monocul.us/de4dot-cex
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Make sure it gets an RVA, and change field type to byte

Browse Source
This commit is contained in:
de4dot 2012-01-24 09:06:54 +01:00
parent 5c98e81e78
commit 8fbcdeb060
3 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
de4dot.code/deobfuscators/DeepSea/AssemblyResolver.cs
View File

@ -177,7 +177,8 @@ namespace de4dot.code.deobfuscators.DeepSea {
foreach (var fieldInfo in fieldInfos) {
var decrypted = decryptResourceV4(fieldInfo.field.InitialValue, fieldInfo.magic);
infos.Add(getAssemblyInfo(decrypted, null));
fieldInfo.field.InitialValue = new byte[0];
fieldInfo.field.InitialValue = new byte[1];
fieldInfo.field.FieldType = module.TypeSystem.Byte;
}
return infos;

3
de4dot.code/deobfuscators/DeepSea/ResourceResolver.cs
View File

@ -137,7 +137,8 @@ namespace de4dot.code.deobfuscators.DeepSea {
string name = string.Format("Embedded data field {0:X8} RVA {0:X8}", resourceField.MetadataToken.ToInt32(), resourceField.RVA);
DeobUtils.decryptAndAddResources(module, name, () => decryptResourceV4(resourceField.InitialValue, magicV4));
resourceField.InitialValue = new byte[0];
resourceField.InitialValue = new byte[1];
resourceField.FieldType = module.TypeSystem.Byte;
}
return true;
}

3
de4dot.code/deobfuscators/DeepSea/StringDecrypter.cs
View File

@ -256,7 +256,8 @@ namespace de4dot.code.deobfuscators.DeepSea {
}
public void cleanup() {
encryptedDataField.InitialValue = new byte[0];
encryptedDataField.InitialValue = new byte[1];
encryptedDataField.FieldType = encryptedDataField.Module.TypeSystem.Byte;
}
}