderClassFinder.cs @@ -185,12 +185,11 @@ namespace de4dot.code.deobfuscators.SmartAssembly { var fields = new FieldTypes(type); if (fields.exists("System.Collections.Hashtable") || fields.exists("System.Collections.Generic.Dictionary`2") || - fields.exactly(fields2x) || fields.exactly(fields3x)) { if (DotNetUtils.getMethod(type, ".cctor") == null) return false; } - else if (fields.exactly(fields1x)) { + else if (fields.exactly(fields1x) || fields.exactly(fields2x)) { } else return false;