From 8ec3da7080aa0fc61e3967a6225345061cbafce8 Mon Sep 17 00:00:00 2001 From: de4dot Date: Fri, 7 Oct 2011 17:30:41 +0200 Subject: [PATCH] Update detection and some strings --- de4dot.code/deobfuscators/Unknown/Deobfuscator.cs | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/de4dot.code/deobfuscators/Unknown/Deobfuscator.cs b/de4dot.code/deobfuscators/Unknown/Deobfuscator.cs index 8f45d083..5afd9e56 100644 --- a/de4dot.code/deobfuscators/Unknown/Deobfuscator.cs +++ b/de4dot.code/deobfuscators/Unknown/Deobfuscator.cs @@ -72,8 +72,8 @@ namespace de4dot.deobfuscators.Unknown { string scanTypes() { foreach (var type in module.Types) { - if (type.FullName == "BabelAttribute") - return "Babel .NET"; + if (type.FullName == "BabelAttribute" || type.FullName == "BabelObfuscatorAttribute") + return "Babel Obfuscator"; if (type.Namespace == "___codefort") return "CodeFort"; if (type.FullName == "____KILL") @@ -81,7 +81,7 @@ namespace de4dot.deobfuscators.Unknown { if (type.FullName == "CryptoObfuscator.ProtectedWithCryptoObfuscatorAttribute") return "Crypto Obfuscator"; if (type.FullName.Contains("ObfuscatedByGoliath")) - return "Goliath .NET"; + return "Goliath .NET Obfuscator"; if (type.FullName == "Xenocode.Client.Attributes.AssemblyAttributes.ProcessedByXenocode") return "Xenocode"; if (type.FullName == "ZYXDNGuarder") @@ -91,7 +91,7 @@ namespace de4dot.deobfuscators.Unknown { if (type.Name.Contains("();\t")) return "Manco .NET Obfuscator"; if (Regex.IsMatch(type.FullName, @"^EMyPID_\d+_$")) - return "BitHelmet"; + return "BitHelmet Obfuscator"; if (type.FullName == "NineRays.Decompiler.NotDecompile") return "Spices.Net Obfuscator"; if (type.FullName == "YanoAttribute")