monocul.us/de4dot-cex
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Rename some fields, and only remove types/etc if users wants it

Browse Source
This commit is contained in:
de4dot 2011-11-06 18:01:37 +01:00
parent 045e6ecf73
commit a94d1406db
1 changed files with 21 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

36
de4dot.code/deobfuscators/CliSecure/Deobfuscator.cs
View File

@ -27,13 +27,13 @@ namespace de4dot.deobfuscators.CliSecure {
public const string THE_NAME = "CliSecure"; public const string THE_NAME = "CliSecure";
const string DEFAULT_REGEX = @"[a-zA-Z_0-9>}$]$"; const string DEFAULT_REGEX = @"[a-zA-Z_0-9>}$]$";
BoolOption decryptMethods; BoolOption decryptMethods;
BoolOption fixResources; BoolOption decryptResources;
BoolOption removeStackFrameHelper; BoolOption removeStackFrameHelper;
public DeobfuscatorInfo() public DeobfuscatorInfo()
: base(DEFAULT_REGEX) { : base(DEFAULT_REGEX) {
decryptMethods = new BoolOption(null, makeArgName("methods"), "Decrypt methods", true); decryptMethods = new BoolOption(null, makeArgName("methods"), "Decrypt methods", true);
fixResources = new BoolOption(null, makeArgName("rsrc"), "Decrypt resources", true); decryptResources = new BoolOption(null, makeArgName("rsrc"), "Decrypt resources", true);
removeStackFrameHelper = new BoolOption(null, makeArgName("stack"), "Remove all StackFrameHelper code", true); removeStackFrameHelper = new BoolOption(null, makeArgName("stack"), "Remove all StackFrameHelper code", true);
} }
@ -49,7 +49,7 @@ namespace de4dot.deobfuscators.CliSecure {
return new Deobfuscator(new Deobfuscator.Options { return new Deobfuscator(new Deobfuscator.Options {
ValidNameRegex = validNameRegex.get(), ValidNameRegex = validNameRegex.get(),
DecryptMethods = decryptMethods.get(), DecryptMethods = decryptMethods.get(),
FixResources = fixResources.get(), DecryptResources = decryptResources.get(),
RemoveStackFrameHelper = removeStackFrameHelper.get(), RemoveStackFrameHelper = removeStackFrameHelper.get(),
}); });
} }
@ -57,7 +57,7 @@ namespace de4dot.deobfuscators.CliSecure {
protected override IEnumerable<Option> getOptionsInternal() { protected override IEnumerable<Option> getOptionsInternal() {
return new List<Option>() { return new List<Option>() {
decryptMethods, decryptMethods,
fixResources, decryptResources,
removeStackFrameHelper, removeStackFrameHelper,
}; };
} }
@ -76,7 +76,7 @@ namespace de4dot.deobfuscators.CliSecure {
internal class Options : OptionsBase { internal class Options : OptionsBase {
public bool DecryptMethods { get; set; } public bool DecryptMethods { get; set; }
public bool FixResources { get; set; } public bool DecryptResources { get; set; }
public bool RemoveStackFrameHelper { get; set; } public bool RemoveStackFrameHelper { get; set; }
} }
@ -157,8 +157,6 @@ namespace de4dot.deobfuscators.CliSecure {
base.deobfuscateBegin(); base.deobfuscateBegin();
addAttributeToBeRemoved(cliSecureAttribute, "Obfuscator attribute"); addAttributeToBeRemoved(cliSecureAttribute, "Obfuscator attribute");
addTypeToBeRemoved(stringDecrypter.Type, "Obfuscator string decrypter type");
findPossibleNamesToRemove(cliSecureRtType.LoadMethod);
resourceDecrypter = new ResourceDecrypter(module); resourceDecrypter = new ResourceDecrypter(module);
resourceDecrypter.find(); resourceDecrypter.find();
@ -174,9 +172,12 @@ namespace de4dot.deobfuscators.CliSecure {
staticStringDecrypter.add(stringDecrypter.Method, (method, args) => stringDecrypter.decrypt((string)args[0])); staticStringDecrypter.add(stringDecrypter.Method, (method, args) => stringDecrypter.decrypt((string)args[0]));
addCctorInitCallToBeRemoved(cliSecureRtType.InitializeMethod); if (options.DecryptMethods) {
addCctorInitCallToBeRemoved(cliSecureRtType.PostInitializeMethod); addCctorInitCallToBeRemoved(cliSecureRtType.InitializeMethod);
if (options.FixResources) addCctorInitCallToBeRemoved(cliSecureRtType.PostInitializeMethod);
findPossibleNamesToRemove(cliSecureRtType.LoadMethod);
}
if (options.DecryptResources)
addCctorInitCallToBeRemoved(resourceDecrypter.RsrcRrrMethod); addCctorInitCallToBeRemoved(resourceDecrypter.RsrcRrrMethod);
} }
@ -195,17 +196,22 @@ namespace de4dot.deobfuscators.CliSecure {
} }
public override void deobfuscateEnd() { public override void deobfuscateEnd() {
if (options.FixResources) if (options.DecryptResources)
decryptResources(); decryptResources();
removeProxyDelegates(proxyDelegateFinder); removeProxyDelegates(proxyDelegateFinder);
if (options.RemoveStackFrameHelper) { if (options.RemoveStackFrameHelper) {
if (stackFrameHelper.ExceptionLoggerRemover.NumRemovedExceptionLoggers > 0) if (stackFrameHelper.ExceptionLoggerRemover.NumRemovedExceptionLoggers > 0)
addTypeToBeRemoved(stackFrameHelper.Type, "StackFrameHelper type"); addTypeToBeRemoved(stackFrameHelper.Type, "StackFrameHelper type");
} }
if (Operations.DecryptStrings != OpDecryptString.None) if (Operations.DecryptStrings != OpDecryptString.None) {
addTypeToBeRemoved(cliSecureRtType.Type, "Obfuscator type"); addTypeToBeRemoved(stringDecrypter.Type, "Obfuscator string decrypter type");
addResources("Obfuscator protection files"); if (options.DecryptMethods)
addModuleReferences("Obfuscator protection files"); addTypeToBeRemoved(cliSecureRtType.Type, "Obfuscator type");
}
if (options.DecryptMethods) {
addResources("Obfuscator protection files");
addModuleReferences("Obfuscator protection files");
}
base.deobfuscateEnd(); base.deobfuscateEnd();
} }