diff --git a/de4dot.code/deobfuscators/CryptoObfuscator/AntiDebugger.cs b/de4dot.code/deobfuscators/CryptoObfuscator/AntiDebugger.cs index afd67885..4a8dfc67 100644 --- a/de4dot.code/deobfuscators/CryptoObfuscator/AntiDebugger.cs +++ b/de4dot.code/deobfuscators/CryptoObfuscator/AntiDebugger.cs @@ -67,7 +67,8 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator { !containsString(method, "Debugger detected") && !containsString(method, "Debugger was detected") && !containsString(method, "{0} was detected") && - !containsString(method, "run under")) + !containsString(method, "run under") && + !containsString(method, "run with")) continue; antiDebuggerType = type; diff --git a/de4dot.code/deobfuscators/CryptoObfuscator/ProxyCallFixer.cs b/de4dot.code/deobfuscators/CryptoObfuscator/ProxyCallFixer.cs index a7b9cd8b..f95e394a 100644 --- a/de4dot.code/deobfuscators/CryptoObfuscator/ProxyCallFixer.cs +++ b/de4dot.code/deobfuscators/CryptoObfuscator/ProxyCallFixer.cs @@ -110,7 +110,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator { MethodDef getProxyCreateMethod(TypeDef type) { if (DotNetUtils.findFieldType(type, "System.ModuleHandle", true) == null) return null; - if (type.Fields.Count < 1 || type.Fields.Count > 14) + if (type.Fields.Count < 1 || type.Fields.Count > 16) return null; MethodDef createMethod = null; diff --git a/de4dot.code/deobfuscators/CryptoObfuscator/ResourceDecrypter.cs b/de4dot.code/deobfuscators/CryptoObfuscator/ResourceDecrypter.cs index 43626593..9200ad89 100644 --- a/de4dot.code/deobfuscators/CryptoObfuscator/ResourceDecrypter.cs +++ b/de4dot.code/deobfuscators/CryptoObfuscator/ResourceDecrypter.cs @@ -79,9 +79,9 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator { bool findDesktopOrCompactFramework() { resourceDecrypterType = null; foreach (var type in module.Types) { - if (type.Fields.Count != 5) + if (type.Fields.Count < 5) continue; - if (!new FieldTypes(type).exactly(requiredTypes)) + if (!new FieldTypes(type).all(requiredTypes)) continue; var cctor = type.FindStaticConstructor(); @@ -300,6 +300,8 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator { foreach (var method in type.Methods) { if (DotNetUtils.isMethod(method, "System.Byte[]", "(System.IO.Stream)")) yield return method; + else if (DotNetUtils.isMethod(method, "System.Byte[]", "(System.Int64,System.IO.Stream)")) + yield return method; else if (DotNetUtils.isMethod(method, "System.Byte[]", "(System.Int32,System.IO.Stream)")) yield return method; else if (DotNetUtils.isMethod(method, "System.Byte[]", "(System.Int16,System.IO.Stream)")) diff --git a/de4dot.code/deobfuscators/CryptoObfuscator/TamperDetection.cs b/de4dot.code/deobfuscators/CryptoObfuscator/TamperDetection.cs index d1ff7166..fc76ad37 100644 --- a/de4dot.code/deobfuscators/CryptoObfuscator/TamperDetection.cs +++ b/de4dot.code/deobfuscators/CryptoObfuscator/TamperDetection.cs @@ -84,7 +84,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator { if (!method.IsStatic || !DotNetUtils.isMethod(method, "System.Void", "()")) return false; - if (type.Methods.Count < 3 || type.Methods.Count > 20) + if (type.Methods.Count < 3 || type.Methods.Count > 24) return false; if (DotNetUtils.getPInvokeMethod(type, "mscoree", "StrongNameSignatureVerificationEx") != null) { }