Detect Confuser 1.8 r75369 proxy methods creator
This commit is contained in:
parent
e256ecfa9a
commit
965bf1f2e6
|
@ -57,6 +57,8 @@ namespace de4dot.code.deobfuscators.Confuser {
|
||||||
v17_r74708_native,
|
v17_r74708_native,
|
||||||
v18_r75367_normal,
|
v18_r75367_normal,
|
||||||
v18_r75367_native,
|
v18_r75367_native,
|
||||||
|
v18_r75369_normal,
|
||||||
|
v18_r75369_native,
|
||||||
v19_r76101_normal,
|
v19_r76101_normal,
|
||||||
v19_r76101_native,
|
v19_r76101_native,
|
||||||
}
|
}
|
||||||
|
@ -232,11 +234,13 @@ namespace de4dot.code.deobfuscators.Confuser {
|
||||||
break;
|
break;
|
||||||
|
|
||||||
case ConfuserVersion.v18_r75367_normal:
|
case ConfuserVersion.v18_r75367_normal:
|
||||||
|
case ConfuserVersion.v18_r75369_normal:
|
||||||
case ConfuserVersion.v19_r76101_normal:
|
case ConfuserVersion.v19_r76101_normal:
|
||||||
getCallInfo_v18_r75367_normal(info, creatorInfo, out calledMethod, out callOpcode);
|
getCallInfo_v18_r75367_normal(info, creatorInfo, out calledMethod, out callOpcode);
|
||||||
break;
|
break;
|
||||||
|
|
||||||
case ConfuserVersion.v18_r75367_native:
|
case ConfuserVersion.v18_r75367_native:
|
||||||
|
case ConfuserVersion.v18_r75369_native:
|
||||||
case ConfuserVersion.v19_r76101_native:
|
case ConfuserVersion.v19_r76101_native:
|
||||||
getCallInfo_v18_r75367_native(info, creatorInfo, out calledMethod, out callOpcode);
|
getCallInfo_v18_r75367_native(info, creatorInfo, out calledMethod, out callOpcode);
|
||||||
break;
|
break;
|
||||||
|
@ -504,9 +508,9 @@ namespace de4dot.code.deobfuscators.Confuser {
|
||||||
if (proxyType == ProxyCreatorType.CallOrCallvirt && !findCallvirtChar(method, out callvirtChar))
|
if (proxyType == ProxyCreatorType.CallOrCallvirt && !findCallvirtChar(method, out callvirtChar))
|
||||||
continue;
|
continue;
|
||||||
if ((nativeMethod = findNativeMethod_v18_r75367(method)) != null)
|
if ((nativeMethod = findNativeMethod_v18_r75367(method)) != null)
|
||||||
theVersion = ConfuserVersion.v18_r75367_native;
|
theVersion = proxyType != ProxyCreatorType.CallOrCallvirt || callvirtChar == 9 ? ConfuserVersion.v18_r75367_native : ConfuserVersion.v18_r75369_native;
|
||||||
else if (findMagic_v18_r75367(method, out magic))
|
else if (findMagic_v18_r75367(method, out magic))
|
||||||
theVersion = ConfuserVersion.v18_r75367_normal;
|
theVersion = proxyType != ProxyCreatorType.CallOrCallvirt || callvirtChar == 9 ? ConfuserVersion.v18_r75367_normal : ConfuserVersion.v18_r75369_normal;
|
||||||
else if (findMagic_v19_r76101(method, out magic))
|
else if (findMagic_v19_r76101(method, out magic))
|
||||||
theVersion = ConfuserVersion.v19_r76101_normal;
|
theVersion = ConfuserVersion.v19_r76101_normal;
|
||||||
else if ((nativeMethod = findNativeMethod_v19_r76101(method)) != null)
|
else if ((nativeMethod = findNativeMethod_v19_r76101(method)) != null)
|
||||||
|
@ -1123,6 +1127,12 @@ namespace de4dot.code.deobfuscators.Confuser {
|
||||||
maxRev = 75926;
|
maxRev = 75926;
|
||||||
return true;
|
return true;
|
||||||
|
|
||||||
|
case ConfuserVersion.v18_r75369_normal:
|
||||||
|
case ConfuserVersion.v18_r75369_native:
|
||||||
|
minRev = 75369;
|
||||||
|
maxRev = 75926;
|
||||||
|
return true;
|
||||||
|
|
||||||
case ConfuserVersion.v19_r76101_normal:
|
case ConfuserVersion.v19_r76101_normal:
|
||||||
case ConfuserVersion.v19_r76101_native:
|
case ConfuserVersion.v19_r76101_native:
|
||||||
minRev = 76101;
|
minRev = 76101;
|
||||||
|
|
Loading…
Reference in New Issue
Block a user