diff --git a/de4dot.code/deobfuscators/CryptoObfuscator/AntiDebugger.cs b/de4dot.code/deobfuscators/CryptoObfuscator/AntiDebugger.cs index c77115c0..5d0a84f5 100644 --- a/de4dot.code/deobfuscators/CryptoObfuscator/AntiDebugger.cs +++ b/de4dot.code/deobfuscators/CryptoObfuscator/AntiDebugger.cs @@ -70,7 +70,8 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator { !ContainsString(method, "run under") && !ContainsString(method, "run with") && !ContainsString(method, "started under") && - !ContainsString(method, "{0} detected")) + !ContainsString(method, "{0} detected") && + !ContainsString(method, "{0} found")) continue; antiDebuggerType = type; diff --git a/de4dot.code/deobfuscators/CryptoObfuscator/ProxyCallFixer.cs b/de4dot.code/deobfuscators/CryptoObfuscator/ProxyCallFixer.cs index b296ff6c..d8ff5395 100644 --- a/de4dot.code/deobfuscators/CryptoObfuscator/ProxyCallFixer.cs +++ b/de4dot.code/deobfuscators/CryptoObfuscator/ProxyCallFixer.cs @@ -110,7 +110,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator { MethodDef GetProxyCreateMethod(TypeDef type) { if (DotNetUtils.FindFieldType(type, "System.ModuleHandle", true) == null) return null; - if (type.Fields.Count < 1 || type.Fields.Count > 18) + if (type.Fields.Count < 1 || type.Fields.Count > 20) return null; MethodDef createMethod = null; diff --git a/de4dot.code/deobfuscators/CryptoObfuscator/ResourceDecrypter.cs b/de4dot.code/deobfuscators/CryptoObfuscator/ResourceDecrypter.cs index c836d621..3449cc90 100644 --- a/de4dot.code/deobfuscators/CryptoObfuscator/ResourceDecrypter.cs +++ b/de4dot.code/deobfuscators/CryptoObfuscator/ResourceDecrypter.cs @@ -180,6 +180,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator { } static bool CheckFlipBits(MethodDef method) { + int nots = 0; var instrs = method.Body.Instructions; for (int i = 0; i < instrs.Count - 1; i++) { var ldloc = instrs[i]; @@ -189,14 +190,11 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator { if (local == null || local.Type.GetElementType().GetPrimitiveSize() < 0) continue; - var not = instrs[i + 1]; - if (not.OpCode.Code != Code.Not) - continue; - - return true; + if (instrs[i + 1].OpCode.Code == Code.Not) + nots++; } - return false; + return (nots & 1) == 1; } bool UpdateFlags(MethodDef method, ISimpleDeobfuscator simpleDeobfuscator) { diff --git a/de4dot.code/deobfuscators/CryptoObfuscator/TamperDetection.cs b/de4dot.code/deobfuscators/CryptoObfuscator/TamperDetection.cs index 1a44a36a..79392332 100644 --- a/de4dot.code/deobfuscators/CryptoObfuscator/TamperDetection.cs +++ b/de4dot.code/deobfuscators/CryptoObfuscator/TamperDetection.cs @@ -84,7 +84,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator { if (!method.IsStatic || !DotNetUtils.IsMethod(method, "System.Void", "()")) return false; - if (type.Methods.Count < 3 || type.Methods.Count > 27) + if (type.Methods.Count < 3 || type.Methods.Count > 31) return false; if (DotNetUtils.GetPInvokeMethod(type, "mscoree", "StrongNameSignatureVerificationEx") != null) { }