Fix code since CilBody/HasCilBody were renamed
This commit is contained in:
parent
3ed2daebd1
commit
ac171e3f29
|
@ -178,7 +178,7 @@ namespace AssemblyData.methodsrewriter {
|
||||||
|
|
||||||
void initLocals() {
|
void initLocals() {
|
||||||
locals = new List<LocalBuilder>();
|
locals = new List<LocalBuilder>();
|
||||||
foreach (var local in methodInfo.methodDef.CilBody.LocalList)
|
foreach (var local in methodInfo.methodDef.Body.LocalList)
|
||||||
locals.Add(ilg.DeclareLocal(Resolver.getRtType(local.Type), local.Type.IsPinned));
|
locals.Add(ilg.DeclareLocal(Resolver.getRtType(local.Type), local.Type.IsPinned));
|
||||||
tempObjLocal = ilg.DeclareLocal(typeof(object));
|
tempObjLocal = ilg.DeclareLocal(typeof(object));
|
||||||
tempObjArrayLocal = ilg.DeclareLocal(typeof(object[]));
|
tempObjArrayLocal = ilg.DeclareLocal(typeof(object[]));
|
||||||
|
|
|
@ -30,7 +30,7 @@ namespace AssemblyData.methodsrewriter {
|
||||||
}
|
}
|
||||||
|
|
||||||
public bool hasInstructions() {
|
public bool hasInstructions() {
|
||||||
return methodDef.CilBody != null && methodDef.CilBody.Instructions.Count != 0;
|
return methodDef.Body != null && methodDef.Body.Instructions.Count != 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
public override string ToString() {
|
public override string ToString() {
|
||||||
|
|
|
@ -46,7 +46,7 @@ namespace de4dot.blocks {
|
||||||
}
|
}
|
||||||
|
|
||||||
public void updateBlocks() {
|
public void updateBlocks() {
|
||||||
var body = method.CilBody;
|
var body = method.Body;
|
||||||
locals = body.LocalList;
|
locals = body.LocalList;
|
||||||
methodBlocks = new InstructionListParser(body.Instructions, body.ExceptionHandlers).parse();
|
methodBlocks = new InstructionListParser(body.Instructions, body.ExceptionHandlers).parse();
|
||||||
}
|
}
|
||||||
|
|
|
@ -160,9 +160,9 @@ namespace de4dot.blocks {
|
||||||
}
|
}
|
||||||
|
|
||||||
public static bool isEmpty(MethodDef method) {
|
public static bool isEmpty(MethodDef method) {
|
||||||
if (method.CilBody == null)
|
if (method.Body == null)
|
||||||
return false;
|
return false;
|
||||||
foreach (var instr in method.CilBody.Instructions) {
|
foreach (var instr in method.Body.Instructions) {
|
||||||
var code = instr.OpCode.Code;
|
var code = instr.OpCode.Code;
|
||||||
if (code != Code.Nop && code != Code.Ret)
|
if (code != Code.Nop && code != Code.Ret)
|
||||||
return false;
|
return false;
|
||||||
|
@ -171,10 +171,10 @@ namespace de4dot.blocks {
|
||||||
}
|
}
|
||||||
|
|
||||||
public static bool isEmptyObfuscated(MethodDef method) {
|
public static bool isEmptyObfuscated(MethodDef method) {
|
||||||
if (method.CilBody == null)
|
if (method.Body == null)
|
||||||
return false;
|
return false;
|
||||||
int index = 0;
|
int index = 0;
|
||||||
var instr = getInstruction(method.CilBody.Instructions, ref index);
|
var instr = getInstruction(method.Body.Instructions, ref index);
|
||||||
if (instr == null || instr.OpCode.Code != Code.Ret)
|
if (instr == null || instr.OpCode.Code != Code.Ret)
|
||||||
return false;
|
return false;
|
||||||
|
|
||||||
|
@ -467,8 +467,8 @@ namespace de4dot.blocks {
|
||||||
|
|
||||||
public static IList<string> getCodeStrings(MethodDef method) {
|
public static IList<string> getCodeStrings(MethodDef method) {
|
||||||
var strings = new List<string>();
|
var strings = new List<string>();
|
||||||
if (method != null && method.CilBody != null) {
|
if (method != null && method.Body != null) {
|
||||||
foreach (var instr in method.CilBody.Instructions) {
|
foreach (var instr in method.Body.Instructions) {
|
||||||
if (instr.OpCode.Code == Code.Ldstr)
|
if (instr.OpCode.Code == Code.Ldstr)
|
||||||
strings.Add((string)instr.Operand);
|
strings.Add((string)instr.Operand);
|
||||||
}
|
}
|
||||||
|
@ -604,14 +604,14 @@ namespace de4dot.blocks {
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
public static void copyBody(MethodDef method, out IList<Instruction> instructions, out IList<ExceptionHandler> exceptionHandlers) {
|
public static void copyBody(MethodDef method, out IList<Instruction> instructions, out IList<ExceptionHandler> exceptionHandlers) {
|
||||||
if (method == null || !method.HasCilBody) {
|
if (method == null || !method.HasBody) {
|
||||||
instructions = new List<Instruction>();
|
instructions = new List<Instruction>();
|
||||||
exceptionHandlers = new List<ExceptionHandler>();
|
exceptionHandlers = new List<ExceptionHandler>();
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
|
|
||||||
var oldInstrs = method.CilBody.Instructions;
|
var oldInstrs = method.Body.Instructions;
|
||||||
var oldExHandlers = method.CilBody.ExceptionHandlers;
|
var oldExHandlers = method.Body.ExceptionHandlers;
|
||||||
instructions = new List<Instruction>(oldInstrs.Count);
|
instructions = new List<Instruction>(oldInstrs.Count);
|
||||||
exceptionHandlers = new List<ExceptionHandler>(oldExHandlers.Count);
|
exceptionHandlers = new List<ExceptionHandler>(oldExHandlers.Count);
|
||||||
var oldToIndex = Utils.createObjectToIndexDictionary(oldInstrs);
|
var oldToIndex = Utils.createObjectToIndexDictionary(oldInstrs);
|
||||||
|
@ -669,15 +669,15 @@ namespace de4dot.blocks {
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
public static void restoreBody(MethodDef method, IEnumerable<Instruction> instructions, IEnumerable<ExceptionHandler> exceptionHandlers) {
|
public static void restoreBody(MethodDef method, IEnumerable<Instruction> instructions, IEnumerable<ExceptionHandler> exceptionHandlers) {
|
||||||
if (method == null || method.CilBody == null)
|
if (method == null || method.Body == null)
|
||||||
return;
|
return;
|
||||||
|
|
||||||
var bodyInstrs = method.CilBody.Instructions;
|
var bodyInstrs = method.Body.Instructions;
|
||||||
bodyInstrs.Clear();
|
bodyInstrs.Clear();
|
||||||
foreach (var instr in instructions)
|
foreach (var instr in instructions)
|
||||||
bodyInstrs.Add(instr);
|
bodyInstrs.Add(instr);
|
||||||
|
|
||||||
var bodyExceptionHandlers = method.CilBody.ExceptionHandlers;
|
var bodyExceptionHandlers = method.Body.ExceptionHandlers;
|
||||||
bodyExceptionHandlers.Clear();
|
bodyExceptionHandlers.Clear();
|
||||||
foreach (var eh in exceptionHandlers)
|
foreach (var eh in exceptionHandlers)
|
||||||
bodyExceptionHandlers.Add(eh);
|
bodyExceptionHandlers.Add(eh);
|
||||||
|
@ -696,8 +696,8 @@ namespace de4dot.blocks {
|
||||||
}
|
}
|
||||||
|
|
||||||
static void copyLocalsFromTo(MethodDef fromMethod, MethodDef toMethod) {
|
static void copyLocalsFromTo(MethodDef fromMethod, MethodDef toMethod) {
|
||||||
var fromBody = fromMethod.CilBody;
|
var fromBody = fromMethod.Body;
|
||||||
var toBody = toMethod.CilBody;
|
var toBody = toMethod.Body;
|
||||||
|
|
||||||
toBody.LocalList.Clear();
|
toBody.LocalList.Clear();
|
||||||
foreach (var local in fromBody.LocalList)
|
foreach (var local in fromBody.LocalList)
|
||||||
|
@ -705,8 +705,8 @@ namespace de4dot.blocks {
|
||||||
}
|
}
|
||||||
|
|
||||||
static void updateInstructionOperands(MethodDef fromMethod, MethodDef toMethod) {
|
static void updateInstructionOperands(MethodDef fromMethod, MethodDef toMethod) {
|
||||||
var fromBody = fromMethod.CilBody;
|
var fromBody = fromMethod.Body;
|
||||||
var toBody = toMethod.CilBody;
|
var toBody = toMethod.Body;
|
||||||
|
|
||||||
toBody.InitLocals = fromBody.InitLocals;
|
toBody.InitLocals = fromBody.InitLocals;
|
||||||
toBody.MaxStack = fromBody.MaxStack;
|
toBody.MaxStack = fromBody.MaxStack;
|
||||||
|
|
|
@ -48,7 +48,7 @@ namespace de4dot.blocks.cflow {
|
||||||
if (deobfuscated.TryGetValue(method, out deobfuscatedMethod))
|
if (deobfuscated.TryGetValue(method, out deobfuscatedMethod))
|
||||||
return deobfuscatedMethod;
|
return deobfuscatedMethod;
|
||||||
|
|
||||||
if (method.CilBody == null || method.CilBody.Instructions.Count == 0) {
|
if (method.Body == null || method.Body.Instructions.Count == 0) {
|
||||||
deobfuscated[method] = method;
|
deobfuscated[method] = method;
|
||||||
return method;
|
return method;
|
||||||
}
|
}
|
||||||
|
|
|
@ -40,7 +40,7 @@ namespace de4dot.blocks.cflow {
|
||||||
}
|
}
|
||||||
|
|
||||||
static bool hasNonEmptyBody(MethodDef method) {
|
static bool hasNonEmptyBody(MethodDef method) {
|
||||||
return method.CilBody != null && method.CilBody.Instructions.Count > 0;
|
return method.Body != null && method.Body.Instructions.Count > 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
void deobfuscate(MethodDef method, Action<Blocks> handler) {
|
void deobfuscate(MethodDef method, Action<Blocks> handler) {
|
||||||
|
|
|
@ -48,7 +48,7 @@ namespace de4dot.blocks.cflow {
|
||||||
|
|
||||||
public void init(MethodDef method) {
|
public void init(MethodDef method) {
|
||||||
this.parameterDefs = method.Parameters;
|
this.parameterDefs = method.Parameters;
|
||||||
this.localDefs = method.CilBody.LocalList;
|
this.localDefs = method.Body.LocalList;
|
||||||
valueStack.init();
|
valueStack.init();
|
||||||
protectedStackValues.Clear();
|
protectedStackValues.Clear();
|
||||||
|
|
||||||
|
|
|
@ -62,7 +62,7 @@ namespace de4dot.blocks.cflow {
|
||||||
|
|
||||||
if (!canInline(methodToInline))
|
if (!canInline(methodToInline))
|
||||||
return false;
|
return false;
|
||||||
var body = methodToInline.CilBody;
|
var body = methodToInline.Body;
|
||||||
if (body == null)
|
if (body == null)
|
||||||
return false;
|
return false;
|
||||||
|
|
||||||
|
|
|
@ -131,7 +131,7 @@ namespace de4dot.blocks.cflow {
|
||||||
if (instr.GetParameterIndex() != loadIndex)
|
if (instr.GetParameterIndex() != loadIndex)
|
||||||
return null;
|
return null;
|
||||||
loadIndex++;
|
loadIndex++;
|
||||||
instr = DotNetUtils.getInstruction(methodToInline.CilBody.Instructions, ref instrIndex);
|
instr = DotNetUtils.getInstruction(methodToInline.Body.Instructions, ref instrIndex);
|
||||||
}
|
}
|
||||||
if (instr == null || loadIndex != methodArgsCount - popLastArgs)
|
if (instr == null || loadIndex != methodArgsCount - popLastArgs)
|
||||||
return null;
|
return null;
|
||||||
|
@ -187,7 +187,7 @@ namespace de4dot.blocks.cflow {
|
||||||
}
|
}
|
||||||
|
|
||||||
protected virtual bool isReturn(MethodDef methodToInline, int instrIndex) {
|
protected virtual bool isReturn(MethodDef methodToInline, int instrIndex) {
|
||||||
var instr = DotNetUtils.getInstruction(methodToInline.CilBody.Instructions, ref instrIndex);
|
var instr = DotNetUtils.getInstruction(methodToInline.Body.Instructions, ref instrIndex);
|
||||||
return instr != null && instr.OpCode.Code == Code.Ret;
|
return instr != null && instr.OpCode.Code == Code.Ret;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
@ -218,7 +218,7 @@ namespace de4dot.code {
|
||||||
|
|
||||||
bool getLocalVariableValue(Local variable, out object value) {
|
bool getLocalVariableValue(Local variable, out object value) {
|
||||||
if (variableValues == null)
|
if (variableValues == null)
|
||||||
variableValues = new VariableValues(theMethod.CilBody.LocalList, allBlocks);
|
variableValues = new VariableValues(theMethod.Body.LocalList, allBlocks);
|
||||||
var val = variableValues.getValue(variable);
|
var val = variableValues.getValue(variable);
|
||||||
if (!val.isValid()) {
|
if (!val.isValid()) {
|
||||||
value = null;
|
value = null;
|
||||||
|
@ -342,7 +342,7 @@ namespace de4dot.code {
|
||||||
case Code.Ldloc_1:
|
case Code.Ldloc_1:
|
||||||
case Code.Ldloc_2:
|
case Code.Ldloc_2:
|
||||||
case Code.Ldloc_3:
|
case Code.Ldloc_3:
|
||||||
getLocalVariableValue(instr.Instruction.GetLocal(theMethod.CilBody.LocalList), out arg);
|
getLocalVariableValue(instr.Instruction.GetLocal(theMethod.Body.LocalList), out arg);
|
||||||
break;
|
break;
|
||||||
|
|
||||||
case Code.Ldfld:
|
case Code.Ldfld:
|
||||||
|
|
|
@ -549,7 +549,7 @@ namespace de4dot.code {
|
||||||
catch (Exception ex) {
|
catch (Exception ex) {
|
||||||
if (!canLoadMethodBody(method)) {
|
if (!canLoadMethodBody(method)) {
|
||||||
Log.v("Invalid method body. {0:X8}", method.MDToken.ToInt32());
|
Log.v("Invalid method body. {0:X8}", method.MDToken.ToInt32());
|
||||||
method.CilBody = new CilBody();
|
method.Body = new CilBody();
|
||||||
}
|
}
|
||||||
else {
|
else {
|
||||||
Log.w("Could not deobfuscate method {0:X8}. Hello, E.T.: {1}", // E.T. = exception type
|
Log.w("Could not deobfuscate method {0:X8}. Hello, E.T.: {1}", // E.T. = exception type
|
||||||
|
@ -568,7 +568,7 @@ namespace de4dot.code {
|
||||||
|
|
||||||
static bool canLoadMethodBody(MethodDef method) {
|
static bool canLoadMethodBody(MethodDef method) {
|
||||||
try {
|
try {
|
||||||
var body = method.CilBody;
|
var body = method.Body;
|
||||||
return true;
|
return true;
|
||||||
}
|
}
|
||||||
catch {
|
catch {
|
||||||
|
@ -582,7 +582,7 @@ namespace de4dot.code {
|
||||||
|
|
||||||
var blocks = new Blocks(method);
|
var blocks = new Blocks(method);
|
||||||
int numRemovedLocals = 0;
|
int numRemovedLocals = 0;
|
||||||
int oldNumInstructions = method.CilBody.Instructions.Count;
|
int oldNumInstructions = method.Body.Instructions.Count;
|
||||||
|
|
||||||
deob.deobfuscateMethodBegin(blocks);
|
deob.deobfuscateMethodBegin(blocks);
|
||||||
if (options.ControlFlowDeobfuscation) {
|
if (options.ControlFlowDeobfuscation) {
|
||||||
|
@ -611,7 +611,7 @@ namespace de4dot.code {
|
||||||
|
|
||||||
if (numRemovedLocals > 0)
|
if (numRemovedLocals > 0)
|
||||||
Log.v("Removed {0} unused local(s)", numRemovedLocals);
|
Log.v("Removed {0} unused local(s)", numRemovedLocals);
|
||||||
int numRemovedInstructions = oldNumInstructions - method.CilBody.Instructions.Count;
|
int numRemovedInstructions = oldNumInstructions - method.Body.Instructions.Count;
|
||||||
if (numRemovedInstructions > 0)
|
if (numRemovedInstructions > 0)
|
||||||
Log.v("Removed {0} dead instruction(s)", numRemovedInstructions);
|
Log.v("Removed {0} dead instruction(s)", numRemovedInstructions);
|
||||||
|
|
||||||
|
@ -625,7 +625,7 @@ namespace de4dot.code {
|
||||||
}
|
}
|
||||||
|
|
||||||
bool hasNonEmptyBody(MethodDef method) {
|
bool hasNonEmptyBody(MethodDef method) {
|
||||||
return method.HasCilBody && method.CilBody.Instructions.Count > 0;
|
return method.HasBody && method.Body.Instructions.Count > 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
void deobfuscateStrings(Blocks blocks) {
|
void deobfuscateStrings(Blocks blocks) {
|
||||||
|
|
|
@ -31,7 +31,7 @@ namespace de4dot.code.deobfuscators {
|
||||||
|
|
||||||
public static List<byte[]> getArrays(MethodDef method, IType arrayElementType) {
|
public static List<byte[]> getArrays(MethodDef method, IType arrayElementType) {
|
||||||
var arrays = new List<byte[]>();
|
var arrays = new List<byte[]>();
|
||||||
var instrs = method.CilBody.Instructions;
|
var instrs = method.Body.Instructions;
|
||||||
for (int i = 0; i < instrs.Count; i++) {
|
for (int i = 0; i < instrs.Count; i++) {
|
||||||
IType type;
|
IType type;
|
||||||
var ary = getArray(instrs, ref i, out type);
|
var ary = getArray(instrs, ref i, out type);
|
||||||
|
@ -135,7 +135,7 @@ namespace de4dot.code.deobfuscators {
|
||||||
var theArray = new UnknownValue();
|
var theArray = new UnknownValue();
|
||||||
emulator.push(theArray);
|
emulator.push(theArray);
|
||||||
|
|
||||||
var instructions = method.CilBody.Instructions;
|
var instructions = method.Body.Instructions;
|
||||||
int i;
|
int i;
|
||||||
for (i = newarrIndex + 1; i < instructions.Count; i++) {
|
for (i = newarrIndex + 1; i < instructions.Count; i++) {
|
||||||
var instr = instructions[i];
|
var instr = instructions[i];
|
||||||
|
@ -194,7 +194,7 @@ done:
|
||||||
}
|
}
|
||||||
|
|
||||||
public static bool findNewarr(MethodDef method, ref int i, out int size) {
|
public static bool findNewarr(MethodDef method, ref int i, out int size) {
|
||||||
var instructions = method.CilBody.Instructions;
|
var instructions = method.Body.Instructions;
|
||||||
for (; i < instructions.Count; i++) {
|
for (; i < instructions.Count; i++) {
|
||||||
var instr = instructions[i];
|
var instr = instructions[i];
|
||||||
if (instr.OpCode.Code != Code.Newarr || i < 1)
|
if (instr.OpCode.Code != Code.Newarr || i < 1)
|
||||||
|
|
|
@ -99,8 +99,8 @@ namespace de4dot.code.deobfuscators {
|
||||||
}
|
}
|
||||||
|
|
||||||
public ConstantsReader(MethodDef method)
|
public ConstantsReader(MethodDef method)
|
||||||
: this(method.CilBody.Instructions) {
|
: this(method.Body.Instructions) {
|
||||||
this.locals = method.CilBody.LocalList;
|
this.locals = method.Body.LocalList;
|
||||||
}
|
}
|
||||||
|
|
||||||
public ConstantsReader(IList<Instr> instrs, IList<Local> locals)
|
public ConstantsReader(IList<Instr> instrs, IList<Local> locals)
|
||||||
|
|
|
@ -210,9 +210,9 @@ namespace de4dot.code.deobfuscators {
|
||||||
}
|
}
|
||||||
|
|
||||||
public static int indexOfLdci4Instruction(MethodDef method, int value) {
|
public static int indexOfLdci4Instruction(MethodDef method, int value) {
|
||||||
if (method == null || method.CilBody == null)
|
if (method == null || method.Body == null)
|
||||||
return -1;
|
return -1;
|
||||||
var instrs = method.CilBody.Instructions;
|
var instrs = method.Body.Instructions;
|
||||||
for (int i = 0; i < instrs.Count; i++) {
|
for (int i = 0; i < instrs.Count; i++) {
|
||||||
var instr = instrs[i];
|
var instr = instrs[i];
|
||||||
if (!instr.IsLdcI4())
|
if (!instr.IsLdcI4())
|
||||||
|
@ -249,9 +249,9 @@ namespace de4dot.code.deobfuscators {
|
||||||
|
|
||||||
public static List<MethodDef> getAllResolveHandlers(MethodDef method) {
|
public static List<MethodDef> getAllResolveHandlers(MethodDef method) {
|
||||||
var list = new List<MethodDef>();
|
var list = new List<MethodDef>();
|
||||||
if (method == null || method.CilBody == null)
|
if (method == null || method.Body == null)
|
||||||
return list;
|
return list;
|
||||||
foreach (var instr in method.CilBody.Instructions) {
|
foreach (var instr in method.Body.Instructions) {
|
||||||
if (instr.OpCode.Code != Code.Ldftn && instr.OpCode.Code != Code.Ldvirtftn)
|
if (instr.OpCode.Code != Code.Ldftn && instr.OpCode.Code != Code.Ldvirtftn)
|
||||||
continue;
|
continue;
|
||||||
var handler = instr.Operand as MethodDef;
|
var handler = instr.Operand as MethodDef;
|
||||||
|
|
|
@ -540,15 +540,15 @@ namespace de4dot.code.deobfuscators {
|
||||||
foreach (var type in module.GetTypes()) {
|
foreach (var type in module.GetTypes()) {
|
||||||
foreach (var method in type.Methods) {
|
foreach (var method in type.Methods) {
|
||||||
if (isFatHeader(method))
|
if (isFatHeader(method))
|
||||||
method.CilBody.InitLocals = true;
|
method.Body.InitLocals = true;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
static bool isFatHeader(MethodDef method) {
|
static bool isFatHeader(MethodDef method) {
|
||||||
if (method == null || method.CilBody == null)
|
if (method == null || method.Body == null)
|
||||||
return false;
|
return false;
|
||||||
var body = method.CilBody;
|
var body = method.Body;
|
||||||
if (body.InitLocals || body.MaxStack > 8)
|
if (body.InitLocals || body.MaxStack > 8)
|
||||||
return true;
|
return true;
|
||||||
if (body.LocalList.Count > 0)
|
if (body.LocalList.Count > 0)
|
||||||
|
@ -562,10 +562,10 @@ namespace de4dot.code.deobfuscators {
|
||||||
}
|
}
|
||||||
|
|
||||||
static int getCodeSize(MethodDef method) {
|
static int getCodeSize(MethodDef method) {
|
||||||
if (method == null || method.CilBody == null)
|
if (method == null || method.Body == null)
|
||||||
return 0;
|
return 0;
|
||||||
int size = 0;
|
int size = 0;
|
||||||
foreach (var instr in method.CilBody.Instructions)
|
foreach (var instr in method.Body.Instructions)
|
||||||
size += instr.GetSize();
|
size += instr.GetSize();
|
||||||
return size;
|
return size;
|
||||||
}
|
}
|
||||||
|
@ -575,10 +575,10 @@ namespace de4dot.code.deobfuscators {
|
||||||
}
|
}
|
||||||
|
|
||||||
protected void findPossibleNamesToRemove(MethodDef method) {
|
protected void findPossibleNamesToRemove(MethodDef method) {
|
||||||
if (method == null || !method.HasCilBody)
|
if (method == null || !method.HasBody)
|
||||||
return;
|
return;
|
||||||
|
|
||||||
foreach (var instr in method.CilBody.Instructions) {
|
foreach (var instr in method.Body.Instructions) {
|
||||||
if (instr.OpCode == OpCodes.Ldstr)
|
if (instr.OpCode == OpCodes.Ldstr)
|
||||||
namesToPossiblyRemove.Add((string)instr.Operand);
|
namesToPossiblyRemove.Add((string)instr.Operand);
|
||||||
}
|
}
|
||||||
|
@ -730,14 +730,14 @@ namespace de4dot.code.deobfuscators {
|
||||||
|
|
||||||
foreach (var type in module.GetTypes()) {
|
foreach (var type in module.GetTypes()) {
|
||||||
foreach (var method in type.Methods) {
|
foreach (var method in type.Methods) {
|
||||||
if (method.CilBody == null)
|
if (method.Body == null)
|
||||||
continue;
|
continue;
|
||||||
if (decrypterMethods.exists(method))
|
if (decrypterMethods.exists(method))
|
||||||
break; // decrypter type / nested type method
|
break; // decrypter type / nested type method
|
||||||
if (removedMethods.exists(method))
|
if (removedMethods.exists(method))
|
||||||
continue;
|
continue;
|
||||||
|
|
||||||
foreach (var instr in method.CilBody.Instructions) {
|
foreach (var instr in method.Body.Instructions) {
|
||||||
switch (instr.OpCode.Code) {
|
switch (instr.OpCode.Code) {
|
||||||
case Code.Call:
|
case Code.Call:
|
||||||
case Code.Callvirt:
|
case Code.Callvirt:
|
||||||
|
|
|
@ -40,9 +40,9 @@ namespace de4dot.code.deobfuscators {
|
||||||
continue;
|
continue;
|
||||||
if (method.Name == ".cctor")
|
if (method.Name == ".cctor")
|
||||||
continue;
|
continue;
|
||||||
if (method.CilBody == null)
|
if (method.Body == null)
|
||||||
continue;
|
continue;
|
||||||
var instrs = method.CilBody.Instructions;
|
var instrs = method.Body.Instructions;
|
||||||
if (instrs.Count < 2)
|
if (instrs.Count < 2)
|
||||||
continue;
|
continue;
|
||||||
|
|
||||||
|
@ -100,7 +100,7 @@ namespace de4dot.code.deobfuscators {
|
||||||
static bool isCallMethod(MethodDef method) {
|
static bool isCallMethod(MethodDef method) {
|
||||||
int loadIndex = 0;
|
int loadIndex = 0;
|
||||||
int methodArgsCount = DotNetUtils.getArgsCount(method);
|
int methodArgsCount = DotNetUtils.getArgsCount(method);
|
||||||
var instrs = method.CilBody.Instructions;
|
var instrs = method.Body.Instructions;
|
||||||
int i = 0;
|
int i = 0;
|
||||||
for (; i < instrs.Count && i < methodArgsCount; i++) {
|
for (; i < instrs.Count && i < methodArgsCount; i++) {
|
||||||
var instr = instrs[i];
|
var instr = instrs[i];
|
||||||
|
|
|
@ -246,7 +246,7 @@ namespace de4dot.code.deobfuscators {
|
||||||
case Code.Ldloc_1:
|
case Code.Ldloc_1:
|
||||||
case Code.Ldloc_2:
|
case Code.Ldloc_2:
|
||||||
case Code.Ldloc_3:
|
case Code.Ldloc_3:
|
||||||
local = pushInstr.GetLocal(method.CilBody.LocalList);
|
local = pushInstr.GetLocal(method.Body.LocalList);
|
||||||
if (local == null)
|
if (local == null)
|
||||||
return null;
|
return null;
|
||||||
type = local.Type.RemovePinned();
|
type = local.Type.RemovePinned();
|
||||||
|
|
|
@ -210,7 +210,7 @@ namespace de4dot.code.deobfuscators {
|
||||||
foreach (var tmp in getDelegateTypes()) {
|
foreach (var tmp in getDelegateTypes()) {
|
||||||
var type = tmp;
|
var type = tmp;
|
||||||
var cctor = type.FindClassConstructor();
|
var cctor = type.FindClassConstructor();
|
||||||
if (cctor == null || !cctor.HasCilBody)
|
if (cctor == null || !cctor.HasBody)
|
||||||
continue;
|
continue;
|
||||||
if (!type.HasFields)
|
if (!type.HasFields)
|
||||||
continue;
|
continue;
|
||||||
|
@ -394,7 +394,7 @@ namespace de4dot.code.deobfuscators {
|
||||||
protected void find2() {
|
protected void find2() {
|
||||||
foreach (var type in getDelegateTypes()) {
|
foreach (var type in getDelegateTypes()) {
|
||||||
var cctor = type.FindClassConstructor();
|
var cctor = type.FindClassConstructor();
|
||||||
if (cctor == null || !cctor.HasCilBody)
|
if (cctor == null || !cctor.HasBody)
|
||||||
continue;
|
continue;
|
||||||
if (!type.HasFields)
|
if (!type.HasFields)
|
||||||
continue;
|
continue;
|
||||||
|
@ -441,10 +441,10 @@ namespace de4dot.code.deobfuscators {
|
||||||
Dictionary<FieldDef, MethodDef> getFieldToMethodDictionary(TypeDef type) {
|
Dictionary<FieldDef, MethodDef> getFieldToMethodDictionary(TypeDef type) {
|
||||||
var dict = new Dictionary<FieldDef, MethodDef>();
|
var dict = new Dictionary<FieldDef, MethodDef>();
|
||||||
foreach (var method in type.Methods) {
|
foreach (var method in type.Methods) {
|
||||||
if (!method.IsStatic || !method.HasCilBody || method.Name == ".cctor")
|
if (!method.IsStatic || !method.HasBody || method.Name == ".cctor")
|
||||||
continue;
|
continue;
|
||||||
|
|
||||||
var instructions = method.CilBody.Instructions;
|
var instructions = method.Body.Instructions;
|
||||||
for (int i = 0; i < instructions.Count; i++) {
|
for (int i = 0; i < instructions.Count; i++) {
|
||||||
var instr = instructions[i];
|
var instr = instructions[i];
|
||||||
if (instr.OpCode.Code != Code.Ldsfld)
|
if (instr.OpCode.Code != Code.Ldsfld)
|
||||||
|
|
|
@ -87,8 +87,8 @@ namespace de4dot.code.deobfuscators {
|
||||||
|
|
||||||
class LocalTypes : StringCounts {
|
class LocalTypes : StringCounts {
|
||||||
public LocalTypes(MethodDef method) {
|
public LocalTypes(MethodDef method) {
|
||||||
if (method != null && method.CilBody != null)
|
if (method != null && method.Body != null)
|
||||||
init(method.CilBody.LocalList);
|
init(method.Body.LocalList);
|
||||||
}
|
}
|
||||||
|
|
||||||
public LocalTypes(IEnumerable<Local> locals) {
|
public LocalTypes(IEnumerable<Local> locals) {
|
||||||
|
|
|
@ -253,7 +253,7 @@ namespace de4dot.code.deobfuscators {
|
||||||
}
|
}
|
||||||
|
|
||||||
void deobfuscateMethod(MethodDef method) {
|
void deobfuscateMethod(MethodDef method) {
|
||||||
if (!method.IsStatic || method.CilBody == null)
|
if (!method.IsStatic || method.Body == null)
|
||||||
return;
|
return;
|
||||||
|
|
||||||
bool fixReturnType = isUnknownType(method.MethodSig.GetRetType());
|
bool fixReturnType = isUnknownType(method.MethodSig.GetRetType());
|
||||||
|
@ -271,7 +271,7 @@ namespace de4dot.code.deobfuscators {
|
||||||
|
|
||||||
var methodParams = method.Parameters;
|
var methodParams = method.Parameters;
|
||||||
PushedArgs pushedArgs;
|
PushedArgs pushedArgs;
|
||||||
var instructions = method.CilBody.Instructions;
|
var instructions = method.Body.Instructions;
|
||||||
for (int i = 0; i < instructions.Count; i++) {
|
for (int i = 0; i < instructions.Count; i++) {
|
||||||
var instr = instructions[i];
|
var instr = instructions[i];
|
||||||
switch (instr.OpCode.Code) {
|
switch (instr.OpCode.Code) {
|
||||||
|
@ -329,7 +329,7 @@ namespace de4dot.code.deobfuscators {
|
||||||
pushedArgs = MethodStack.getPushedArgInstructions(instructions, i);
|
pushedArgs = MethodStack.getPushedArgInstructions(instructions, i);
|
||||||
if (pushedArgs.NumValidArgs < 1)
|
if (pushedArgs.NumValidArgs < 1)
|
||||||
break;
|
break;
|
||||||
addMethodArgType(method, getParameter(methodParams, pushedArgs.getEnd(0)), instr.GetLocal(method.CilBody.LocalList));
|
addMethodArgType(method, getParameter(methodParams, pushedArgs.getEnd(0)), instr.GetLocal(method.Body.LocalList));
|
||||||
break;
|
break;
|
||||||
|
|
||||||
case Code.Stsfld:
|
case Code.Stsfld:
|
||||||
|
@ -474,9 +474,9 @@ namespace de4dot.code.deobfuscators {
|
||||||
info.clear();
|
info.clear();
|
||||||
|
|
||||||
foreach (var method in allMethods) {
|
foreach (var method in allMethods) {
|
||||||
if (method.CilBody == null)
|
if (method.Body == null)
|
||||||
continue;
|
continue;
|
||||||
var instructions = method.CilBody.Instructions;
|
var instructions = method.Body.Instructions;
|
||||||
for (int i = 0; i < instructions.Count; i++) {
|
for (int i = 0; i < instructions.Count; i++) {
|
||||||
var instr = instructions[i];
|
var instr = instructions[i];
|
||||||
TypeSig fieldType = null;
|
TypeSig fieldType = null;
|
||||||
|
|
|
@ -58,14 +58,14 @@ namespace de4dot.code.deobfuscators {
|
||||||
}
|
}
|
||||||
|
|
||||||
void check(MethodDef method) {
|
void check(MethodDef method) {
|
||||||
if (method.CilBody == null)
|
if (method.Body == null)
|
||||||
return;
|
return;
|
||||||
if (possiblyUnusedMethods.ContainsKey(method))
|
if (possiblyUnusedMethods.ContainsKey(method))
|
||||||
return;
|
return;
|
||||||
if (removedMethods.exists(method))
|
if (removedMethods.exists(method))
|
||||||
return;
|
return;
|
||||||
|
|
||||||
foreach (var instr in method.CilBody.Instructions) {
|
foreach (var instr in method.Body.Instructions) {
|
||||||
switch (instr.OpCode.Code) {
|
switch (instr.OpCode.Code) {
|
||||||
case Code.Call:
|
case Code.Call:
|
||||||
case Code.Calli:
|
case Code.Calli:
|
||||||
|
|
|
@ -64,11 +64,11 @@ namespace de4dot.code.deobfuscators.Xenocode {
|
||||||
method = null;
|
method = null;
|
||||||
break;
|
break;
|
||||||
}
|
}
|
||||||
if (method == null || method.CilBody == null)
|
if (method == null || method.Body == null)
|
||||||
continue;
|
continue;
|
||||||
|
|
||||||
bool foundConstant = false;
|
bool foundConstant = false;
|
||||||
foreach (var instr in method.CilBody.Instructions) {
|
foreach (var instr in method.Body.Instructions) {
|
||||||
if (instr.IsLdcI4() && instr.GetLdcI4Value() == STRING_DECRYPTER_KEY_CONST) {
|
if (instr.IsLdcI4() && instr.GetLdcI4Value() == STRING_DECRYPTER_KEY_CONST) {
|
||||||
foundConstant = true;
|
foundConstant = true;
|
||||||
break;
|
break;
|
||||||
|
|
|
@ -81,9 +81,9 @@ namespace de4dot.code.renamer {
|
||||||
|
|
||||||
static string getResourceName(TypeDef type) {
|
static string getResourceName(TypeDef type) {
|
||||||
foreach (var method in type.Methods) {
|
foreach (var method in type.Methods) {
|
||||||
if (method.CilBody == null)
|
if (method.Body == null)
|
||||||
continue;
|
continue;
|
||||||
var instrs = method.CilBody.Instructions;
|
var instrs = method.Body.Instructions;
|
||||||
string resourceName = null;
|
string resourceName = null;
|
||||||
for (int i = 0; i < instrs.Count; i++) {
|
for (int i = 0; i < instrs.Count; i++) {
|
||||||
var instr = instrs[i];
|
var instr = instrs[i];
|
||||||
|
@ -155,10 +155,10 @@ namespace de4dot.code.renamer {
|
||||||
nameToInfo[info.element.Name] = info;
|
nameToInfo[info.element.Name] = info;
|
||||||
|
|
||||||
foreach (var method in type.Methods) {
|
foreach (var method in type.Methods) {
|
||||||
if (method.CilBody == null)
|
if (method.Body == null)
|
||||||
continue;
|
continue;
|
||||||
|
|
||||||
var instrs = method.CilBody.Instructions;
|
var instrs = method.Body.Instructions;
|
||||||
for (int i = 0; i < instrs.Count; i++) {
|
for (int i = 0; i < instrs.Count; i++) {
|
||||||
var call = instrs[i];
|
var call = instrs[i];
|
||||||
if (call.OpCode.Code != Code.Call && call.OpCode.Code != Code.Callvirt)
|
if (call.OpCode.Code != Code.Call && call.OpCode.Code != Code.Callvirt)
|
||||||
|
|
|
@ -60,9 +60,9 @@ namespace de4dot.code.renamer {
|
||||||
oldNameToTypeInfo[info.oldFullName] = info;
|
oldNameToTypeInfo[info.oldFullName] = info;
|
||||||
|
|
||||||
foreach (var method in module.getAllMethods()) {
|
foreach (var method in module.getAllMethods()) {
|
||||||
if (!method.HasCilBody)
|
if (!method.HasBody)
|
||||||
continue;
|
continue;
|
||||||
var instrs = method.CilBody.Instructions;
|
var instrs = method.Body.Instructions;
|
||||||
for (int i = 0; i < instrs.Count; i++) {
|
for (int i = 0; i < instrs.Count; i++) {
|
||||||
var instr = instrs[i];
|
var instr = instrs[i];
|
||||||
if (instr.OpCode != OpCodes.Ldstr)
|
if (instr.OpCode != OpCodes.Ldstr)
|
||||||
|
|
|
@ -456,11 +456,11 @@ namespace de4dot.code.renamer {
|
||||||
ourMethods.add(methodDef.MethodDef, methodDef);
|
ourMethods.add(methodDef.MethodDef, methodDef);
|
||||||
|
|
||||||
foreach (var methodDef in type.AllMethods) {
|
foreach (var methodDef in type.AllMethods) {
|
||||||
if (methodDef.MethodDef.CilBody == null)
|
if (methodDef.MethodDef.Body == null)
|
||||||
continue;
|
continue;
|
||||||
if (methodDef.MethodDef.IsStatic || methodDef.MethodDef.IsVirtual)
|
if (methodDef.MethodDef.IsStatic || methodDef.MethodDef.IsVirtual)
|
||||||
continue;
|
continue;
|
||||||
var instructions = methodDef.MethodDef.CilBody.Instructions;
|
var instructions = methodDef.MethodDef.Body.Instructions;
|
||||||
for (int i = 2; i < instructions.Count; i++) {
|
for (int i = 2; i < instructions.Count; i++) {
|
||||||
var call = instructions[i];
|
var call = instructions[i];
|
||||||
if (call.OpCode.Code != Code.Call && call.OpCode.Code != Code.Callvirt)
|
if (call.OpCode.Code != Code.Call && call.OpCode.Code != Code.Callvirt)
|
||||||
|
@ -513,9 +513,9 @@ namespace de4dot.code.renamer {
|
||||||
}
|
}
|
||||||
|
|
||||||
static IField getFieldReference(MethodDef method) {
|
static IField getFieldReference(MethodDef method) {
|
||||||
if (method == null || method.CilBody == null)
|
if (method == null || method.Body == null)
|
||||||
return null;
|
return null;
|
||||||
var instructions = method.CilBody.Instructions;
|
var instructions = method.Body.Instructions;
|
||||||
int index = 0;
|
int index = 0;
|
||||||
var ldarg0 = DotNetUtils.getInstruction(instructions, ref index);
|
var ldarg0 = DotNetUtils.getInstruction(instructions, ref index);
|
||||||
if (ldarg0 == null || ldarg0.GetParameterIndex() != 0)
|
if (ldarg0 == null || ldarg0.GetParameterIndex() != 0)
|
||||||
|
@ -527,11 +527,11 @@ namespace de4dot.code.renamer {
|
||||||
if (ret == null)
|
if (ret == null)
|
||||||
return null;
|
return null;
|
||||||
if (ret.IsStloc()) {
|
if (ret.IsStloc()) {
|
||||||
var local = ret.GetLocal(method.CilBody.LocalList);
|
var local = ret.GetLocal(method.Body.LocalList);
|
||||||
ret = DotNetUtils.getInstruction(instructions, ref index);
|
ret = DotNetUtils.getInstruction(instructions, ref index);
|
||||||
if (ret == null || !ret.IsLdloc())
|
if (ret == null || !ret.IsLdloc())
|
||||||
return null;
|
return null;
|
||||||
if (ret.GetLocal(method.CilBody.LocalList) != local)
|
if (ret.GetLocal(method.Body.LocalList) != local)
|
||||||
return null;
|
return null;
|
||||||
ret = DotNetUtils.getInstruction(instructions, ref index);
|
ret = DotNetUtils.getInstruction(instructions, ref index);
|
||||||
}
|
}
|
||||||
|
@ -580,7 +580,7 @@ namespace de4dot.code.renamer {
|
||||||
|
|
||||||
static IMethod getVbHandler(MethodDef method, out string eventName) {
|
static IMethod getVbHandler(MethodDef method, out string eventName) {
|
||||||
eventName = null;
|
eventName = null;
|
||||||
if (method.CilBody == null)
|
if (method.Body == null)
|
||||||
return null;
|
return null;
|
||||||
var sig = method.MethodSig;
|
var sig = method.MethodSig;
|
||||||
if (sig == null)
|
if (sig == null)
|
||||||
|
@ -589,12 +589,12 @@ namespace de4dot.code.renamer {
|
||||||
return null;
|
return null;
|
||||||
if (sig.Params.Count != 1)
|
if (sig.Params.Count != 1)
|
||||||
return null;
|
return null;
|
||||||
if (method.CilBody.LocalList.Count != 1)
|
if (method.Body.LocalList.Count != 1)
|
||||||
return null;
|
return null;
|
||||||
if (!isEventHandlerType(method.CilBody.LocalList[0].Type))
|
if (!isEventHandlerType(method.Body.LocalList[0].Type))
|
||||||
return null;
|
return null;
|
||||||
|
|
||||||
var instructions = method.CilBody.Instructions;
|
var instructions = method.Body.Instructions;
|
||||||
int index = 0;
|
int index = 0;
|
||||||
|
|
||||||
int newobjIndex = findInstruction(instructions, index, Code.Newobj);
|
int newobjIndex = findInstruction(instructions, index, Code.Newobj);
|
||||||
|
@ -676,11 +676,11 @@ namespace de4dot.code.renamer {
|
||||||
var checker = NameChecker;
|
var checker = NameChecker;
|
||||||
|
|
||||||
foreach (var methodDef in type.AllMethods) {
|
foreach (var methodDef in type.AllMethods) {
|
||||||
if (methodDef.MethodDef.CilBody == null)
|
if (methodDef.MethodDef.Body == null)
|
||||||
continue;
|
continue;
|
||||||
if (methodDef.MethodDef.IsStatic)
|
if (methodDef.MethodDef.IsStatic)
|
||||||
continue;
|
continue;
|
||||||
var instructions = methodDef.MethodDef.CilBody.Instructions;
|
var instructions = methodDef.MethodDef.Body.Instructions;
|
||||||
for (int i = 0; i < instructions.Count - 6; i++) {
|
for (int i = 0; i < instructions.Count - 6; i++) {
|
||||||
// We're looking for this code pattern:
|
// We're looking for this code pattern:
|
||||||
// ldarg.0
|
// ldarg.0
|
||||||
|
@ -755,12 +755,12 @@ namespace de4dot.code.renamer {
|
||||||
var checker = NameChecker;
|
var checker = NameChecker;
|
||||||
|
|
||||||
foreach (var methodDef in type.AllMethods) {
|
foreach (var methodDef in type.AllMethods) {
|
||||||
if (methodDef.MethodDef.CilBody == null)
|
if (methodDef.MethodDef.Body == null)
|
||||||
continue;
|
continue;
|
||||||
if (methodDef.MethodDef.IsStatic)
|
if (methodDef.MethodDef.IsStatic)
|
||||||
continue;
|
continue;
|
||||||
var method = methodDef.MethodDef;
|
var method = methodDef.MethodDef;
|
||||||
var instructions = method.CilBody.Instructions;
|
var instructions = method.Body.Instructions;
|
||||||
for (int i = 0; i < instructions.Count - 5; i++) {
|
for (int i = 0; i < instructions.Count - 5; i++) {
|
||||||
// ldarg.0
|
// ldarg.0
|
||||||
// ldarg.0 / dup
|
// ldarg.0 / dup
|
||||||
|
@ -839,11 +839,11 @@ namespace de4dot.code.renamer {
|
||||||
|
|
||||||
string findWindowsFormsClassName(MTypeDef type) {
|
string findWindowsFormsClassName(MTypeDef type) {
|
||||||
foreach (var methodDef in type.AllMethods) {
|
foreach (var methodDef in type.AllMethods) {
|
||||||
if (methodDef.MethodDef.CilBody == null)
|
if (methodDef.MethodDef.Body == null)
|
||||||
continue;
|
continue;
|
||||||
if (methodDef.MethodDef.IsStatic || methodDef.MethodDef.IsVirtual)
|
if (methodDef.MethodDef.IsStatic || methodDef.MethodDef.IsVirtual)
|
||||||
continue;
|
continue;
|
||||||
var instructions = methodDef.MethodDef.CilBody.Instructions;
|
var instructions = methodDef.MethodDef.Body.Instructions;
|
||||||
for (int i = 2; i < instructions.Count; i++) {
|
for (int i = 2; i < instructions.Count; i++) {
|
||||||
var call = instructions[i];
|
var call = instructions[i];
|
||||||
if (call.OpCode.Code != Code.Call && call.OpCode.Code != Code.Callvirt)
|
if (call.OpCode.Code != Code.Call && call.OpCode.Code != Code.Callvirt)
|
||||||
|
@ -872,9 +872,9 @@ namespace de4dot.code.renamer {
|
||||||
foreach (var methodDef in type.AllMethods) {
|
foreach (var methodDef in type.AllMethods) {
|
||||||
if (methodDef.MethodDef.Name != ".ctor")
|
if (methodDef.MethodDef.Name != ".ctor")
|
||||||
continue;
|
continue;
|
||||||
if (methodDef.MethodDef.CilBody == null)
|
if (methodDef.MethodDef.Body == null)
|
||||||
continue;
|
continue;
|
||||||
foreach (var instr in methodDef.MethodDef.CilBody.Instructions) {
|
foreach (var instr in methodDef.MethodDef.Body.Instructions) {
|
||||||
if (instr.OpCode.Code != Code.Call && instr.OpCode.Code != Code.Callvirt)
|
if (instr.OpCode.Code != Code.Call && instr.OpCode.Code != Code.Callvirt)
|
||||||
continue;
|
continue;
|
||||||
if (!MethodEqualityComparer.CompareDeclaringTypes.Equals(possibleInitMethod.MethodDef, instr.Operand as IMethod))
|
if (!MethodEqualityComparer.CompareDeclaringTypes.Equals(possibleInitMethod.MethodDef, instr.Operand as IMethod))
|
||||||
|
|
2
dot10
2
dot10
|
@ -1 +1 @@
|
||||||
Subproject commit 8acaf8b483a7ddd6b31f618b205d7ac6c28593b2
|
Subproject commit 12295508eddc4cc7c35cd10e23fbffcb87fb7afb
|
Loading…
Reference in New Issue
Block a user