From 989e3644810e27e64d3570707805d703cdc1aabe Mon Sep 17 00:00:00 2001
From: de4dot <de4dot@gmail.com>
Date: Tue, 20 Nov 2012 05:35:05 +0100
Subject: [PATCH] Fix detection of DS string decrypter

---
 .../deobfuscators/DeepSea/StringDecrypter.cs  | 23 +++++++++++--------
 1 file changed, 13 insertions(+), 10 deletions(-)

diff --git a/de4dot.code/deobfuscators/DeepSea/StringDecrypter.cs b/de4dot.code/deobfuscators/DeepSea/StringDecrypter.cs
index bb7306cb..2c221274 100644
--- a/de4dot.code/deobfuscators/DeepSea/StringDecrypter.cs
+++ b/de4dot.code/deobfuscators/DeepSea/StringDecrypter.cs
@@ -185,7 +185,7 @@ namespace de4dot.code.deobfuscators.DeepSea {
 				Method = method;
 			}
 
-			public static bool isPossibleDecrypterMethod(MethodDef method, bool firstTime) {
+			public static bool isPossibleDecrypterMethod(MethodDef method, ref bool? state) {
 				if (!checkMethodSignature(method))
 					return false;
 				var fields = getFields(method);
@@ -406,8 +406,10 @@ namespace de4dot.code.deobfuscators.DeepSea {
 				this.Method = method;
 			}
 
-			public static bool isPossibleDecrypterMethod(MethodDef method, bool firstTime) {
-				if (!firstTime || !checkFields(method.DeclaringType.Fields))
+			public static bool isPossibleDecrypterMethod(MethodDef method, ref bool? state) {
+				if (state == null)
+					state = checkFields(method.DeclaringType.Fields);
+				if (!state.Value)
 					return false;
 				return DotNetUtils.isMethod(method, "System.String", "(System.Int32,System.Int32)");
 			}
@@ -559,8 +561,10 @@ namespace de4dot.code.deobfuscators.DeepSea {
 				get { return DecrypterVersion.V1_3; }
 			}
 
-			public static bool isPossibleDecrypterMethod(MethodDef method, bool firstTime) {
-				if (!firstTime || !checkFields(method.DeclaringType.Fields))
+			public static bool isPossibleDecrypterMethod(MethodDef method, ref bool? state) {
+				if (state == null)
+					state = checkFields(method.DeclaringType.Fields);
+				if (!state.Value)
 					return false;
 				return DotNetUtils.isMethod(method, "System.String", "(System.Int32)");
 			}
@@ -737,29 +741,28 @@ namespace de4dot.code.deobfuscators.DeepSea {
 					continue;
 
 				bool deobfuscatedCctor = false;
-				bool firstTime = true;
+				bool? v13State = null, v40State = null, v41State = null;
 				foreach (var method in type.Methods) {
 					if (!method.IsStatic || method.Body == null)
 						continue;
 
 					IDecrypterInfo info = null;
 
-					if (DecrypterInfo13.isPossibleDecrypterMethod(method, firstTime)) {
+					if (DecrypterInfo13.isPossibleDecrypterMethod(method, ref v13State)) {
 						deobfuscateCctor(simpleDeobfuscator, cctor, ref deobfuscatedCctor, hasPublicKeyToken);
 						simpleDeobfuscator.deobfuscate(method);
 						info = getInfoV13(cctor, method);
 					}
-					else if (DecrypterInfo40.isPossibleDecrypterMethod(method, firstTime)) {
+					else if (DecrypterInfo40.isPossibleDecrypterMethod(method, ref v40State)) {
 						deobfuscateCctor(simpleDeobfuscator, cctor, ref deobfuscatedCctor, hasPublicKeyToken);
 						simpleDeobfuscator.deobfuscate(method);
 						info = getInfoV40(cctor, method);
 					}
-					else if (DecrypterInfo41.isPossibleDecrypterMethod(method, firstTime)) {
+					else if (DecrypterInfo41.isPossibleDecrypterMethod(method, ref v41State)) {
 						deobfuscateCctor(simpleDeobfuscator, cctor, ref deobfuscatedCctor, hasPublicKeyToken);
 						simpleDeobfuscator.deobfuscate(method);
 						info = getInfoV41(cctor, method);
 					}
-					firstTime = false;
 
 					if (info == null)
 						continue;