Clear RVA when resetting field type and initial value
This commit is contained in:
parent
6a7ddbaa56
commit
7e1d16dafb
|
@ -221,6 +221,7 @@ namespace de4dot.code.deobfuscators.CodeVeil {
|
||||||
reader = MemoryImageStream.Create(decompressed);
|
reader = MemoryImageStream.Create(decompressed);
|
||||||
info.dataField.FieldSig.Type = module.CorLibTypes.Byte;
|
info.dataField.FieldSig.Type = module.CorLibTypes.Byte;
|
||||||
info.dataField.InitialValue = new byte[1];
|
info.dataField.InitialValue = new byte[1];
|
||||||
|
info.dataField.RVA = 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
void findOtherTypes() {
|
void findOtherTypes() {
|
||||||
|
|
|
@ -192,6 +192,7 @@ namespace de4dot.code.deobfuscators.CodeVeil {
|
||||||
|
|
||||||
stringDataField.FieldSig.Type = module.CorLibTypes.Byte;
|
stringDataField.FieldSig.Type = module.CorLibTypes.Byte;
|
||||||
stringDataField.InitialValue = new byte[1];
|
stringDataField.InitialValue = new byte[1];
|
||||||
|
stringDataField.RVA = 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
static uint[] getKey(MethodDef method) {
|
static uint[] getKey(MethodDef method) {
|
||||||
|
|
|
@ -118,6 +118,7 @@ namespace de4dot.code.deobfuscators.DeepSea {
|
||||||
}
|
}
|
||||||
fieldInfo.arrayInitField.InitialValue = new byte[1];
|
fieldInfo.arrayInitField.InitialValue = new byte[1];
|
||||||
fieldInfo.arrayInitField.FieldSig.Type = module.CorLibTypes.Byte;
|
fieldInfo.arrayInitField.FieldSig.Type = module.CorLibTypes.Byte;
|
||||||
|
fieldInfo.arrayInitField.RVA = 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
IList<Instruction> allInstructions;
|
IList<Instruction> allInstructions;
|
||||||
|
|
|
@ -497,6 +497,7 @@ namespace de4dot.code.deobfuscators.DeepSea {
|
||||||
infos.Add(getAssemblyInfo(decrypted, null));
|
infos.Add(getAssemblyInfo(decrypted, null));
|
||||||
fieldInfo.field.InitialValue = new byte[1];
|
fieldInfo.field.InitialValue = new byte[1];
|
||||||
fieldInfo.field.FieldSig.Type = module.CorLibTypes.Byte;
|
fieldInfo.field.FieldSig.Type = module.CorLibTypes.Byte;
|
||||||
|
fieldInfo.field.RVA = 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
return infos;
|
return infos;
|
||||||
|
|
|
@ -345,6 +345,7 @@ namespace de4dot.code.deobfuscators.DeepSea {
|
||||||
DeobUtils.decryptAndAddResources(module, name, () => decryptResourceV4(resourceField.InitialValue, magic));
|
DeobUtils.decryptAndAddResources(module, name, () => decryptResourceV4(resourceField.InitialValue, magic));
|
||||||
resourceField.InitialValue = new byte[1];
|
resourceField.InitialValue = new byte[1];
|
||||||
resourceField.FieldSig.Type = module.CorLibTypes.Byte;
|
resourceField.FieldSig.Type = module.CorLibTypes.Byte;
|
||||||
|
resourceField.RVA = 0;
|
||||||
return true;
|
return true;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
|
@ -380,6 +380,7 @@ namespace de4dot.code.deobfuscators.DeepSea {
|
||||||
public void cleanup() {
|
public void cleanup() {
|
||||||
arrayInfo.initField.InitialValue = new byte[1];
|
arrayInfo.initField.InitialValue = new byte[1];
|
||||||
arrayInfo.initField.FieldSig.Type = arrayInfo.initField.Module.CorLibTypes.Byte;
|
arrayInfo.initField.FieldSig.Type = arrayInfo.initField.Module.CorLibTypes.Byte;
|
||||||
|
arrayInfo.initField.RVA = 0;
|
||||||
removeInitializeArrayCall(cctor, arrayInfo.initField);
|
removeInitializeArrayCall(cctor, arrayInfo.initField);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
@ -539,6 +540,7 @@ namespace de4dot.code.deobfuscators.DeepSea {
|
||||||
public void cleanup() {
|
public void cleanup() {
|
||||||
encryptedDataField.InitialValue = new byte[1];
|
encryptedDataField.InitialValue = new byte[1];
|
||||||
encryptedDataField.FieldSig.Type = encryptedDataField.Module.CorLibTypes.Byte;
|
encryptedDataField.FieldSig.Type = encryptedDataField.Module.CorLibTypes.Byte;
|
||||||
|
encryptedDataField.RVA = 0;
|
||||||
removeInitializeArrayCall(cctor, encryptedDataField);
|
removeInitializeArrayCall(cctor, encryptedDataField);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
|
@ -341,6 +341,7 @@ namespace de4dot.code.deobfuscators.Spices_Net {
|
||||||
|
|
||||||
encryptedDataField.InitialValue = new byte[1];
|
encryptedDataField.InitialValue = new byte[1];
|
||||||
encryptedDataField.FieldSig.Type = module.CorLibTypes.Byte;
|
encryptedDataField.FieldSig.Type = module.CorLibTypes.Byte;
|
||||||
|
encryptedDataField.RVA = 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
public string decrypt(MethodDef method) {
|
public string decrypt(MethodDef method) {
|
||||||
|
|
Loading…
Reference in New Issue
Block a user