monocul.us/de4dot-cex
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Clear RVA when resetting field type and initial value

Browse Source
This commit is contained in:
de4dot 2012-11-17 11:45:24 +01:00
parent 6a7ddbaa56
commit 7e1d16dafb
7 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
de4dot.code/deobfuscators/CodeVeil/ProxyCallFixer.cs
View File

@ -221,6 +221,7 @@ namespace de4dot.code.deobfuscators.CodeVeil {
reader = MemoryImageStream.Create(decompressed);
info.dataField.FieldSig.Type = module.CorLibTypes.Byte;
info.dataField.InitialValue = new byte[1];
info.dataField.RVA = 0;
}
void findOtherTypes() {

1
de4dot.code/deobfuscators/CodeVeil/StringDecrypter.cs
View File

@ -192,6 +192,7 @@ namespace de4dot.code.deobfuscators.CodeVeil {
stringDataField.FieldSig.Type = module.CorLibTypes.Byte;
stringDataField.InitialValue = new byte[1];
stringDataField.RVA = 0;
}
static uint[] getKey(MethodDef method) {

1
de4dot.code/deobfuscators/DeepSea/ArrayBlockState.cs
View File

@ -118,6 +118,7 @@ namespace de4dot.code.deobfuscators.DeepSea {
}
fieldInfo.arrayInitField.InitialValue = new byte[1];
fieldInfo.arrayInitField.FieldSig.Type = module.CorLibTypes.Byte;
fieldInfo.arrayInitField.RVA = 0;
}
IList<Instruction> allInstructions;

1
de4dot.code/deobfuscators/DeepSea/AssemblyResolver.cs
View File

@ -497,6 +497,7 @@ namespace de4dot.code.deobfuscators.DeepSea {
infos.Add(getAssemblyInfo(decrypted, null));
fieldInfo.field.InitialValue = new byte[1];
fieldInfo.field.FieldSig.Type = module.CorLibTypes.Byte;
fieldInfo.field.RVA = 0;
}
return infos;

1
de4dot.code/deobfuscators/DeepSea/ResourceResolver.cs
View File

@ -345,6 +345,7 @@ namespace de4dot.code.deobfuscators.DeepSea {
DeobUtils.decryptAndAddResources(module, name, () => decryptResourceV4(resourceField.InitialValue, magic));
resourceField.InitialValue = new byte[1];
resourceField.FieldSig.Type = module.CorLibTypes.Byte;
resourceField.RVA = 0;
return true;
}
}

2
de4dot.code/deobfuscators/DeepSea/StringDecrypter.cs
View File

@ -380,6 +380,7 @@ namespace de4dot.code.deobfuscators.DeepSea {
public void cleanup() {
arrayInfo.initField.InitialValue = new byte[1];
arrayInfo.initField.FieldSig.Type = arrayInfo.initField.Module.CorLibTypes.Byte;
arrayInfo.initField.RVA = 0;
removeInitializeArrayCall(cctor, arrayInfo.initField);
}
}
@ -539,6 +540,7 @@ namespace de4dot.code.deobfuscators.DeepSea {
public void cleanup() {
encryptedDataField.InitialValue = new byte[1];
encryptedDataField.FieldSig.Type = encryptedDataField.Module.CorLibTypes.Byte;
encryptedDataField.RVA = 0;
removeInitializeArrayCall(cctor, encryptedDataField);
}
}

1
de4dot.code/deobfuscators/Spices_Net/StringDecrypter.cs
View File

@ -341,6 +341,7 @@ namespace de4dot.code.deobfuscators.Spices_Net {
encryptedDataField.InitialValue = new byte[1];
encryptedDataField.FieldSig.Type = module.CorLibTypes.Byte;
encryptedDataField.RVA = 0;
}
public string decrypt(MethodDef method) {