Make sure it gets an RVA, and change field type to byte
This commit is contained in:
parent
5c98e81e78
commit
8fbcdeb060
|
@ -177,7 +177,8 @@ namespace de4dot.code.deobfuscators.DeepSea {
|
|||
foreach (var fieldInfo in fieldInfos) {
|
||||
var decrypted = decryptResourceV4(fieldInfo.field.InitialValue, fieldInfo.magic);
|
||||
infos.Add(getAssemblyInfo(decrypted, null));
|
||||
fieldInfo.field.InitialValue = new byte[0];
|
||||
fieldInfo.field.InitialValue = new byte[1];
|
||||
fieldInfo.field.FieldType = module.TypeSystem.Byte;
|
||||
}
|
||||
|
||||
return infos;
|
||||
|
|
|
@ -137,7 +137,8 @@ namespace de4dot.code.deobfuscators.DeepSea {
|
|||
|
||||
string name = string.Format("Embedded data field {0:X8} RVA {0:X8}", resourceField.MetadataToken.ToInt32(), resourceField.RVA);
|
||||
DeobUtils.decryptAndAddResources(module, name, () => decryptResourceV4(resourceField.InitialValue, magicV4));
|
||||
resourceField.InitialValue = new byte[0];
|
||||
resourceField.InitialValue = new byte[1];
|
||||
resourceField.FieldType = module.TypeSystem.Byte;
|
||||
}
|
||||
return true;
|
||||
}
|
||||
|
|
|
@ -256,7 +256,8 @@ namespace de4dot.code.deobfuscators.DeepSea {
|
|||
}
|
||||
|
||||
public void cleanup() {
|
||||
encryptedDataField.InitialValue = new byte[0];
|
||||
encryptedDataField.InitialValue = new byte[1];
|
||||
encryptedDataField.FieldType = encryptedDataField.Module.TypeSystem.Byte;
|
||||
}
|
||||
}
|
||||
|
||||
|
|
Loading…
Reference in New Issue
Block a user