From a594b112543eaa38e26d42c667bfc36eeb205afc Mon Sep 17 00:00:00 2001 From: de4dot Date: Fri, 21 Oct 2011 19:32:37 +0200 Subject: [PATCH] Remember to add this as first arg if HasThis is set --- blocks/cflow/BlockCflowDeobfuscator.cs | 4 ++-- blocks/cflow/BlocksCflowDeobfuscator.cs | 2 +- blocks/cflow/InstructionEmulator.cs | 4 +++- blocks/cflow/SwitchCflowDeobfuscator.cs | 6 +++--- 4 files changed, 9 insertions(+), 7 deletions(-) diff --git a/blocks/cflow/BlockCflowDeobfuscator.cs b/blocks/cflow/BlockCflowDeobfuscator.cs index d135cd6b..99cee022 100644 --- a/blocks/cflow/BlockCflowDeobfuscator.cs +++ b/blocks/cflow/BlockCflowDeobfuscator.cs @@ -26,9 +26,9 @@ namespace de4dot.blocks.cflow { Block block; InstructionEmulator instructionEmulator = new InstructionEmulator(); - public void init(Block block, IList args, IList locals) { + public void init(Blocks blocks, Block block) { this.block = block; - instructionEmulator.init(false, args, locals); + instructionEmulator.init(blocks.Method.HasThis, false, blocks.Method.Parameters, blocks.Locals); } // Returns true if code was updated, false otherwise diff --git a/blocks/cflow/BlocksCflowDeobfuscator.cs b/blocks/cflow/BlocksCflowDeobfuscator.cs index 8e4f6d7b..b5bf20cf 100644 --- a/blocks/cflow/BlocksCflowDeobfuscator.cs +++ b/blocks/cflow/BlocksCflowDeobfuscator.cs @@ -53,7 +53,7 @@ namespace de4dot.blocks.cflow { var lastInstr = block.LastInstr; if (!DotNetUtils.isConditionalBranch(lastInstr.OpCode.Code) && lastInstr.OpCode.Code != Code.Switch) continue; - blockCflowDeobfuscator.init(block, blocks.Method.Parameters, blocks.Locals); + blockCflowDeobfuscator.init(blocks, block); changed |= blockCflowDeobfuscator.deobfuscate(); } diff --git a/blocks/cflow/InstructionEmulator.cs b/blocks/cflow/InstructionEmulator.cs index 9ec6026a..feca660d 100644 --- a/blocks/cflow/InstructionEmulator.cs +++ b/blocks/cflow/InstructionEmulator.cs @@ -30,12 +30,14 @@ namespace de4dot.blocks.cflow { List args = new List(); List locals = new List(); - public void init(bool initLocals, IList parameterDefinitions, IList variableDefinitions) { + public void init(bool hasThis, bool initLocals, IList parameterDefinitions, IList variableDefinitions) { this.parameterDefinitions = parameterDefinitions; this.variableDefinitions = variableDefinitions; valueStack.init(); args.Clear(); + if (hasThis) + args.Add(new UnknownValue()); foreach (var arg in parameterDefinitions) args.Add(getUnknownValue(arg.ParameterType)); diff --git a/blocks/cflow/SwitchCflowDeobfuscator.cs b/blocks/cflow/SwitchCflowDeobfuscator.cs index fb626bdc..c2cfd8d8 100644 --- a/blocks/cflow/SwitchCflowDeobfuscator.cs +++ b/blocks/cflow/SwitchCflowDeobfuscator.cs @@ -119,7 +119,7 @@ namespace de4dot.blocks.cflow { foreach (var source in new List(block.Sources)) { if (!isBranchBlock(source)) continue; - instructionEmulator.init(false, blocks.Method.Parameters, blocks.Locals); + instructionEmulator.init(blocks.Method.HasThis, false, blocks.Method.Parameters, blocks.Locals); instructionEmulator.emulate(source.Instructions); var target = getSwitchTarget(switchTargets, switchFallThrough, source, instructionEmulator.pop()); @@ -145,7 +145,7 @@ namespace de4dot.blocks.cflow { foreach (var source in new List(block.Sources)) { if (!isBranchBlock(source)) continue; - instructionEmulator.init(false, blocks.Method.Parameters, blocks.Locals); + instructionEmulator.init(blocks.Method.HasThis, false, blocks.Method.Parameters, blocks.Locals); instructionEmulator.emulate(source.Instructions); var target = getSwitchTarget(switchTargets, switchFallThrough, source, instructionEmulator.getLocal(switchVariable)); @@ -168,7 +168,7 @@ namespace de4dot.blocks.cflow { foreach (var source in new List(block.Sources)) { if (!isBranchBlock(source)) continue; - instructionEmulator.init(false, blocks.Method.Parameters, blocks.Locals); + instructionEmulator.init(blocks.Method.HasThis, false, blocks.Method.Parameters, blocks.Locals); instructionEmulator.emulate(source.Instructions); var target = getSwitchTarget(switchTargets, switchFallThrough, source, instructionEmulator.pop());