Call the correct ctor
This commit is contained in:
parent
926d53885e
commit
923fb1f9ca
|
@ -205,7 +205,9 @@ namespace de4dot.code.deobfuscators.Confuser {
|
||||||
CanUnpack = 2,
|
CanUnpack = 2,
|
||||||
}
|
}
|
||||||
DecryptState decryptState = DecryptState.CanDecryptMethods | DecryptState.CanUnpack;
|
DecryptState decryptState = DecryptState.CanDecryptMethods | DecryptState.CanUnpack;
|
||||||
|
bool hasUnpacked = false;
|
||||||
public override bool getDecryptedModule(int count, ref byte[] newFileData, ref DumpedMethods dumpedMethods) {
|
public override bool getDecryptedModule(int count, ref byte[] newFileData, ref DumpedMethods dumpedMethods) {
|
||||||
|
hasUnpacked = false;
|
||||||
byte[] fileData = getFileData();
|
byte[] fileData = getFileData();
|
||||||
var peImage = new PeImage(fileData);
|
var peImage = new PeImage(fileData);
|
||||||
|
|
||||||
|
@ -242,6 +244,7 @@ namespace de4dot.code.deobfuscators.Confuser {
|
||||||
realAssemblyInfo = mainInfo.realAssemblyInfo;
|
realAssemblyInfo = mainInfo.realAssemblyInfo;
|
||||||
embeddedAssemblyInfos.AddRange(unpacker.getEmbeddedAssemblyInfos());
|
embeddedAssemblyInfos.AddRange(unpacker.getEmbeddedAssemblyInfos());
|
||||||
ModuleBytes = newFileData;
|
ModuleBytes = newFileData;
|
||||||
|
hasUnpacked = true;
|
||||||
return true;
|
return true;
|
||||||
}
|
}
|
||||||
else {
|
else {
|
||||||
|
@ -276,7 +279,8 @@ namespace de4dot.code.deobfuscators.Confuser {
|
||||||
newOne.ModuleBytes = ModuleBytes;
|
newOne.ModuleBytes = ModuleBytes;
|
||||||
newOne.embeddedAssemblyInfos.AddRange(embeddedAssemblyInfos);
|
newOne.embeddedAssemblyInfos.AddRange(embeddedAssemblyInfos);
|
||||||
newOne.setModule(module);
|
newOne.setModule(module);
|
||||||
newOne.jitMethodsDecrypter = new JitMethodsDecrypter(module, DeobfuscatedFile, jitMethodsDecrypter);
|
newOne.jitMethodsDecrypter = hasUnpacked ? new JitMethodsDecrypter(module, DeobfuscatedFile) :
|
||||||
|
new JitMethodsDecrypter(module, DeobfuscatedFile, jitMethodsDecrypter);
|
||||||
if ((newOne.decryptState & DecryptState.CanDecryptMethods) != 0) {
|
if ((newOne.decryptState & DecryptState.CanDecryptMethods) != 0) {
|
||||||
try {
|
try {
|
||||||
newOne.jitMethodsDecrypter.find();
|
newOne.jitMethodsDecrypter.find();
|
||||||
|
@ -286,7 +290,8 @@ namespace de4dot.code.deobfuscators.Confuser {
|
||||||
if (newOne.jitMethodsDecrypter.Detected)
|
if (newOne.jitMethodsDecrypter.Detected)
|
||||||
return newOne;
|
return newOne;
|
||||||
}
|
}
|
||||||
newOne.memoryMethodsDecrypter = new MemoryMethodsDecrypter(module, DeobfuscatedFile, memoryMethodsDecrypter);
|
newOne.memoryMethodsDecrypter = hasUnpacked ? new MemoryMethodsDecrypter(module, DeobfuscatedFile) :
|
||||||
|
new MemoryMethodsDecrypter(module, DeobfuscatedFile, memoryMethodsDecrypter);
|
||||||
if ((newOne.decryptState & DecryptState.CanDecryptMethods) != 0) {
|
if ((newOne.decryptState & DecryptState.CanDecryptMethods) != 0) {
|
||||||
newOne.memoryMethodsDecrypter.find();
|
newOne.memoryMethodsDecrypter.find();
|
||||||
if (newOne.memoryMethodsDecrypter.Detected)
|
if (newOne.memoryMethodsDecrypter.Detected)
|
||||||
|
|
Loading…
Reference in New Issue
Block a user