From 7d4c791575167b7a12014070e0398e8f51613258 Mon Sep 17 00:00:00 2001
From: de4dot <de4dot@gmail.com>
Date: Sat, 10 Mar 2012 05:32:42 +0100
Subject: [PATCH] Update detection of SA v2 string decrypter

---
 .../deobfuscators/SmartAssembly/StringDecrypterInfo.cs        | 4 ++--
 .../deobfuscators/SmartAssembly/StringEncoderClassFinder.cs   | 3 +--
 2 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/de4dot.code/deobfuscators/SmartAssembly/StringDecrypterInfo.cs b/de4dot.code/deobfuscators/SmartAssembly/StringDecrypterInfo.cs
index 95715589..04e74ae6 100644
--- a/de4dot.code/deobfuscators/SmartAssembly/StringDecrypterInfo.cs
+++ b/de4dot.code/deobfuscators/SmartAssembly/StringDecrypterInfo.cs
@@ -92,11 +92,11 @@ namespace de4dot.code.deobfuscators.SmartAssembly {
 			"System.Int32",
 		};
 		StringDecrypterVersion guessVersion(MethodDefinition cctor) {
-			if (cctor == null)
-				return StringDecrypterVersion.V1;
 			var fieldTypes = new FieldTypes(stringsEncodingClass);
 			if (fieldTypes.exactly(fields2x))
 				return StringDecrypterVersion.V2;
+			if (cctor == null)
+				return StringDecrypterVersion.V1;
 			if (fieldTypes.exactly(fields3x))
 				return StringDecrypterVersion.V3;
 			return StringDecrypterVersion.Unknown;
diff --git a/de4dot.code/deobfuscators/SmartAssembly/StringEncoderClassFinder.cs b/de4dot.code/deobfuscators/SmartAssembly/StringEncoderClassFinder.cs
index 424eddff..1a50bcdb 100644
--- a/de4dot.code/deobfuscators/SmartAssembly/StringEncoderClassFinder.cs
+++ b/de4dot.code/deobfuscators/SmartAssembly/StringEncoderClassFinder.cs
@@ -185,12 +185,11 @@ namespace de4dot.code.deobfuscators.SmartAssembly {
 			var fields = new FieldTypes(type);
 			if (fields.exists("System.Collections.Hashtable") ||
 				fields.exists("System.Collections.Generic.Dictionary`2<System.Int32,System.String>") ||
-				fields.exactly(fields2x) ||
 				fields.exactly(fields3x)) {
 				if (DotNetUtils.getMethod(type, ".cctor") == null)
 					return false;
 			}
-			else if (fields.exactly(fields1x)) {
+			else if (fields.exactly(fields1x) || fields.exactly(fields2x)) {
 			}
 			else
 				return false;