monocul.us/de4dot-cex
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Detect Confuser 1.8 r75369 proxy methods creator

Browse Source
This commit is contained in:
de4dot 2012-08-10 23:18:44 +02:00
parent e256ecfa9a
commit 965bf1f2e6
1 changed files with 12 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
de4dot.code/deobfuscators/Confuser/ProxyCallFixer.cs
View File

@ -57,6 +57,8 @@ namespace de4dot.code.deobfuscators.Confuser {
v17_r74708_native,
v18_r75367_normal,
v18_r75367_native,
v18_r75369_normal,
v18_r75369_native,
v19_r76101_normal,
v19_r76101_native,
}
@ -232,11 +234,13 @@ namespace de4dot.code.deobfuscators.Confuser {
break;
case ConfuserVersion.v18_r75367_normal:
case ConfuserVersion.v18_r75369_normal:
case ConfuserVersion.v19_r76101_normal:
getCallInfo_v18_r75367_normal(info, creatorInfo, out calledMethod, out callOpcode);
break;
case ConfuserVersion.v18_r75367_native:
case ConfuserVersion.v18_r75369_native:
case ConfuserVersion.v19_r76101_native:
getCallInfo_v18_r75367_native(info, creatorInfo, out calledMethod, out callOpcode);
break;
@ -504,9 +508,9 @@ namespace de4dot.code.deobfuscators.Confuser {
if (proxyType == ProxyCreatorType.CallOrCallvirt && !findCallvirtChar(method, out callvirtChar))
continue;
if ((nativeMethod = findNativeMethod_v18_r75367(method)) != null)
theVersion = ConfuserVersion.v18_r75367_native;
theVersion = proxyType != ProxyCreatorType.CallOrCallvirt || callvirtChar == 9 ? ConfuserVersion.v18_r75367_native : ConfuserVersion.v18_r75369_native;
else if (findMagic_v18_r75367(method, out magic))
theVersion = ConfuserVersion.v18_r75367_normal;
theVersion = proxyType != ProxyCreatorType.CallOrCallvirt || callvirtChar == 9 ? ConfuserVersion.v18_r75367_normal : ConfuserVersion.v18_r75369_normal;
else if (findMagic_v19_r76101(method, out magic))
theVersion = ConfuserVersion.v19_r76101_normal;
else if ((nativeMethod = findNativeMethod_v19_r76101(method)) != null)
@ -1123,6 +1127,12 @@ namespace de4dot.code.deobfuscators.Confuser {
maxRev = 75926;
return true;
case ConfuserVersion.v18_r75369_normal:
case ConfuserVersion.v18_r75369_native:
minRev = 75369;
maxRev = 75926;
return true;
case ConfuserVersion.v19_r76101_normal:
case ConfuserVersion.v19_r76101_native:
minRev = 76101;