monocul.us/de4dot-cex
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Clear RVA when resetting field type and initial value

Browse Source
This commit is contained in:
de4dot 2012-11-17 11:45:24 +01:00
parent 6a7ddbaa56
commit 7e1d16dafb
7 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
de4dot.code/deobfuscators/CodeVeil/ProxyCallFixer.cs
View File

@ -221,6 +221,7 @@ namespace de4dot.code.deobfuscators.CodeVeil {
reader = MemoryImageStream.Create(decompressed); reader = MemoryImageStream.Create(decompressed);
info.dataField.FieldSig.Type = module.CorLibTypes.Byte; info.dataField.FieldSig.Type = module.CorLibTypes.Byte;
info.dataField.InitialValue = new byte[1]; info.dataField.InitialValue = new byte[1];
info.dataField.RVA = 0;
} }
void findOtherTypes() { void findOtherTypes() {

1
de4dot.code/deobfuscators/CodeVeil/StringDecrypter.cs
View File

@ -192,6 +192,7 @@ namespace de4dot.code.deobfuscators.CodeVeil {
stringDataField.FieldSig.Type = module.CorLibTypes.Byte; stringDataField.FieldSig.Type = module.CorLibTypes.Byte;
stringDataField.InitialValue = new byte[1]; stringDataField.InitialValue = new byte[1];
stringDataField.RVA = 0;
} }
static uint[] getKey(MethodDef method) { static uint[] getKey(MethodDef method) {

1
de4dot.code/deobfuscators/DeepSea/ArrayBlockState.cs
View File

@ -118,6 +118,7 @@ namespace de4dot.code.deobfuscators.DeepSea {
} }
fieldInfo.arrayInitField.InitialValue = new byte[1]; fieldInfo.arrayInitField.InitialValue = new byte[1];
fieldInfo.arrayInitField.FieldSig.Type = module.CorLibTypes.Byte; fieldInfo.arrayInitField.FieldSig.Type = module.CorLibTypes.Byte;
fieldInfo.arrayInitField.RVA = 0;
} }
IList<Instruction> allInstructions; IList<Instruction> allInstructions;

1
de4dot.code/deobfuscators/DeepSea/AssemblyResolver.cs
View File

@ -497,6 +497,7 @@ namespace de4dot.code.deobfuscators.DeepSea {
infos.Add(getAssemblyInfo(decrypted, null)); infos.Add(getAssemblyInfo(decrypted, null));
fieldInfo.field.InitialValue = new byte[1]; fieldInfo.field.InitialValue = new byte[1];
fieldInfo.field.FieldSig.Type = module.CorLibTypes.Byte; fieldInfo.field.FieldSig.Type = module.CorLibTypes.Byte;
fieldInfo.field.RVA = 0;
} }
return infos; return infos;

1
de4dot.code/deobfuscators/DeepSea/ResourceResolver.cs
View File

@ -345,6 +345,7 @@ namespace de4dot.code.deobfuscators.DeepSea {
DeobUtils.decryptAndAddResources(module, name, () => decryptResourceV4(resourceField.InitialValue, magic)); DeobUtils.decryptAndAddResources(module, name, () => decryptResourceV4(resourceField.InitialValue, magic));
resourceField.InitialValue = new byte[1]; resourceField.InitialValue = new byte[1];
resourceField.FieldSig.Type = module.CorLibTypes.Byte; resourceField.FieldSig.Type = module.CorLibTypes.Byte;
resourceField.RVA = 0;
return true; return true;
} }
} }

2
de4dot.code/deobfuscators/DeepSea/StringDecrypter.cs
View File

@ -380,6 +380,7 @@ namespace de4dot.code.deobfuscators.DeepSea {
public void cleanup() { public void cleanup() {
arrayInfo.initField.InitialValue = new byte[1]; arrayInfo.initField.InitialValue = new byte[1];
arrayInfo.initField.FieldSig.Type = arrayInfo.initField.Module.CorLibTypes.Byte; arrayInfo.initField.FieldSig.Type = arrayInfo.initField.Module.CorLibTypes.Byte;
arrayInfo.initField.RVA = 0;
removeInitializeArrayCall(cctor, arrayInfo.initField); removeInitializeArrayCall(cctor, arrayInfo.initField);
} }
} }
@ -539,6 +540,7 @@ namespace de4dot.code.deobfuscators.DeepSea {
public void cleanup() { public void cleanup() {
encryptedDataField.InitialValue = new byte[1]; encryptedDataField.InitialValue = new byte[1];
encryptedDataField.FieldSig.Type = encryptedDataField.Module.CorLibTypes.Byte; encryptedDataField.FieldSig.Type = encryptedDataField.Module.CorLibTypes.Byte;
encryptedDataField.RVA = 0;
removeInitializeArrayCall(cctor, encryptedDataField); removeInitializeArrayCall(cctor, encryptedDataField);
} }
} }

1
de4dot.code/deobfuscators/Spices_Net/StringDecrypter.cs
View File

@ -341,6 +341,7 @@ namespace de4dot.code.deobfuscators.Spices_Net {
encryptedDataField.InitialValue = new byte[1]; encryptedDataField.InitialValue = new byte[1];
encryptedDataField.FieldSig.Type = module.CorLibTypes.Byte; encryptedDataField.FieldSig.Type = module.CorLibTypes.Byte;
encryptedDataField.RVA = 0;
} }
public string decrypt(MethodDef method) { public string decrypt(MethodDef method) {