diff --git a/de4dot.code/de4dot.code.csproj b/de4dot.code/de4dot.code.csproj index a3c92e77..5e2d54b6 100644 --- a/de4dot.code/de4dot.code.csproj +++ b/de4dot.code/de4dot.code.csproj @@ -67,6 +67,7 @@ + diff --git a/de4dot.code/deobfuscators/CryptoObfuscator/CoUtils.cs b/de4dot.code/deobfuscators/CryptoObfuscator/CoUtils.cs new file mode 100644 index 00000000..d3f37981 --- /dev/null +++ b/de4dot.code/deobfuscators/CryptoObfuscator/CoUtils.cs @@ -0,0 +1,50 @@ +/* + Copyright (C) 2011-2012 de4dot@gmail.com + + This file is part of de4dot. + + de4dot is free software: you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation, either version 3 of the License, or + (at your option) any later version. + + de4dot is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with de4dot. If not, see . +*/ + +using System; +using System.Collections.Generic; +using System.Text; +using Mono.Cecil; +using de4dot.blocks; + +namespace de4dot.code.deobfuscators.CryptoObfuscator { + static class CoUtils { + public static EmbeddedResource getResource(ModuleDefinition module, MethodDefinition method) { + if (method == null || method.Body == null) + return null; + return getResource(module, DotNetUtils.getCodeStrings(method)); + } + + public static EmbeddedResource getResource(ModuleDefinition module, IEnumerable names) { + foreach (var name in names) { + var resource = DotNetUtils.getResource(module, name) as EmbeddedResource; + if (resource != null) + return resource; + try { + resource = DotNetUtils.getResource(module, Encoding.UTF8.GetString(Convert.FromBase64String(name))) as EmbeddedResource; + if (resource != null) + return resource; + } + catch { + } + } + return null; + } + } +} diff --git a/de4dot.code/deobfuscators/CryptoObfuscator/ConstantsDecrypter.cs b/de4dot.code/deobfuscators/CryptoObfuscator/ConstantsDecrypter.cs index 6b3940a2..1fa6749b 100644 --- a/de4dot.code/deobfuscators/CryptoObfuscator/ConstantsDecrypter.cs +++ b/de4dot.code/deobfuscators/CryptoObfuscator/ConstantsDecrypter.cs @@ -106,26 +106,10 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator { if (decrypterType == null) return; - encryptedResource = getResource(module, DotNetUtils.getCodeStrings(DotNetUtils.getMethod(decrypterType, ".cctor"))); + encryptedResource = CoUtils.getResource(module, DotNetUtils.getCodeStrings(DotNetUtils.getMethod(decrypterType, ".cctor"))); constantsData = resourceDecrypter.decrypt(encryptedResource.GetResourceStream()); } - static EmbeddedResource getResource(ModuleDefinition module, IEnumerable names) { - foreach (var name in names) { - var resource = DotNetUtils.getResource(module, name) as EmbeddedResource; - if (resource != null) - return resource; - try { - resource = DotNetUtils.getResource(module, Encoding.UTF8.GetString(Convert.FromBase64String(name))) as EmbeddedResource; - if (resource != null) - return resource; - } - catch { - } - } - return null; - } - public int decryptInt32(int index) { return BitConverter.ToInt32(constantsData, index); }