monocul.us/de4dot-cex
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Remove call to InitializeArray

Browse Source
This commit is contained in:
de4dot 2012-07-18 14:39:27 +02:00
parent d0712b46aa
commit 9b71da3633
1 changed files with 25 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
de4dot.code/deobfuscators/DeepSea/StringDecrypter.cs
View File

@ -127,6 +127,29 @@ namespace de4dot.code.deobfuscators.DeepSea {
return false; return false;
} }
static void removeInitializeArrayCall(MethodDefinition method, FieldDefinition field) {
var instrs = method.Body.Instructions;
for (int i = 0; i < instrs.Count - 1; i++) {
var ldtoken = instrs[i];
if (ldtoken.OpCode.Code != Code.Ldtoken)
continue;
if (ldtoken.Operand != field)
continue;
var call = instrs[i + 1];
if (call.OpCode.Code != Code.Call)
continue;
var calledMethod = call.Operand as MethodReference;
if (calledMethod == null)
continue;
if (calledMethod.ToString() != "System.Void System.Runtime.CompilerServices.RuntimeHelpers::InitializeArray(System.Array,System.RuntimeFieldHandle)")
continue;
instrs[i] = Instruction.Create(OpCodes.Pop);
instrs[i + 1] = Instruction.Create(OpCodes.Nop);
}
}
class DecrypterInfo41 : IDecrypterInfo { class DecrypterInfo41 : IDecrypterInfo {
MethodDefinition cctor; MethodDefinition cctor;
int magic; int magic;
@ -358,6 +381,7 @@ namespace de4dot.code.deobfuscators.DeepSea {
public void cleanup() { public void cleanup() {
arrayInfo.initField.InitialValue = new byte[1]; arrayInfo.initField.InitialValue = new byte[1];
arrayInfo.initField.FieldType = arrayInfo.initField.Module.TypeSystem.Byte; arrayInfo.initField.FieldType = arrayInfo.initField.Module.TypeSystem.Byte;
removeInitializeArrayCall(cctor, arrayInfo.initField);
} }
} }
@ -516,6 +540,7 @@ namespace de4dot.code.deobfuscators.DeepSea {
public void cleanup() { public void cleanup() {
encryptedDataField.InitialValue = new byte[1]; encryptedDataField.InitialValue = new byte[1];
encryptedDataField.FieldType = encryptedDataField.Module.TypeSystem.Byte; encryptedDataField.FieldType = encryptedDataField.Module.TypeSystem.Byte;
removeInitializeArrayCall(cctor, encryptedDataField);
} }
} }