Detect Confuser 1.8 r75367 compressor
This commit is contained in:
parent
edac6b1a91
commit
94acbc7131
|
@ -83,6 +83,7 @@ namespace de4dot.code.deobfuscators.Confuser {
|
|||
v17_r73477,
|
||||
v17_r75076,
|
||||
v18_r75184,
|
||||
v18_r75367,
|
||||
}
|
||||
|
||||
public bool Detected {
|
||||
|
@ -153,8 +154,10 @@ namespace de4dot.code.deobfuscators.Confuser {
|
|||
if (use7zip) {
|
||||
if (new LocalTypes(decyptMethod).exists("System.IO.MemoryStream"))
|
||||
version = ConfuserVersion.v17_r75076;
|
||||
else
|
||||
else if (module.Name == "Stub.exe")
|
||||
version = ConfuserVersion.v18_r75184;
|
||||
else
|
||||
version = ConfuserVersion.v18_r75367;
|
||||
}
|
||||
else if (isDecryptMethod_v17_r73404(decyptMethod))
|
||||
version = ConfuserVersion.v17_r73404;
|
||||
|
@ -448,6 +451,7 @@ namespace de4dot.code.deobfuscators.Confuser {
|
|||
case ConfuserVersion.v17_r73477: return decrypt_v17_r73404(data);
|
||||
case ConfuserVersion.v17_r75076: return decrypt_v17_r75076(data);
|
||||
case ConfuserVersion.v18_r75184: return decrypt_v17_r75076(data);
|
||||
case ConfuserVersion.v18_r75367: return decrypt_v17_r75076(data);
|
||||
default: throw new ApplicationException("Unknown version");
|
||||
}
|
||||
}
|
||||
|
|
Loading…
Reference in New Issue
Block a user