diff --git a/de4dot.code/deobfuscators/CliSecure/CliSecureRtType.cs b/de4dot.code/deobfuscators/CliSecure/CliSecureRtType.cs index 8ac2b8b2..8e36c7fc 100644 --- a/de4dot.code/deobfuscators/CliSecure/CliSecureRtType.cs +++ b/de4dot.code/deobfuscators/CliSecure/CliSecureRtType.cs @@ -202,5 +202,35 @@ namespace de4dot.code.deobfuscators.CliSecure { public bool isAtLeastVersion50() { return DotNetUtils.hasPinvokeMethod(cliSecureRtType, "LoadLibraryA"); } + + public void findStringDecrypterMethod() { + if (cliSecureRtType != null) + return; + + foreach (var type in module.Types) { + if (type.Fields.Count != 0) + continue; + if (type.Methods.Count != 1) + continue; + var cs = type.Methods[0]; + if (!isOldStringDecrypterMethod(cs)) + continue; + + cliSecureRtType = type; + stringDecrypterMethod = cs; + return; + } + } + + static bool isOldStringDecrypterMethod(MethodDefinition method) { + if (method == null || method.Body == null || !method.IsStatic) + return false; + if (!DotNetUtils.isMethod(method, "System.String", "(System.String)")) + return false; + if (!DeobUtils.hasInteger(method, 0xFF)) + return false; + + return true; + } } } diff --git a/de4dot.code/deobfuscators/CliSecure/Deobfuscator.cs b/de4dot.code/deobfuscators/CliSecure/Deobfuscator.cs index 07790541..db4bc5d9 100644 --- a/de4dot.code/deobfuscators/CliSecure/Deobfuscator.cs +++ b/de4dot.code/deobfuscators/CliSecure/Deobfuscator.cs @@ -214,6 +214,9 @@ namespace de4dot.code.deobfuscators.CliSecure { public override void deobfuscateBegin() { base.deobfuscateBegin(); + cliSecureRtType.findStringDecrypterMethod(); + stringDecrypter.Method = cliSecureRtType.StringDecrypterMethod; + addAttributesToBeRemoved(cliSecureAttributes, "Obfuscator attribute"); if (options.DecryptResources) { diff --git a/de4dot.code/deobfuscators/CliSecure/StringDecrypter.cs b/de4dot.code/deobfuscators/CliSecure/StringDecrypter.cs index e59481e6..ef3e5e5c 100644 --- a/de4dot.code/deobfuscators/CliSecure/StringDecrypter.cs +++ b/de4dot.code/deobfuscators/CliSecure/StringDecrypter.cs @@ -38,6 +38,7 @@ namespace de4dot.code.deobfuscators.CliSecure { public MethodDefinition Method { get { return stringDecrypterMethod; } + set { stringDecrypterMethod = value; } } public StringDecrypter(ModuleDefinition module, MethodDefinition stringDecrypterMethod) {