Make sure it gets an RVA, and change field type to byte
This commit is contained in:
parent
5c98e81e78
commit
8fbcdeb060
|
@ -177,7 +177,8 @@ namespace de4dot.code.deobfuscators.DeepSea {
|
||||||
foreach (var fieldInfo in fieldInfos) {
|
foreach (var fieldInfo in fieldInfos) {
|
||||||
var decrypted = decryptResourceV4(fieldInfo.field.InitialValue, fieldInfo.magic);
|
var decrypted = decryptResourceV4(fieldInfo.field.InitialValue, fieldInfo.magic);
|
||||||
infos.Add(getAssemblyInfo(decrypted, null));
|
infos.Add(getAssemblyInfo(decrypted, null));
|
||||||
fieldInfo.field.InitialValue = new byte[0];
|
fieldInfo.field.InitialValue = new byte[1];
|
||||||
|
fieldInfo.field.FieldType = module.TypeSystem.Byte;
|
||||||
}
|
}
|
||||||
|
|
||||||
return infos;
|
return infos;
|
||||||
|
|
|
@ -137,7 +137,8 @@ namespace de4dot.code.deobfuscators.DeepSea {
|
||||||
|
|
||||||
string name = string.Format("Embedded data field {0:X8} RVA {0:X8}", resourceField.MetadataToken.ToInt32(), resourceField.RVA);
|
string name = string.Format("Embedded data field {0:X8} RVA {0:X8}", resourceField.MetadataToken.ToInt32(), resourceField.RVA);
|
||||||
DeobUtils.decryptAndAddResources(module, name, () => decryptResourceV4(resourceField.InitialValue, magicV4));
|
DeobUtils.decryptAndAddResources(module, name, () => decryptResourceV4(resourceField.InitialValue, magicV4));
|
||||||
resourceField.InitialValue = new byte[0];
|
resourceField.InitialValue = new byte[1];
|
||||||
|
resourceField.FieldType = module.TypeSystem.Byte;
|
||||||
}
|
}
|
||||||
return true;
|
return true;
|
||||||
}
|
}
|
||||||
|
|
|
@ -256,7 +256,8 @@ namespace de4dot.code.deobfuscators.DeepSea {
|
||||||
}
|
}
|
||||||
|
|
||||||
public void cleanup() {
|
public void cleanup() {
|
||||||
encryptedDataField.InitialValue = new byte[0];
|
encryptedDataField.InitialValue = new byte[1];
|
||||||
|
encryptedDataField.FieldType = encryptedDataField.Module.TypeSystem.Byte;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
Loading…
Reference in New Issue
Block a user