Find old string decrypter method
This commit is contained in:
parent
67c866491d
commit
7e5e7ddcd2
|
@ -202,5 +202,35 @@ namespace de4dot.code.deobfuscators.CliSecure {
|
||||||
public bool isAtLeastVersion50() {
|
public bool isAtLeastVersion50() {
|
||||||
return DotNetUtils.hasPinvokeMethod(cliSecureRtType, "LoadLibraryA");
|
return DotNetUtils.hasPinvokeMethod(cliSecureRtType, "LoadLibraryA");
|
||||||
}
|
}
|
||||||
|
|
||||||
|
public void findStringDecrypterMethod() {
|
||||||
|
if (cliSecureRtType != null)
|
||||||
|
return;
|
||||||
|
|
||||||
|
foreach (var type in module.Types) {
|
||||||
|
if (type.Fields.Count != 0)
|
||||||
|
continue;
|
||||||
|
if (type.Methods.Count != 1)
|
||||||
|
continue;
|
||||||
|
var cs = type.Methods[0];
|
||||||
|
if (!isOldStringDecrypterMethod(cs))
|
||||||
|
continue;
|
||||||
|
|
||||||
|
cliSecureRtType = type;
|
||||||
|
stringDecrypterMethod = cs;
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
static bool isOldStringDecrypterMethod(MethodDefinition method) {
|
||||||
|
if (method == null || method.Body == null || !method.IsStatic)
|
||||||
|
return false;
|
||||||
|
if (!DotNetUtils.isMethod(method, "System.String", "(System.String)"))
|
||||||
|
return false;
|
||||||
|
if (!DeobUtils.hasInteger(method, 0xFF))
|
||||||
|
return false;
|
||||||
|
|
||||||
|
return true;
|
||||||
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
|
@ -214,6 +214,9 @@ namespace de4dot.code.deobfuscators.CliSecure {
|
||||||
public override void deobfuscateBegin() {
|
public override void deobfuscateBegin() {
|
||||||
base.deobfuscateBegin();
|
base.deobfuscateBegin();
|
||||||
|
|
||||||
|
cliSecureRtType.findStringDecrypterMethod();
|
||||||
|
stringDecrypter.Method = cliSecureRtType.StringDecrypterMethod;
|
||||||
|
|
||||||
addAttributesToBeRemoved(cliSecureAttributes, "Obfuscator attribute");
|
addAttributesToBeRemoved(cliSecureAttributes, "Obfuscator attribute");
|
||||||
|
|
||||||
if (options.DecryptResources) {
|
if (options.DecryptResources) {
|
||||||
|
|
|
@ -38,6 +38,7 @@ namespace de4dot.code.deobfuscators.CliSecure {
|
||||||
|
|
||||||
public MethodDefinition Method {
|
public MethodDefinition Method {
|
||||||
get { return stringDecrypterMethod; }
|
get { return stringDecrypterMethod; }
|
||||||
|
set { stringDecrypterMethod = value; }
|
||||||
}
|
}
|
||||||
|
|
||||||
public StringDecrypter(ModuleDefinition module, MethodDefinition stringDecrypterMethod) {
|
public StringDecrypter(ModuleDefinition module, MethodDefinition stringDecrypterMethod) {
|
||||||
|
|
Loading…
Reference in New Issue
Block a user