monocul.us/de4dot-cex
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge branch 'master' into newcode

Browse Source
This commit is contained in:
de4dot 2012-01-08 19:09:18 +01:00
commit b02cb11a61
6 changed files with 34 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
AssemblyData/methodsrewriter/MModule.cs
View File

@ -44,11 +44,9 @@ namespace AssemblyData.methodsrewriter {
var tmpTokenToTypeDefinition = new Dictionary<int, TypeDefinition>();
foreach (var t in module.GetTypes())
tmpTokenToType[t.MetadataToken] = t;
foreach (var t in moduleDefinition.GetTypes()) {
foreach (var t in moduleDefinition.GetTypes())
tmpTokenToTypeDefinition[t.MetadataToken.ToInt32()] = t;
if (moduleType == null && t.FullName == "<Module>")
moduleType = t;
}
moduleType = DotNetUtils.getModuleType(moduleDefinition);
foreach (var token in tmpTokenToType.Keys) {
var mtype = new MType(tmpTokenToType[token], tmpTokenToTypeDefinition[token]);
tokenToType[token] = mtype;

14
blocks/DotNetUtils.cs
View File

@ -281,11 +281,17 @@ namespace de4dot.blocks {
}
public static TypeDefinition getModuleType(ModuleDefinition module) {
foreach (var type in module.Types) {
if (type.FullName == "<Module>")
return type;
if (module.Types.Count == 0)
return null;
if (module.Runtime == TargetRuntime.Net_1_0 || module.Runtime == TargetRuntime.Net_1_1) {
if (module.Types[0].FullName == "<Module>")
return module.Types[0];
return null;
}
return null;
// It's always the first one, no matter what it is named.
return module.Types[0];
}
public static bool isEmpty(MethodDefinition method) {

3
de4dot.code/deobfuscators/DeobfuscatorBase.cs
View File

@ -169,8 +169,9 @@ namespace de4dot.code.deobfuscators {
}
void restoreBaseType() {
var moduleType = DotNetUtils.getModuleType(module);
foreach (var type in module.GetTypes()) {
if (type.BaseType != null || type.IsInterface || type.FullName == "<Module>")
if (type.BaseType != null || type.IsInterface || type == moduleType)
continue;
Log.v("Adding System.Object as base type: {0} ({1:X8})",
Utils.removeNewlines(type),

3
de4dot.code/deobfuscators/SmartAssembly/Deobfuscator.cs
View File

@ -271,8 +271,9 @@ namespace de4dot.code.deobfuscators.SmartAssembly {
bool hasEmptyClassesInEveryNamespace() {
var namespaces = new Dictionary<string, int>(StringComparer.Ordinal);
var moduleType = DotNetUtils.getModuleType(module);
foreach (var type in module.Types) {
if (type.FullName == "<Module>")
if (type == moduleType)
continue;
var ns = type.Namespace;
if (!namespaces.ContainsKey(ns))

11
de4dot.code/deobfuscators/SmartAssembly/StringDecrypterInfo.cs
View File

@ -217,10 +217,15 @@ namespace de4dot.code.deobfuscators.SmartAssembly {
// Find the string decrypter string offset value or null if none found
int? findOffsetValue(MethodDefinition method) {
var fieldDict = new FieldDefinitionAndDeclaringTypeDict<FieldReference>();
foreach (var field in method.DeclaringType.Fields)
fieldDict.add(field, field);
var offsetField = findOffsetField(method);
if (offsetField == null)
return null;
return findOffsetValue(method, offsetField);
return findOffsetValue(method, (FieldDefinition)fieldDict.find(offsetField), fieldDict);
}
FieldReference findOffsetField(MethodDefinition method) {
@ -248,7 +253,7 @@ namespace de4dot.code.deobfuscators.SmartAssembly {
return null;
}
int? findOffsetValue(MethodDefinition method, FieldReference offsetField) {
int? findOffsetValue(MethodDefinition method, FieldDefinition offsetField, FieldDefinitionAndDeclaringTypeDict<FieldReference> fields) {
var instructions = method.Body.Instructions;
for (int i = 0; i <= instructions.Count - 2; i++) {
var ldstr = instructions[i];
@ -262,7 +267,7 @@ namespace de4dot.code.deobfuscators.SmartAssembly {
if (stsfld.OpCode.Code != Code.Stsfld)
continue;
var field = stsfld.Operand as FieldReference;
if (field == null || !MemberReferenceHelper.compareFieldReference(offsetField, field))
if (field == null || fields.find(field) != offsetField)
continue;
int value;

11
de4dot.code/renamer/TypeInfo.cs
View File

@ -81,6 +81,10 @@ namespace de4dot.code.renamer {
return baseInfo;
}
bool isModuleType() {
return type.TypeDefinition == DotNetUtils.getModuleType(type.TypeDefinition.Module);
}
public void prepareRenameTypes(TypeRenamerState state) {
var checker = NameChecker;
@ -94,7 +98,12 @@ namespace de4dot.code.renamer {
string origClassName = null;
if (isWinFormsClass())
origClassName = findWindowsFormsClassName(type);
if (oldFullName != "<Module>" && !checker.isValidTypeName(oldName)) {
if (isModuleType()) {
if (oldNamespace != "")
newNamespace = "";
rename("<Module>");
}
else if (!checker.isValidTypeName(oldName)) {
if (origClassName != null && checker.isValidTypeName(origClassName))
rename(state.getTypeName(oldName, origClassName));
else {