From 8a81e98b3f6dfe1ca0abc033a286e789b7bd727c Mon Sep 17 00:00:00 2001 From: de4dot Date: Mon, 23 Jul 2012 10:42:38 +0200 Subject: [PATCH] Fix invalid Mvid --- .../deobfuscators/MPRESS/Deobfuscator.cs | 21 +++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/de4dot.code/deobfuscators/MPRESS/Deobfuscator.cs b/de4dot.code/deobfuscators/MPRESS/Deobfuscator.cs index bab02faf..3cb18f7c 100644 --- a/de4dot.code/deobfuscators/MPRESS/Deobfuscator.cs +++ b/de4dot.code/deobfuscators/MPRESS/Deobfuscator.cs @@ -19,6 +19,8 @@ using System; using System.Collections.Generic; +using System.Security.Cryptography; +using System.Text; using Mono.Cecil; using Mono.MyStuff; using de4dot.PE; @@ -236,6 +238,25 @@ namespace de4dot.code.deobfuscators.MPRESS { return newOne; } + public override void deobfuscateBegin() { + base.deobfuscateBegin(); + + fixInvalidMvid(); + } + + void fixInvalidMvid() { + if (module.Mvid == Guid.Empty) { + var hash = new SHA1Managed().ComputeHash(Encoding.UTF8.GetBytes(module.ToString())); + var guid = new Guid(BitConverter.ToInt32(hash, 0), + BitConverter.ToInt16(hash, 4), + BitConverter.ToInt16(hash, 6), + hash[8], hash[9], hash[10], hash[11], + hash[12], hash[13], hash[14], hash[15]); + Log.v("Updating MVID: {0}", guid.ToString("B")); + module.Mvid = guid; + } + } + public override IEnumerable getStringDecrypterMethods() { return new List(); }