Return the correct return value
This commit is contained in:
parent
d84d2e6a6c
commit
ab60692c2f
|
@ -402,16 +402,29 @@ namespace de4dot.code.deobfuscators.CliSecure {
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
enum DecryptResult {
|
||||||
|
NotEncrypted,
|
||||||
|
Decrypted,
|
||||||
|
Error,
|
||||||
|
}
|
||||||
|
|
||||||
public bool decrypt(PeImage peImage, string filename, CliSecureRtType csRtType, ref DumpedMethods dumpedMethods) {
|
public bool decrypt(PeImage peImage, string filename, CliSecureRtType csRtType, ref DumpedMethods dumpedMethods) {
|
||||||
this.peImage = peImage;
|
this.peImage = peImage;
|
||||||
this.csRtType = csRtType;
|
this.csRtType = csRtType;
|
||||||
if (decrypt2(ref dumpedMethods))
|
|
||||||
|
switch (decrypt2(ref dumpedMethods)) {
|
||||||
|
case DecryptResult.Decrypted: return true;
|
||||||
|
case DecryptResult.NotEncrypted: return false;
|
||||||
|
|
||||||
|
case DecryptResult.Error:
|
||||||
|
Log.w("Using dynamic method decryption");
|
||||||
|
byte[] moduleCctorBytes = getModuleCctorBytes(csRtType);
|
||||||
|
dumpedMethods = de4dot.code.deobfuscators.MethodsDecrypter.decrypt(filename, moduleCctorBytes);
|
||||||
return true;
|
return true;
|
||||||
|
|
||||||
Log.w("Using dynamic method decryption");
|
default:
|
||||||
byte[] moduleCctorBytes = getModuleCctorBytes(csRtType);
|
throw new ApplicationException("Invalid DecryptResult");
|
||||||
dumpedMethods = de4dot.code.deobfuscators.MethodsDecrypter.decrypt(filename, moduleCctorBytes);
|
}
|
||||||
return true;
|
|
||||||
}
|
}
|
||||||
|
|
||||||
static byte[] getModuleCctorBytes(CliSecureRtType csRtType) {
|
static byte[] getModuleCctorBytes(CliSecureRtType csRtType) {
|
||||||
|
@ -433,10 +446,11 @@ namespace de4dot.code.deobfuscators.CliSecure {
|
||||||
return peImage.rvaToOffset(peImage.Cor20Header.metadataDirectory.virtualAddress + peImage.Cor20Header.metadataDirectory.size);
|
return peImage.rvaToOffset(peImage.Cor20Header.metadataDirectory.virtualAddress + peImage.Cor20Header.metadataDirectory.size);
|
||||||
}
|
}
|
||||||
|
|
||||||
bool decrypt2(ref DumpedMethods dumpedMethods) {
|
DecryptResult decrypt2(ref DumpedMethods dumpedMethods) {
|
||||||
uint codeHeaderOffset = getCodeHeaderOffset(peImage);
|
uint codeHeaderOffset = getCodeHeaderOffset(peImage);
|
||||||
if (!readCodeHeader(codeHeaderOffset))
|
readCodeHeader(codeHeaderOffset);
|
||||||
return false;
|
if (!isValidSignature(codeHeader.signature))
|
||||||
|
return DecryptResult.NotEncrypted;
|
||||||
|
|
||||||
var metadataTables = peImage.Cor20Header.createMetadataTables();
|
var metadataTables = peImage.Cor20Header.createMetadataTables();
|
||||||
var methodDefTable = metadataTables.getMetadataType(MetadataIndex.iMethodDef);
|
var methodDefTable = metadataTables.getMetadataType(MetadataIndex.iMethodDef);
|
||||||
|
@ -444,13 +458,13 @@ namespace de4dot.code.deobfuscators.CliSecure {
|
||||||
foreach (var version in getCsHeaderVersions(codeHeaderOffset, methodDefTable)) {
|
foreach (var version in getCsHeaderVersions(codeHeaderOffset, methodDefTable)) {
|
||||||
try {
|
try {
|
||||||
decryptMethods(codeHeaderOffset, methodDefTable, createCsHeader(version), ref dumpedMethods);
|
decryptMethods(codeHeaderOffset, methodDefTable, createCsHeader(version), ref dumpedMethods);
|
||||||
return true;
|
return DecryptResult.Decrypted;
|
||||||
}
|
}
|
||||||
catch {
|
catch {
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
return false;
|
return DecryptResult.Error;
|
||||||
}
|
}
|
||||||
|
|
||||||
void decryptMethods(uint codeHeaderOffset, MetadataType methodDefTable, ICsHeader csHeader, ref DumpedMethods dumpedMethods) {
|
void decryptMethods(uint codeHeaderOffset, MetadataType methodDefTable, ICsHeader csHeader, ref DumpedMethods dumpedMethods) {
|
||||||
|
@ -484,22 +498,13 @@ namespace de4dot.code.deobfuscators.CliSecure {
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
bool readCodeHeader(uint offset) {
|
void readCodeHeader(uint offset) {
|
||||||
codeHeader.signature = peImage.offsetReadBytes(offset, 16);
|
codeHeader.signature = peImage.offsetReadBytes(offset, 16);
|
||||||
codeHeader.decryptionKey = peImage.offsetReadBytes(offset + 0x10, 16);
|
codeHeader.decryptionKey = peImage.offsetReadBytes(offset + 0x10, 16);
|
||||||
codeHeader.totalCodeSize = peImage.offsetReadUInt32(offset + 0x20);
|
codeHeader.totalCodeSize = peImage.offsetReadUInt32(offset + 0x20);
|
||||||
codeHeader.numMethods = peImage.offsetReadUInt32(offset + 0x24);
|
codeHeader.numMethods = peImage.offsetReadUInt32(offset + 0x24);
|
||||||
codeHeader.methodDefTableOffset = peImage.offsetReadUInt32(offset + 0x28);
|
codeHeader.methodDefTableOffset = peImage.offsetReadUInt32(offset + 0x28);
|
||||||
codeHeader.methodDefElemSize = peImage.offsetReadUInt32(offset + 0x2C);
|
codeHeader.methodDefElemSize = peImage.offsetReadUInt32(offset + 0x2C);
|
||||||
|
|
||||||
if (!isValidSignature(codeHeader.signature))
|
|
||||||
return false;
|
|
||||||
if (codeHeader.totalCodeSize > 0x10000000)
|
|
||||||
return false;
|
|
||||||
if (codeHeader.numMethods > 512*1024)
|
|
||||||
return false;
|
|
||||||
|
|
||||||
return true;
|
|
||||||
}
|
}
|
||||||
|
|
||||||
static SigType getSigType(byte[] sig) {
|
static SigType getSigType(byte[] sig) {
|
||||||
|
|
Loading…
Reference in New Issue
Block a user