monocul.us/de4dot-cex
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Support a new EF 3.3 version that was released 1-2 days ago

Browse Source
This commit is contained in:
de4dot 2012-03-11 15:34:53 +01:00
parent 5b1d094dfb
commit 7e1bf542af
1 changed files with 26 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
de4dot.code/deobfuscators/Eazfuscator_NET/StringDecrypter.cs
View File

@ -31,7 +31,7 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
MethodDefinition stringMethod;
TypeDefinition dataDecrypterType;
short s1, s2, s3;
int i1, i2, i3, i4, i5;
int i1, i2, i3, i4, i5, i6;
bool checkMinus2;
bool usePublicKeyToken;
int keyLen;
@ -262,7 +262,7 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
public string decrypt(int val) {
while (true) {
int offset = magic1 ^ i3 ^ val;
int offset = magic1 ^ i3 ^ val ^ i6;
reader.BaseStream.Position = offset;
byte[] tmpKey;
if (theKey == null) {
@ -523,12 +523,23 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
continue;
i3 = DotNetUtils.getLdcI4Value(ldci4);
if (!findInt6(method, i + 5))
return false;
return true;
}
return false;
}
// v3.3.134.30672+ (not 3.3.128.10407)
bool findInt6(MethodDefinition method, int index) {
index = getNextLdci4InSameBlock(method, index);
if (index < 0)
return true;
return EfUtils.getNextInt32(method, ref index, out i6);
}
bool findInt4(MethodDefinition method) {
int index = 0;
if (!findCallReadInt32(method, ref index))
@ -539,6 +550,19 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
return true;
}
static int getNextLdci4InSameBlock(MethodDefinition method, int index) {
var instrs = method.Body.Instructions;
for (int i = index; i < instrs.Count; i++) {
var instr = instrs[i];
if (instr.OpCode.FlowControl != FlowControl.Next)
return -1;
if (DotNetUtils.isLdcI4(instr))
return i;
}
return -1;
}
bool findInt5(MethodDefinition method) {
int index = -1;
while (true) {