monocul.us/de4dot-cex
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Update detection of the empty class

Browse Source
This commit is contained in:
de4dot 2011-11-26 12:34:17 +01:00
parent cec8758ed2
commit a90fd1fa2f
2 changed files with 21 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
blocks/DotNetUtils.cs
View File

@ -83,6 +83,11 @@ namespace de4dot.blocks {
}
public MethodReference most() {
int numCalls;
return most(out numCalls);
}
public MethodReference most(out int numCalls) {
MethodReference method = null;
int callCount = 0;
foreach (var key in calls.Keys) {
@ -91,6 +96,7 @@ namespace de4dot.blocks {
method = key.MethodReference;
}
}
numCalls = callCount;
return method;
}
}

18
de4dot.code/deobfuscators/dotNET_Reactor/EmptyClass.cs
View File

@ -46,7 +46,7 @@ namespace de4dot.deobfuscators.dotNET_Reactor {
if (count >= 40)
break;
foreach (var method in type.Methods) {
if (method.Name != ".ctor")
if (method.Name != ".ctor" && method.Name != ".cctor" && module.EntryPoint != method)
continue;
foreach (var tuple in DotNetUtils.getCalledMethods(module, method)) {
var calledMethod = tuple.Item2;
@ -62,7 +62,10 @@ namespace de4dot.deobfuscators.dotNET_Reactor {
}
}
emptyMethod = (MethodDefinition)callCounter.most();
int numCalls;
var theMethod = (MethodDefinition)callCounter.most(out numCalls);
if (numCalls >= 10)
emptyMethod = theMethod;
}
bool isEmptyClass(MethodDefinition emptyMethod) {
@ -76,14 +79,23 @@ namespace de4dot.deobfuscators.dotNET_Reactor {
return false;
if (type.Fields[0].FieldType.FullName != "System.Boolean")
return false;
if (type.IsPublic)
return false;
int otherMethods = 0;
foreach (var method in type.Methods) {
if (method.Name == ".ctor" || method.Name == ".cctor")
continue;
if (method == emptyMethod)
continue;
return false;
otherMethods++;
if (method.Body == null)
return false;
if (method.Body.Instructions.Count > 20)
return false;
}
if (otherMethods > 8)
return false;
return true;
}