diff --git a/de4dot.code/deobfuscators/ILProtector/Deobfuscator.cs b/de4dot.code/deobfuscators/ILProtector/Deobfuscator.cs index 0f3187c8..9ad0a082 100644 --- a/de4dot.code/deobfuscators/ILProtector/Deobfuscator.cs +++ b/de4dot.code/deobfuscators/ILProtector/Deobfuscator.cs @@ -118,11 +118,16 @@ namespace de4dot.code.deobfuscators.ILProtector { else if (dynamicMethodsRestorer != null) { Logger.v("Runtime file versions:"); Logger.Instance.Indent(); + bool emailMe = false; foreach (var info in mainType.RuntimeFileInfos) { var version = info.GetVersion(); + emailMe |= version == null && System.IO.File.Exists(info.PathName); + emailMe |= version != null && version == new Version(1, 0, 7, 0); Logger.v("Version: {0} ({1})", version == null ? "UNKNOWN" : version.ToString(), info.PathName); } Logger.Instance.DeIndent(); + if (emailMe) + Logger.n("**** Email me this program! de4dot@gmail.com"); dynamicMethodsRestorer.Decrypt(); RemoveObfuscatorJunk(dynamicMethodsRestorer); diff --git a/de4dot.code/deobfuscators/ILProtector/DynamicMethodsDecrypter.cs b/de4dot.code/deobfuscators/ILProtector/DynamicMethodsDecrypter.cs index dcae0f9f..8d4f6e05 100644 --- a/de4dot.code/deobfuscators/ILProtector/DynamicMethodsDecrypter.cs +++ b/de4dot.code/deobfuscators/ILProtector/DynamicMethodsDecrypter.cs @@ -159,13 +159,13 @@ namespace de4dot.code.deobfuscators.ILProtector { public abstract byte[] Decrypt(int methodId, uint rid); } - // 1.0.7.1 - 1.0.8.0 - class DecrypterV1_0_7_1 : DecrypterBase { + // 1.0.7.0 - 1.0.8.0 + class DecrypterV1_0_7_0 : DecrypterBase { DecryptMethod decryptMethod; unsafe delegate bool DecryptMethod(int appDomainId, int asmHashCode, int methodId, out byte* pMethodCode, out int methodSize); - public DecrypterV1_0_7_1(DynamicMethodsDecrypter dmd, FieldDef delegateField) + public DecrypterV1_0_7_0(DynamicMethodsDecrypter dmd, FieldDef delegateField) : base(dmd) { IntPtr addr = GetDelegateAddress(delegateField); decryptMethod = (DecryptMethod)Marshal.GetDelegateForFunctionPointer(addr, typeof(DecryptMethod)); @@ -348,7 +348,7 @@ namespace de4dot.code.deobfuscators.ILProtector { if (delegateField == null) return null; - return new DecrypterV1_0_7_1(this, delegateField); + return new DecrypterV1_0_7_0(this, delegateField); } IDecrypter CreateDecrypterV2_0_0_0() { diff --git a/de4dot.code/deobfuscators/ILProtector/RuntimeFileInfo.cs b/de4dot.code/deobfuscators/ILProtector/RuntimeFileInfo.cs index e4da4f20..b6333553 100644 --- a/de4dot.code/deobfuscators/ILProtector/RuntimeFileInfo.cs +++ b/de4dot.code/deobfuscators/ILProtector/RuntimeFileInfo.cs @@ -45,6 +45,7 @@ namespace de4dot.code.deobfuscators.ILProtector { } static readonly VersionInfo[] versionInfo32 = new VersionInfo[] { + new VersionInfo(new Version(1, 0, 7, 0), new byte[] { 0x94, 0x79, 0x6E, 0xC1, 0x1F, 0x6D, 0xE9, 0xE3, 0x2F, 0x5E, 0xA3, 0x57, 0x71, 0x02, 0x22, 0x6A }), new VersionInfo(new Version(1, 0, 7, 1), new byte[] { 0x8D, 0xCE, 0xAB, 0x0C, 0xA6, 0xA9, 0x4A, 0xA2, 0xCE, 0x43, 0xDE, 0x38, 0xEA, 0xDE, 0x0D, 0x3A }), new VersionInfo(new Version(1, 0, 8, 0), new byte[] { 0x44, 0x09, 0x33, 0xCE, 0x90, 0x43, 0xF9, 0xC2, 0x2F, 0x11, 0x40, 0x1D, 0x18, 0xDA, 0x63, 0x3B }), new VersionInfo(new Version(2, 0, 0, 0), new byte[] { 0xFD, 0x1D, 0x2B, 0x73, 0x2F, 0xD8, 0x27, 0x5F, 0xA3, 0x83, 0x76, 0x36, 0x29, 0x8E, 0x51, 0xA9 }), @@ -65,6 +66,7 @@ namespace de4dot.code.deobfuscators.ILProtector { }; static readonly VersionInfo[] versionInfo64 = new VersionInfo[] { + // No sig for 1.0.7.0 x64 since I don't have it yet. new VersionInfo(new Version(1, 0, 7, 1), new byte[] { 0x68, 0x4C, 0xC0, 0xC2, 0x55, 0x75, 0x72, 0x09, 0x12, 0x10, 0xA4, 0xF3, 0xFE, 0x95, 0x4D, 0x7A }), new VersionInfo(new Version(1, 0, 8, 0), new byte[] { 0x99, 0xAF, 0x3D, 0x39, 0x16, 0xC2, 0xD6, 0x10, 0x6E, 0x09, 0x64, 0xDE, 0xA4, 0xB3, 0x30, 0xE5 }), new VersionInfo(new Version(2, 0, 0, 0), new byte[] { 0x02, 0x90, 0xDA, 0xBD, 0x37, 0xEE, 0x20, 0x86, 0xA7, 0x30, 0x31, 0x6D, 0x92, 0xEF, 0xB3, 0x01 }), diff --git a/de4dot.code/deobfuscators/ILProtector/StaticMethodsDecrypter.cs b/de4dot.code/deobfuscators/ILProtector/StaticMethodsDecrypter.cs index c614017b..7bd1e9ee 100644 --- a/de4dot.code/deobfuscators/ILProtector/StaticMethodsDecrypter.cs +++ b/de4dot.code/deobfuscators/ILProtector/StaticMethodsDecrypter.cs @@ -146,13 +146,13 @@ namespace de4dot.code.deobfuscators.ILProtector { } } - // 1.0.6 - 1.0.7.0 + // 1.0.6.x class DecrypterV106 : DecrypterBase { byte[] decryptionKey6; byte[] decryptionKey7; DecrypterV106(byte[] key0, byte[] key6, byte[] key7, int startOffset) { - this.ilpVersion = "1.0.6 - 1.0.7.0"; + this.ilpVersion = "1.0.6.x"; this.startOffset = startOffset; this.decryptionKey = key0; this.decryptionKey6 = key6; @@ -178,7 +178,7 @@ namespace de4dot.code.deobfuscators.ILProtector { var key0 = DeobUtils.Sha1Sum(sha1Data); // 1.0.6.0 var key6 = GetKey(reader, key0, keyXorOffs6); // 1.0.6.6 - var key7 = GetKey(reader, key0, keyXorOffs7); // 1.0.6.7 - 1.0.7.0 + var key7 = GetKey(reader, key0, keyXorOffs7); // 1.0.6.7 return new DecrypterV106(key0, key6, key7, encryptedOffs); } catch (IOException) {