From a2038f348e489ac1af11cbad6eb3a7b164978c5d Mon Sep 17 00:00:00 2001
From: de4dot <de4dot@gmail.com>
Date: Tue, 31 Jul 2012 09:12:11 +0200
Subject: [PATCH] Support Confuser 1.3 r42915 "safe" string decrypter

---
 de4dot.code/deobfuscators/Confuser/StringDecrypter.cs | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/de4dot.code/deobfuscators/Confuser/StringDecrypter.cs b/de4dot.code/deobfuscators/Confuser/StringDecrypter.cs
index 542f0cd8..7677503c 100644
--- a/de4dot.code/deobfuscators/Confuser/StringDecrypter.cs
+++ b/de4dot.code/deobfuscators/Confuser/StringDecrypter.cs
@@ -309,12 +309,15 @@ namespace de4dot.code.deobfuscators.Confuser {
 				if (!findMagic2(method, out magic2))
 					continue;
 
-				if (!localTypes.exists("System.Random"))
+				if (DotNetUtils.callsMethod(method, "System.Text.Encoding System.Text.Encoding::get_UTF8()"))
+					version = ConfuserVersion.v10_r42915;
+				else if (!localTypes.exists("System.Random"))
 					version = ConfuserVersion.v11_r49299;
 				else if (localTypes.exists("System.Collections.Generic.Dictionary`2<System.Int32,System.String>"))
 					version = ConfuserVersion.v10_r48832;
 				else
-					version = ConfuserVersion.v10_r42915;
+					continue;
+
 				resource = tmpResource;
 				decryptMethod = method;
 				break;