monocul.us/de4dot-cex
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Find old string decrypter method

Browse Source
This commit is contained in:
de4dot 2012-04-26 16:53:47 +02:00
parent 67c866491d
commit 7e5e7ddcd2
3 changed files with 34 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
de4dot.code/deobfuscators/CliSecure/CliSecureRtType.cs
View File

@ -202,5 +202,35 @@ namespace de4dot.code.deobfuscators.CliSecure {
public bool isAtLeastVersion50() {
return DotNetUtils.hasPinvokeMethod(cliSecureRtType, "LoadLibraryA");
}
public void findStringDecrypterMethod() {
if (cliSecureRtType != null)
return;
foreach (var type in module.Types) {
if (type.Fields.Count != 0)
continue;
if (type.Methods.Count != 1)
continue;
var cs = type.Methods[0];
if (!isOldStringDecrypterMethod(cs))
continue;
cliSecureRtType = type;
stringDecrypterMethod = cs;
return;
}
}
static bool isOldStringDecrypterMethod(MethodDefinition method) {
if (method == null || method.Body == null || !method.IsStatic)
return false;
if (!DotNetUtils.isMethod(method, "System.String", "(System.String)"))
return false;
if (!DeobUtils.hasInteger(method, 0xFF))
return false;
return true;
}
}
}

3
de4dot.code/deobfuscators/CliSecure/Deobfuscator.cs
View File

@ -214,6 +214,9 @@ namespace de4dot.code.deobfuscators.CliSecure {
public override void deobfuscateBegin() {
base.deobfuscateBegin();
cliSecureRtType.findStringDecrypterMethod();
stringDecrypter.Method = cliSecureRtType.StringDecrypterMethod;
addAttributesToBeRemoved(cliSecureAttributes, "Obfuscator attribute");
if (options.DecryptResources) {

1
de4dot.code/deobfuscators/CliSecure/StringDecrypter.cs
View File

@ -38,6 +38,7 @@ namespace de4dot.code.deobfuscators.CliSecure {
public MethodDefinition Method {
get { return stringDecrypterMethod; }
set { stringDecrypterMethod = value; }
}
public StringDecrypter(ModuleDefinition module, MethodDefinition stringDecrypterMethod) {