Add Xenocode support (dumped modules only)

de4dot.code/Program.cs

@@ -35,6 +35,7 @@ namespace de4dot {
 				new de4dot.deobfuscators.dotNET_Reactor.DeobfuscatorInfo(),
 				new de4dot.deobfuscators.Eazfuscator.DeobfuscatorInfo(),
 				new de4dot.deobfuscators.SmartAssembly.DeobfuscatorInfo(),
+				new de4dot.deobfuscators.Xenocode.DeobfuscatorInfo(),
 			};
 		}
 

de4dot.code/de4dot.code.csproj

@@ -109,6 +109,8 @@
     <Compile Include="deobfuscators\SmartAssembly\TamperProtectionRemover.cs" />
     <Compile Include="deobfuscators\TypesRestorer.cs" />
     <Compile Include="deobfuscators\Unknown\Deobfuscator.cs" />
+    <Compile Include="deobfuscators\Xenocode\Deobfuscator.cs" />
+    <Compile Include="deobfuscators\Xenocode\StringDecrypter.cs" />
     <Compile Include="FilesDeobfuscator.cs" />
     <Compile Include="IObfuscatedFile.cs" />
     <Compile Include="Log.cs" />

de4dot.code/deobfuscators/Unknown/Deobfuscator.cs

@@ -96,8 +96,6 @@ namespace de4dot.deobfuscators.Unknown {
 					return "DeployLX CodeVeil";
 				if (type.FullName.Contains("ObfuscatedByGoliath"))
 					return "Goliath .NET Obfuscator";
-				if (type.FullName == "Xenocode.Client.Attributes.AssemblyAttributes.ProcessedByXenocode")
-					return "Xenocode";
 				if (type.FullName == "ZYXDNGuarder")
 					return "DNGuard HVM";
 				if (type.FullName == "InfaceMaxtoCode")

de4dot.code/deobfuscators/Xenocode/Deobfuscator.cs

@@ -0,0 +1,113 @@
+/*
+    Copyright (C) 2011 de4dot@gmail.com
+
+    This file is part of de4dot.
+
+    de4dot is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    de4dot is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with de4dot.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+using System.Collections.Generic;
+using Mono.Cecil;
+
+namespace de4dot.deobfuscators.Xenocode {
+	class DeobfuscatorInfo : DeobfuscatorInfoBase {
+		public const string THE_NAME = "Xenocode";
+		const string DEFAULT_REGEX = @"!^[oO01l]{4,}$&!^_?x[a-f0-9]{16,}$&" + DeobfuscatorBase.DEFAULT_VALID_NAME_REGEX;
+		public DeobfuscatorInfo()
+			: base(DEFAULT_REGEX) {
+		}
+
+		public override string Name {
+			get { return THE_NAME; }
+		}
+
+		public override string Type {
+			get { return "xc"; }
+		}
+
+		public override IDeobfuscator createDeobfuscator() {
+			return new Deobfuscator(new Deobfuscator.Options {
+				ValidNameRegex = validNameRegex.get(),
+			});
+		}
+	}
+
+	class Deobfuscator : DeobfuscatorBase {
+		bool foundXenocodeAttribute = false;
+		StringDecrypter stringDecrypter;
+
+		internal class Options : OptionsBase {
+		}
+
+		public override string Type {
+			get { return DeobfuscatorInfo.THE_NAME; }
+		}
+
+		public override string Name {
+			get { return Type; }
+		}
+
+		public Deobfuscator(Options options)
+			: base(options) {
+		}
+
+		protected override int detectInternal() {
+			int val = 0;
+
+			if (foundXenocodeAttribute || stringDecrypter.Detected)
+				val += 100;
+			if (foundXenocodeAttribute && stringDecrypter.Detected)
+				val += 10;
+
+			return val;
+		}
+
+		protected override void scanForObfuscator() {
+			findXenocodeAttribute();
+			stringDecrypter = new StringDecrypter(module);
+			stringDecrypter.find();
+		}
+
+		void findXenocodeAttribute() {
+			foreach (var type in module.Types) {
+				switch (type.FullName) {
+				case "Xenocode.Client.Attributes.AssemblyAttributes.ProcessedByXenocode":
+				case "Xenocode.Client.Attributes.AssemblyAttributes.SuppressDisassembly":
+					addAttributeToBeRemoved(type, "Obfuscator attribute");
+					foundXenocodeAttribute = true;
+					break;
+				}
+			}
+		}
+
+		public override void deobfuscateBegin() {
+			base.deobfuscateBegin();
+
+			staticStringDecrypter.add(stringDecrypter.StringDecrypterMethod, (method, args) => stringDecrypter.decrypt((string)args[0], (int)args[1]));
+		}
+
+		public override void deobfuscateEnd() {
+			if (Operations.DecryptStrings != OpDecryptString.None)
+				addTypeToBeRemoved(stringDecrypter.Type, "String decrypter type");
+			base.deobfuscateEnd();
+		}
+
+		public override IEnumerable<string> getStringDecrypterMethods() {
+			var list = new List<string>();
+			if (stringDecrypter.StringDecrypterMethod != null)
+				list.Add(stringDecrypter.StringDecrypterMethod.MetadataToken.ToInt32().ToString("X8"));
+			return list;
+		}
+	}
+}

de4dot.code/deobfuscators/Xenocode/StringDecrypter.cs

@@ -0,0 +1,100 @@
+/*
+    Copyright (C) 2011 de4dot@gmail.com
+
+    This file is part of de4dot.
+
+    de4dot is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    de4dot is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with de4dot.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+using System.Text;
+using Mono.Cecil;
+using de4dot.blocks;
+
+namespace de4dot.deobfuscators.Xenocode {
+	class StringDecrypter {
+		const int STRING_DECRYPTER_KEY_CONST = 1789;
+		ModuleDefinition module;
+		TypeDefinition stringDecrypterType;
+		MethodDefinition stringDecrypterMethod;
+
+		public bool Detected {
+			get { return stringDecrypterMethod != null; }
+		}
+
+		public TypeDefinition Type {
+			get { return stringDecrypterType; }
+		}
+
+		public MethodDefinition StringDecrypterMethod {
+			get { return stringDecrypterMethod; }
+		}
+
+		public StringDecrypter(ModuleDefinition module) {
+			this.module = module;
+		}
+
+		public void find() {
+			foreach (var type in module.Types) {
+				if (type.HasFields)
+					continue;
+				if (type.Methods.Count < 1 || type.Methods.Count > 3)
+					continue;
+				if (type.HasProperties || type.HasEvents)
+					continue;
+
+				MethodDefinition method = null;
+				foreach (var m in type.Methods) {
+					if (m.Name == ".ctor" || m.Name == ".cctor")
+						continue;
+					if (DotNetUtils.isMethod(m, "System.String", "(System.String,System.Int32)")) {
+						method = m;
+						continue;
+					}
+					method = null;
+					break;
+				}
+				if (method == null || method.Body == null)
+					continue;
+
+				bool foundConstant = false;
+				foreach (var instr in method.Body.Instructions) {
+					if (DotNetUtils.isLdcI4(instr) && DotNetUtils.getLdcI4Value(instr) == STRING_DECRYPTER_KEY_CONST) {
+						foundConstant = true;
+						break;
+					}
+				}
+				if (!foundConstant)
+					continue;
+
+				stringDecrypterType = type;
+				stringDecrypterMethod = method;
+				break;
+			}
+		}
+
+		public string decrypt(string es, int magic) {
+			int newLen = es.Length / 4;
+			var sb = new StringBuilder(newLen);
+			for (int i = 0; i < newLen * 4; i += 4) {
+				char c = (char)((es[i] - 'a') +
+							((es[i + 1] - 'a') << 4) +
+							((es[i + 2] - 'a') << 8) +
+							((es[i + 3] - 'a') << 12) - magic);
+				magic += STRING_DECRYPTER_KEY_CONST;
+				sb.Append(c);
+			}
+			return sb.ToString();
+		}
+	}
+}