Clear RVA when resetting field type and initial value
This commit is contained in:
parent
6a7ddbaa56
commit
7e1d16dafb
|
@ -221,6 +221,7 @@ namespace de4dot.code.deobfuscators.CodeVeil {
|
|||
reader = MemoryImageStream.Create(decompressed);
|
||||
info.dataField.FieldSig.Type = module.CorLibTypes.Byte;
|
||||
info.dataField.InitialValue = new byte[1];
|
||||
info.dataField.RVA = 0;
|
||||
}
|
||||
|
||||
void findOtherTypes() {
|
||||
|
|
|
@ -192,6 +192,7 @@ namespace de4dot.code.deobfuscators.CodeVeil {
|
|||
|
||||
stringDataField.FieldSig.Type = module.CorLibTypes.Byte;
|
||||
stringDataField.InitialValue = new byte[1];
|
||||
stringDataField.RVA = 0;
|
||||
}
|
||||
|
||||
static uint[] getKey(MethodDef method) {
|
||||
|
|
|
@ -118,6 +118,7 @@ namespace de4dot.code.deobfuscators.DeepSea {
|
|||
}
|
||||
fieldInfo.arrayInitField.InitialValue = new byte[1];
|
||||
fieldInfo.arrayInitField.FieldSig.Type = module.CorLibTypes.Byte;
|
||||
fieldInfo.arrayInitField.RVA = 0;
|
||||
}
|
||||
|
||||
IList<Instruction> allInstructions;
|
||||
|
|
|
@ -497,6 +497,7 @@ namespace de4dot.code.deobfuscators.DeepSea {
|
|||
infos.Add(getAssemblyInfo(decrypted, null));
|
||||
fieldInfo.field.InitialValue = new byte[1];
|
||||
fieldInfo.field.FieldSig.Type = module.CorLibTypes.Byte;
|
||||
fieldInfo.field.RVA = 0;
|
||||
}
|
||||
|
||||
return infos;
|
||||
|
|
|
@ -345,6 +345,7 @@ namespace de4dot.code.deobfuscators.DeepSea {
|
|||
DeobUtils.decryptAndAddResources(module, name, () => decryptResourceV4(resourceField.InitialValue, magic));
|
||||
resourceField.InitialValue = new byte[1];
|
||||
resourceField.FieldSig.Type = module.CorLibTypes.Byte;
|
||||
resourceField.RVA = 0;
|
||||
return true;
|
||||
}
|
||||
}
|
||||
|
|
|
@ -380,6 +380,7 @@ namespace de4dot.code.deobfuscators.DeepSea {
|
|||
public void cleanup() {
|
||||
arrayInfo.initField.InitialValue = new byte[1];
|
||||
arrayInfo.initField.FieldSig.Type = arrayInfo.initField.Module.CorLibTypes.Byte;
|
||||
arrayInfo.initField.RVA = 0;
|
||||
removeInitializeArrayCall(cctor, arrayInfo.initField);
|
||||
}
|
||||
}
|
||||
|
@ -539,6 +540,7 @@ namespace de4dot.code.deobfuscators.DeepSea {
|
|||
public void cleanup() {
|
||||
encryptedDataField.InitialValue = new byte[1];
|
||||
encryptedDataField.FieldSig.Type = encryptedDataField.Module.CorLibTypes.Byte;
|
||||
encryptedDataField.RVA = 0;
|
||||
removeInitializeArrayCall(cctor, encryptedDataField);
|
||||
}
|
||||
}
|
||||
|
|
|
@ -341,6 +341,7 @@ namespace de4dot.code.deobfuscators.Spices_Net {
|
|||
|
||||
encryptedDataField.InitialValue = new byte[1];
|
||||
encryptedDataField.FieldSig.Type = module.CorLibTypes.Byte;
|
||||
encryptedDataField.RVA = 0;
|
||||
}
|
||||
|
||||
public string decrypt(MethodDef method) {
|
||||
|
|
Loading…
Reference in New Issue
Block a user