Add 1.0.7.0 sig
This commit is contained in:
parent
a6eee49ff0
commit
aa01d4eebb
|
@ -118,11 +118,16 @@ namespace de4dot.code.deobfuscators.ILProtector {
|
||||||
else if (dynamicMethodsRestorer != null) {
|
else if (dynamicMethodsRestorer != null) {
|
||||||
Logger.v("Runtime file versions:");
|
Logger.v("Runtime file versions:");
|
||||||
Logger.Instance.Indent();
|
Logger.Instance.Indent();
|
||||||
|
bool emailMe = false;
|
||||||
foreach (var info in mainType.RuntimeFileInfos) {
|
foreach (var info in mainType.RuntimeFileInfos) {
|
||||||
var version = info.GetVersion();
|
var version = info.GetVersion();
|
||||||
|
emailMe |= version == null && System.IO.File.Exists(info.PathName);
|
||||||
|
emailMe |= version != null && version == new Version(1, 0, 7, 0);
|
||||||
Logger.v("Version: {0} ({1})", version == null ? "UNKNOWN" : version.ToString(), info.PathName);
|
Logger.v("Version: {0} ({1})", version == null ? "UNKNOWN" : version.ToString(), info.PathName);
|
||||||
}
|
}
|
||||||
Logger.Instance.DeIndent();
|
Logger.Instance.DeIndent();
|
||||||
|
if (emailMe)
|
||||||
|
Logger.n("**** Email me this program! de4dot@gmail.com");
|
||||||
|
|
||||||
dynamicMethodsRestorer.Decrypt();
|
dynamicMethodsRestorer.Decrypt();
|
||||||
RemoveObfuscatorJunk(dynamicMethodsRestorer);
|
RemoveObfuscatorJunk(dynamicMethodsRestorer);
|
||||||
|
|
|
@ -159,13 +159,13 @@ namespace de4dot.code.deobfuscators.ILProtector {
|
||||||
public abstract byte[] Decrypt(int methodId, uint rid);
|
public abstract byte[] Decrypt(int methodId, uint rid);
|
||||||
}
|
}
|
||||||
|
|
||||||
// 1.0.7.1 - 1.0.8.0
|
// 1.0.7.0 - 1.0.8.0
|
||||||
class DecrypterV1_0_7_1 : DecrypterBase {
|
class DecrypterV1_0_7_0 : DecrypterBase {
|
||||||
DecryptMethod decryptMethod;
|
DecryptMethod decryptMethod;
|
||||||
|
|
||||||
unsafe delegate bool DecryptMethod(int appDomainId, int asmHashCode, int methodId, out byte* pMethodCode, out int methodSize);
|
unsafe delegate bool DecryptMethod(int appDomainId, int asmHashCode, int methodId, out byte* pMethodCode, out int methodSize);
|
||||||
|
|
||||||
public DecrypterV1_0_7_1(DynamicMethodsDecrypter dmd, FieldDef delegateField)
|
public DecrypterV1_0_7_0(DynamicMethodsDecrypter dmd, FieldDef delegateField)
|
||||||
: base(dmd) {
|
: base(dmd) {
|
||||||
IntPtr addr = GetDelegateAddress(delegateField);
|
IntPtr addr = GetDelegateAddress(delegateField);
|
||||||
decryptMethod = (DecryptMethod)Marshal.GetDelegateForFunctionPointer(addr, typeof(DecryptMethod));
|
decryptMethod = (DecryptMethod)Marshal.GetDelegateForFunctionPointer(addr, typeof(DecryptMethod));
|
||||||
|
@ -348,7 +348,7 @@ namespace de4dot.code.deobfuscators.ILProtector {
|
||||||
if (delegateField == null)
|
if (delegateField == null)
|
||||||
return null;
|
return null;
|
||||||
|
|
||||||
return new DecrypterV1_0_7_1(this, delegateField);
|
return new DecrypterV1_0_7_0(this, delegateField);
|
||||||
}
|
}
|
||||||
|
|
||||||
IDecrypter CreateDecrypterV2_0_0_0() {
|
IDecrypter CreateDecrypterV2_0_0_0() {
|
||||||
|
|
|
@ -45,6 +45,7 @@ namespace de4dot.code.deobfuscators.ILProtector {
|
||||||
}
|
}
|
||||||
|
|
||||||
static readonly VersionInfo[] versionInfo32 = new VersionInfo[] {
|
static readonly VersionInfo[] versionInfo32 = new VersionInfo[] {
|
||||||
|
new VersionInfo(new Version(1, 0, 7, 0), new byte[] { 0x94, 0x79, 0x6E, 0xC1, 0x1F, 0x6D, 0xE9, 0xE3, 0x2F, 0x5E, 0xA3, 0x57, 0x71, 0x02, 0x22, 0x6A }),
|
||||||
new VersionInfo(new Version(1, 0, 7, 1), new byte[] { 0x8D, 0xCE, 0xAB, 0x0C, 0xA6, 0xA9, 0x4A, 0xA2, 0xCE, 0x43, 0xDE, 0x38, 0xEA, 0xDE, 0x0D, 0x3A }),
|
new VersionInfo(new Version(1, 0, 7, 1), new byte[] { 0x8D, 0xCE, 0xAB, 0x0C, 0xA6, 0xA9, 0x4A, 0xA2, 0xCE, 0x43, 0xDE, 0x38, 0xEA, 0xDE, 0x0D, 0x3A }),
|
||||||
new VersionInfo(new Version(1, 0, 8, 0), new byte[] { 0x44, 0x09, 0x33, 0xCE, 0x90, 0x43, 0xF9, 0xC2, 0x2F, 0x11, 0x40, 0x1D, 0x18, 0xDA, 0x63, 0x3B }),
|
new VersionInfo(new Version(1, 0, 8, 0), new byte[] { 0x44, 0x09, 0x33, 0xCE, 0x90, 0x43, 0xF9, 0xC2, 0x2F, 0x11, 0x40, 0x1D, 0x18, 0xDA, 0x63, 0x3B }),
|
||||||
new VersionInfo(new Version(2, 0, 0, 0), new byte[] { 0xFD, 0x1D, 0x2B, 0x73, 0x2F, 0xD8, 0x27, 0x5F, 0xA3, 0x83, 0x76, 0x36, 0x29, 0x8E, 0x51, 0xA9 }),
|
new VersionInfo(new Version(2, 0, 0, 0), new byte[] { 0xFD, 0x1D, 0x2B, 0x73, 0x2F, 0xD8, 0x27, 0x5F, 0xA3, 0x83, 0x76, 0x36, 0x29, 0x8E, 0x51, 0xA9 }),
|
||||||
|
@ -65,6 +66,7 @@ namespace de4dot.code.deobfuscators.ILProtector {
|
||||||
};
|
};
|
||||||
|
|
||||||
static readonly VersionInfo[] versionInfo64 = new VersionInfo[] {
|
static readonly VersionInfo[] versionInfo64 = new VersionInfo[] {
|
||||||
|
// No sig for 1.0.7.0 x64 since I don't have it yet.
|
||||||
new VersionInfo(new Version(1, 0, 7, 1), new byte[] { 0x68, 0x4C, 0xC0, 0xC2, 0x55, 0x75, 0x72, 0x09, 0x12, 0x10, 0xA4, 0xF3, 0xFE, 0x95, 0x4D, 0x7A }),
|
new VersionInfo(new Version(1, 0, 7, 1), new byte[] { 0x68, 0x4C, 0xC0, 0xC2, 0x55, 0x75, 0x72, 0x09, 0x12, 0x10, 0xA4, 0xF3, 0xFE, 0x95, 0x4D, 0x7A }),
|
||||||
new VersionInfo(new Version(1, 0, 8, 0), new byte[] { 0x99, 0xAF, 0x3D, 0x39, 0x16, 0xC2, 0xD6, 0x10, 0x6E, 0x09, 0x64, 0xDE, 0xA4, 0xB3, 0x30, 0xE5 }),
|
new VersionInfo(new Version(1, 0, 8, 0), new byte[] { 0x99, 0xAF, 0x3D, 0x39, 0x16, 0xC2, 0xD6, 0x10, 0x6E, 0x09, 0x64, 0xDE, 0xA4, 0xB3, 0x30, 0xE5 }),
|
||||||
new VersionInfo(new Version(2, 0, 0, 0), new byte[] { 0x02, 0x90, 0xDA, 0xBD, 0x37, 0xEE, 0x20, 0x86, 0xA7, 0x30, 0x31, 0x6D, 0x92, 0xEF, 0xB3, 0x01 }),
|
new VersionInfo(new Version(2, 0, 0, 0), new byte[] { 0x02, 0x90, 0xDA, 0xBD, 0x37, 0xEE, 0x20, 0x86, 0xA7, 0x30, 0x31, 0x6D, 0x92, 0xEF, 0xB3, 0x01 }),
|
||||||
|
|
|
@ -146,13 +146,13 @@ namespace de4dot.code.deobfuscators.ILProtector {
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
// 1.0.6 - 1.0.7.0
|
// 1.0.6.x
|
||||||
class DecrypterV106 : DecrypterBase {
|
class DecrypterV106 : DecrypterBase {
|
||||||
byte[] decryptionKey6;
|
byte[] decryptionKey6;
|
||||||
byte[] decryptionKey7;
|
byte[] decryptionKey7;
|
||||||
|
|
||||||
DecrypterV106(byte[] key0, byte[] key6, byte[] key7, int startOffset) {
|
DecrypterV106(byte[] key0, byte[] key6, byte[] key7, int startOffset) {
|
||||||
this.ilpVersion = "1.0.6 - 1.0.7.0";
|
this.ilpVersion = "1.0.6.x";
|
||||||
this.startOffset = startOffset;
|
this.startOffset = startOffset;
|
||||||
this.decryptionKey = key0;
|
this.decryptionKey = key0;
|
||||||
this.decryptionKey6 = key6;
|
this.decryptionKey6 = key6;
|
||||||
|
@ -178,7 +178,7 @@ namespace de4dot.code.deobfuscators.ILProtector {
|
||||||
|
|
||||||
var key0 = DeobUtils.Sha1Sum(sha1Data); // 1.0.6.0
|
var key0 = DeobUtils.Sha1Sum(sha1Data); // 1.0.6.0
|
||||||
var key6 = GetKey(reader, key0, keyXorOffs6); // 1.0.6.6
|
var key6 = GetKey(reader, key0, keyXorOffs6); // 1.0.6.6
|
||||||
var key7 = GetKey(reader, key0, keyXorOffs7); // 1.0.6.7 - 1.0.7.0
|
var key7 = GetKey(reader, key0, keyXorOffs7); // 1.0.6.7
|
||||||
return new DecrypterV106(key0, key6, key7, encryptedOffs);
|
return new DecrypterV106(key0, key6, key7, encryptedOffs);
|
||||||
}
|
}
|
||||||
catch (IOException) {
|
catch (IOException) {
|
||||||
|
|
Loading…
Reference in New Issue
Block a user