diff --git a/de4dot.code/deobfuscators/Confuser/ProxyCallFixerV1.cs b/de4dot.code/deobfuscators/Confuser/ProxyCallFixerV1.cs index 390007f6..3d19f061 100644 --- a/de4dot.code/deobfuscators/Confuser/ProxyCallFixerV1.cs +++ b/de4dot.code/deobfuscators/Confuser/ProxyCallFixerV1.cs @@ -28,7 +28,7 @@ using de4dot.blocks; namespace de4dot.code.deobfuscators.Confuser { class ProxyCallFixerV1 : ProxyCallFixer2 { MethodDefinitionAndDeclaringTypeDict methodToInfo = new MethodDefinitionAndDeclaringTypeDict(); - FieldDefinitionAndDeclaringTypeDict fieldToMethod = new FieldDefinitionAndDeclaringTypeDict(); + FieldDefinitionAndDeclaringTypeDict> fieldToMethods = new FieldDefinitionAndDeclaringTypeDict>(); string ourAsm; ConfuserVersion version = ConfuserVersion.Unknown; @@ -78,7 +78,18 @@ namespace de4dot.code.deobfuscators.Confuser { } public IEnumerable Fields { - get { return fieldToMethod.getKeys(); } + get { + var fields = new List(fieldToMethods.getKeys()); + var type = DotNetUtils.getModuleType(module); + if (fields.Count > 0 && type != null) { + foreach (var field in type.Fields) { + var fieldType = field.FieldType as TypeDefinition; + if (fieldType != null && delegateTypesDict.ContainsKey(fieldType)) + fields.Add(field); + } + } + return fields; + } } public override IEnumerable> OtherMethods { @@ -90,11 +101,13 @@ namespace de4dot.code.deobfuscators.Confuser { Item2 = "Delegate creator method", }); } - foreach (var method in fieldToMethod.getValues()) { - list.Add(new Tuple { - Item1 = method, - Item2 = "Proxy delegate method", - }); + foreach (var methods in fieldToMethods.getValues()) { + foreach (var method in methods) { + list.Add(new Tuple { + Item1 = method, + Item2 = "Proxy delegate method", + }); + } } return list; } @@ -260,11 +273,11 @@ namespace de4dot.code.deobfuscators.Confuser { Log.v("Finding all proxy delegates"); var delegateInfos = createDelegateInitInfos(cctor); - fieldToMethod = createFieldToMethodDictionary(cctor.DeclaringType); - if (delegateInfos.Count != fieldToMethod.Count) + fieldToMethods = createFieldToMethodsDictionary(cctor.DeclaringType); + if (delegateInfos.Count < fieldToMethods.Count) throw new ApplicationException("Missing proxy delegates"); var delegateToFields = new Dictionary>(); - foreach (var field in fieldToMethod.getKeys()) { + foreach (var field in fieldToMethods.getKeys()) { List list; if (!delegateToFields.TryGetValue((TypeDefinition)field.FieldType, out list)) delegateToFields[(TypeDefinition)field.FieldType] = list = new List(); @@ -280,8 +293,8 @@ namespace de4dot.code.deobfuscators.Confuser { Log.indent(); foreach (var field in fields) { - var proxyMethod = fieldToMethod.find(field); - if (proxyMethod == null) + var proxyMethods = fieldToMethods.find(field); + if (proxyMethods == null) continue; var info = delegateInfos.find(field); if (info == null) @@ -293,12 +306,14 @@ namespace de4dot.code.deobfuscators.Confuser { if (calledMethod == null) continue; - add(proxyMethod, new DelegateInfo(field, calledMethod, callOpcode)); - Log.v("Field: {0}, Opcode: {1}, Method: {2} ({3:X8})", - Utils.removeNewlines(field.Name), - callOpcode, - Utils.removeNewlines(calledMethod), - calledMethod.MetadataToken.ToUInt32()); + foreach (var proxyMethod in proxyMethods) { + add(proxyMethod, new DelegateInfo(field, calledMethod, callOpcode)); + Log.v("Field: {0}, Opcode: {1}, Method: {2} ({3:X8})", + Utils.removeNewlines(field.Name), + callOpcode, + Utils.removeNewlines(calledMethod), + calledMethod.MetadataToken.ToUInt32()); + } } Log.deIndent(); delegateTypesDict[type] = true; @@ -374,15 +389,18 @@ namespace de4dot.code.deobfuscators.Confuser { return infos; } - static FieldDefinitionAndDeclaringTypeDict createFieldToMethodDictionary(TypeDefinition type) { - var dict = new FieldDefinitionAndDeclaringTypeDict(); + static FieldDefinitionAndDeclaringTypeDict> createFieldToMethodsDictionary(TypeDefinition type) { + var dict = new FieldDefinitionAndDeclaringTypeDict>(); foreach (var method in type.Methods) { if (!method.IsStatic || method.Body == null || method.Name == ".cctor") continue; var delegateField = getDelegateField(method); if (delegateField == null) continue; - dict.add(delegateField, method); + var methods = dict.find(delegateField); + if (methods == null) + dict.add(delegateField, methods = new List()); + methods.Add(method); } return dict; }