Remove tamper detection code

de4dot.code/de4dot.code.csproj

@@ -86,6 +86,7 @@
     <Compile Include="deobfuscators\CodeVeil\StringDecrypter.cs" />
     <Compile Include="deobfuscators\CodeVeil\Deobfuscator.cs" />
     <Compile Include="deobfuscators\CodeVeil\ProxyDelegateFinder.cs" />
+    <Compile Include="deobfuscators\CodeVeil\TamperDetection.cs" />
     <Compile Include="deobfuscators\CryptoObfuscator\AntiDebugger.cs" />
     <Compile Include="deobfuscators\CryptoObfuscator\AssemblyResolver.cs" />
     <Compile Include="deobfuscators\CryptoObfuscator\Deobfuscator.cs" />

de4dot.code/deobfuscators/CodeVeil/Deobfuscator.cs

@@ -81,6 +81,7 @@ namespace de4dot.code.deobfuscators.CodeVeil {
 		public Deobfuscator(Options options)
 			: base(options) {
 			this.options = options;
+			StringFeatures = StringFeatures.AllowStaticDecryption | StringFeatures.AllowDynamicDecryption;
 		}
 
 		protected override int detectInternal() {
@@ -174,6 +175,8 @@ namespace de4dot.code.deobfuscators.CodeVeil {
 		public override void deobfuscateBegin() {
 			base.deobfuscateBegin();
 
+			mainType.initialize();
+
 			if (Operations.DecryptStrings != OpDecryptString.None) {
 				stringDecrypter.initialize();
 				staticStringInliner.add(stringDecrypter.DecryptMethod, (method, args) => {
@@ -186,10 +189,20 @@ namespace de4dot.code.deobfuscators.CodeVeil {
 			assemblyResolver.initialize();
 			dumpEmbeddedAssemblies();
 
+			removeTamperDetection();
+
 			proxyDelegateFinder.initialize();
 			proxyDelegateFinder.find();
 		}
 
+		void removeTamperDetection() {
+			var tamperDetection = new TamperDetection(module, mainType);
+			tamperDetection.initialize();
+			foreach (var tamperDetectionMethod in tamperDetection.Methods)
+				addCctorInitCallToBeRemoved(tamperDetectionMethod);
+			addTypeToBeRemoved(tamperDetection.Type, "Tamper detection type");
+		}
+
 		void dumpEmbeddedAssemblies() {
 			foreach (var info in assemblyResolver.AssemblyInfos)
 				DeobfuscatedFile.createAssemblyFile(info.data, info.simpleName, info.extension);

de4dot.code/deobfuscators/CodeVeil/MainType.cs

@@ -29,6 +29,7 @@ namespace de4dot.code.deobfuscators.CodeVeil {
 		ModuleDefinition module;
 		TypeDefinition theType;
 		MethodDefinition initMethod;
+		MethodDefinition tamperCheckMethod;
 		ObfuscatorVersion obfuscatorVersion = ObfuscatorVersion.Unknown;
 		List<int> rvas = new List<int>();	// _stub and _executive
 
@@ -48,6 +49,10 @@ namespace de4dot.code.deobfuscators.CodeVeil {
 			get { return initMethod; }
 		}
 
+		public MethodDefinition TamperCheckMethod {
+			get { return tamperCheckMethod; }
+		}
+
 		public List<int> Rvas {
 			get { return rvas; }
 		}
@@ -60,6 +65,7 @@ namespace de4dot.code.deobfuscators.CodeVeil {
 			this.module = module;
 			this.theType = lookup(oldOne.theType, "Could not find main type");
 			this.initMethod = lookup(oldOne.initMethod, "Could not find main type init method");
+			this.tamperCheckMethod = lookup(oldOne.tamperCheckMethod, "Could not find tamper detection method");
 			this.obfuscatorVersion = oldOne.obfuscatorVersion;
 			this.rvas = oldOne.rvas;
 		}
@@ -166,5 +172,22 @@ namespace de4dot.code.deobfuscators.CodeVeil {
 			}
 			return fields;
 		}
+
+		public void initialize() {
+			tamperCheckMethod = findTamperCheckMethod();
+		}
+
+		MethodDefinition findTamperCheckMethod() {
+			foreach (var method in theType.Methods) {
+				if (!method.IsStatic || method.Body == null)
+					continue;
+				if (!DotNetUtils.isMethod(method, "System.Void", "(System.Reflection.Assembly,System.UInt64)"))
+					continue;
+
+				return method;
+			}
+
+			return null;
+		}
 	}
 }

de4dot.code/deobfuscators/CodeVeil/TamperDetection.cs

@@ -0,0 +1,124 @@
+/*
+    Copyright (C) 2011-2012 de4dot@gmail.com
+
+    This file is part of de4dot.
+
+    de4dot is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    de4dot is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with de4dot.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+using System.Collections.Generic;
+using Mono.Cecil;
+using Mono.Cecil.Metadata;
+using de4dot.blocks;
+
+namespace de4dot.code.deobfuscators.CodeVeil {
+	class TamperDetection {
+		ModuleDefinition module;
+		MainType mainType;
+		TypeDefinition tamperDetectionType;
+		List<MethodDefinition> tamperDetectionMethods = new List<MethodDefinition>();
+
+		public TypeDefinition Type {
+			get { return tamperDetectionType; }
+		}
+
+		public List<MethodDefinition> Methods {
+			get { return tamperDetectionMethods; }
+		}
+
+		public TamperDetection(ModuleDefinition module, MainType mainType) {
+			this.module = module;
+			this.mainType = mainType;
+		}
+
+		public void initialize() {
+			if (!mainType.Detected)
+				return;
+
+			if (mainType.TamperCheckMethod == null)
+				return;
+
+			findTamperDetectionTypes();
+		}
+
+		void findTamperDetectionTypes() {
+			foreach (var type in module.Types) {
+				if (!type.HasNestedTypes)
+					continue;
+				if ((type.Attributes & ~TypeAttributes.Sealed) != 0)
+					continue;
+
+				if (!checkTamperDetectionClasses(type.NestedTypes))
+					continue;
+
+				tamperDetectionType = type;
+				findTamperDetectionMethods();
+				return;
+			}
+		}
+
+		void findTamperDetectionMethods() {
+			foreach (var type in tamperDetectionType.NestedTypes) {
+				foreach (var method in type.Methods) {
+					if (!method.IsStatic || method.Body == null)
+						continue;
+					if (method.Name == ".cctor")
+						continue;
+					if (DotNetUtils.isMethod(method, "System.Void", "()"))
+						tamperDetectionMethods.Add(method);
+				}
+			}
+		}
+
+		bool checkTamperDetectionClasses(IEnumerable<TypeDefinition> types) {
+			foreach (var type in types) {
+				if (!isTamperDetectionClass(type))
+					return false;
+			}
+			return true;
+		}
+
+		bool isTamperDetectionClass(TypeDefinition type) {
+			if (type.BaseType == null || type.BaseType.EType != ElementType.Object)
+				return false;
+			if ((type.Attributes & ~TypeAttributes.Sealed) != TypeAttributes.NestedAssembly)
+				return false;
+
+			MethodDefinition cctor = null, initMethod = null;
+			foreach (var method in type.Methods) {
+				if (!method.IsStatic || method.Body == null)
+					return false;
+				if (method.Name == ".cctor")
+					cctor = method;
+				else if (DotNetUtils.isMethod(method, "System.Void", "()"))
+					initMethod = method;
+			}
+			if (cctor == null || initMethod == null)
+				return false;
+
+			if (!callsMainTypeTamperCheckMethod(cctor))
+				return false;
+
+			return true;
+		}
+
+		bool callsMainTypeTamperCheckMethod(MethodDefinition method) {
+			foreach (var info in DotNetUtils.getCalledMethods(module, method)) {
+				if (info.Item2 == mainType.TamperCheckMethod)
+					return true;
+			}
+			return false;
+		}
+	}
+}