diff --git a/de4dot.code/deobfuscators/dotNET_Reactor3/DecrypterType.cs b/de4dot.code/deobfuscators/dotNET_Reactor3/DecrypterType.cs index d6aefdda..335c2bcd 100644 --- a/de4dot.code/deobfuscators/dotNET_Reactor3/DecrypterType.cs +++ b/de4dot.code/deobfuscators/dotNET_Reactor3/DecrypterType.cs @@ -33,6 +33,7 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor3 { MethodDefinition stringDecrypter2; List initMethods = new List(); List moduleReferences = new List(); + Resource linkedResource; public bool Detected { get { return decrypterType != null; } @@ -42,6 +43,10 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor3 { get { return decrypterType; } } + public Resource LinkedResource { + get { return linkedResource; } + } + public MethodDefinition StringDecrypter1 { get { return stringDecrypter1; } } @@ -113,6 +118,18 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor3 { } } } + updateLinkedResource(); + } + + void updateLinkedResource() { + foreach (var modref in moduleReferences) { + var resource = DotNetUtils.getResource(module, modref.Name) as LinkedResource; + if (resource == null) + continue; + + linkedResource = resource; + return; + } } MethodDefinition addStringDecrypter(TypeDefinition type, string name) { diff --git a/de4dot.code/deobfuscators/dotNET_Reactor3/Deobfuscator.cs b/de4dot.code/deobfuscators/dotNET_Reactor3/Deobfuscator.cs index 46914c91..1741b142 100644 --- a/de4dot.code/deobfuscators/dotNET_Reactor3/Deobfuscator.cs +++ b/de4dot.code/deobfuscators/dotNET_Reactor3/Deobfuscator.cs @@ -299,6 +299,7 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor3 { if (canRemoveDecrypterType && !isTypeCalled(decrypterType.Type)) { addTypeToBeRemoved(decrypterType.Type, "Decrypter type"); addModuleReferencesToBeRemoved(decrypterType.ModuleReferences, "Native lib module references"); + addResourceToBeRemoved(decrypterType.LinkedResource, "Native lib resource"); } base.deobfuscateEnd();