Detect .NET Reactor 4.8
This commit is contained in:
parent
ef628fcb64
commit
a9359729e9
|
@ -361,6 +361,7 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 {
|
|||
bool compileMethodHasConstant_0x70000000 = DeobUtils.HasInteger(compileMethod, 0x70000000); // 4.0-4.1
|
||||
DeobfuscatedFile.Deobfuscate(methodsDecrypter.Method);
|
||||
bool hasCorEnableProfilingString = FindString(methodsDecrypter.Method, "Cor_Enable_Profiling"); // 4.1-4.4
|
||||
bool hasCatchString = FindString(methodsDecrypter.Method, "catch: "); // <= 4.7
|
||||
|
||||
if (compileMethodHasConstant_0x70000000) {
|
||||
if (hasCorEnableProfilingString)
|
||||
|
@ -368,7 +369,6 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 {
|
|||
return DeobfuscatorInfo.THE_NAME + " 4.0";
|
||||
}
|
||||
if (!hasCorEnableProfilingString) {
|
||||
// 4.x or 4.5 - 4.6
|
||||
bool callsReverse = DotNetUtils.CallsMethod(methodsDecrypter.Method, "System.Void System.Array::Reverse(System.Array)");
|
||||
if (!callsReverse)
|
||||
return DeobfuscatorInfo.THE_NAME + " 4.0 - 4.4";
|
||||
|
@ -382,7 +382,9 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 {
|
|||
case 10:
|
||||
if (!hasSymmetricAlgorithm)
|
||||
return DeobfuscatorInfo.THE_NAME + " 4.6";
|
||||
if (hasCatchString)
|
||||
return DeobfuscatorInfo.THE_NAME + " 4.7";
|
||||
return DeobfuscatorInfo.THE_NAME + " 4.8";
|
||||
}
|
||||
}
|
||||
else {
|
||||
|
@ -392,7 +394,9 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 {
|
|||
case 9:
|
||||
if (!hasSymmetricAlgorithm)
|
||||
return DeobfuscatorInfo.THE_NAME + " 4.6";
|
||||
if (hasCatchString)
|
||||
return DeobfuscatorInfo.THE_NAME + " 4.7";
|
||||
return DeobfuscatorInfo.THE_NAME + " 4.8";
|
||||
}
|
||||
}
|
||||
|
||||
|
|
Loading…
Reference in New Issue
Block a user