Update logger
- It's not static anymore - It implements ILogger - It can ignore errors/warnings but an option to disable it
This commit is contained in:
parent
9fac79c8a5
commit
b152362088
|
@ -57,6 +57,7 @@ namespace de4dot.code {
|
||||||
writerOptions.MetaDataOptions.Flags |= MetaDataFlags.KeepOldMaxStack;
|
writerOptions.MetaDataOptions.Flags |= MetaDataFlags.KeepOldMaxStack;
|
||||||
if (preserveTokens)
|
if (preserveTokens)
|
||||||
writerOptions.MetaDataOptions.Flags |= MetaDataFlags.PreserveTokens | MetaDataFlags.PreserveUSOffsets | MetaDataFlags.PreserveExtraSignatureData;
|
writerOptions.MetaDataOptions.Flags |= MetaDataFlags.PreserveTokens | MetaDataFlags.PreserveUSOffsets | MetaDataFlags.PreserveExtraSignatureData;
|
||||||
|
writerOptions.Logger = Logger.Instance;
|
||||||
module.Write(newFilename, writerOptions);
|
module.Write(newFilename, writerOptions);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
@ -1,85 +0,0 @@
|
||||||
/*
|
|
||||||
Copyright (C) 2011-2012 de4dot@gmail.com
|
|
||||||
|
|
||||||
This file is part of de4dot.
|
|
||||||
|
|
||||||
de4dot is free software: you can redistribute it and/or modify
|
|
||||||
it under the terms of the GNU General Public License as published by
|
|
||||||
the Free Software Foundation, either version 3 of the License, or
|
|
||||||
(at your option) any later version.
|
|
||||||
|
|
||||||
de4dot is distributed in the hope that it will be useful,
|
|
||||||
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
||||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
||||||
GNU General Public License for more details.
|
|
||||||
|
|
||||||
You should have received a copy of the GNU General Public License
|
|
||||||
along with de4dot. If not, see <http://www.gnu.org/licenses/>.
|
|
||||||
*/
|
|
||||||
|
|
||||||
using System;
|
|
||||||
using System.Collections.Generic;
|
|
||||||
|
|
||||||
namespace de4dot.code {
|
|
||||||
public static class Log {
|
|
||||||
public static int indentLevel = 0;
|
|
||||||
const int indentSize = 2;
|
|
||||||
|
|
||||||
public enum LogLevel {
|
|
||||||
error,
|
|
||||||
warning,
|
|
||||||
normal,
|
|
||||||
verbose,
|
|
||||||
veryverbose,
|
|
||||||
}
|
|
||||||
public static LogLevel logLevel = LogLevel.normal;
|
|
||||||
public static string indentString = "";
|
|
||||||
|
|
||||||
public static bool isAtLeast(LogLevel ll) {
|
|
||||||
return logLevel >= ll;
|
|
||||||
}
|
|
||||||
|
|
||||||
static void initIndentString() {
|
|
||||||
indentString = new string(' ', indentLevel * indentSize);
|
|
||||||
}
|
|
||||||
|
|
||||||
public static void indent() {
|
|
||||||
indentLevel++;
|
|
||||||
initIndentString();
|
|
||||||
}
|
|
||||||
|
|
||||||
public static void deIndent() {
|
|
||||||
if (indentLevel <= 0)
|
|
||||||
throw new ApplicationException("Can't de-indent!");
|
|
||||||
indentLevel--;
|
|
||||||
initIndentString();
|
|
||||||
}
|
|
||||||
|
|
||||||
public static void log(LogLevel l, string format, params object[] args) {
|
|
||||||
if (!isAtLeast(l))
|
|
||||||
return;
|
|
||||||
var indent = l <= LogLevel.warning ? "" : indentString;
|
|
||||||
Console.WriteLine(indent + format, args);
|
|
||||||
}
|
|
||||||
|
|
||||||
public static void e(string format, params object[] args) {
|
|
||||||
log(LogLevel.error, format, args);
|
|
||||||
}
|
|
||||||
|
|
||||||
public static void w(string format, params object[] args) {
|
|
||||||
log(LogLevel.warning, format, args);
|
|
||||||
}
|
|
||||||
|
|
||||||
public static void n(string format, params object[] args) {
|
|
||||||
log(LogLevel.normal, format, args);
|
|
||||||
}
|
|
||||||
|
|
||||||
public static void v(string format, params object[] args) {
|
|
||||||
log(LogLevel.verbose, format, args);
|
|
||||||
}
|
|
||||||
|
|
||||||
public static void vv(string format, params object[] args) {
|
|
||||||
log(LogLevel.veryverbose, format, args);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
161
de4dot.code/Logger.cs
Normal file
161
de4dot.code/Logger.cs
Normal file
|
@ -0,0 +1,161 @@
|
||||||
|
/*
|
||||||
|
Copyright (C) 2011-2012 de4dot@gmail.com
|
||||||
|
|
||||||
|
This file is part of de4dot.
|
||||||
|
|
||||||
|
de4dot is free software: you can redistribute it and/or modify
|
||||||
|
it under the terms of the GNU General Public License as published by
|
||||||
|
the Free Software Foundation, either version 3 of the License, or
|
||||||
|
(at your option) any later version.
|
||||||
|
|
||||||
|
de4dot is distributed in the hope that it will be useful,
|
||||||
|
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
GNU General Public License for more details.
|
||||||
|
|
||||||
|
You should have received a copy of the GNU General Public License
|
||||||
|
along with de4dot. If not, see <http://www.gnu.org/licenses/>.
|
||||||
|
*/
|
||||||
|
|
||||||
|
using System;
|
||||||
|
using System.Collections.Generic;
|
||||||
|
using dot10.DotNet;
|
||||||
|
|
||||||
|
namespace de4dot.code {
|
||||||
|
public class Logger : ILogger {
|
||||||
|
public readonly static Logger Instance = new Logger();
|
||||||
|
|
||||||
|
int indentLevel = 0;
|
||||||
|
readonly int indentSize = 0;
|
||||||
|
LoggerEvent maxLoggerEvent = LoggerEvent.Info;
|
||||||
|
string indentString = "";
|
||||||
|
Dictionary<string, bool> ignoredMessages = new Dictionary<string, bool>(StringComparer.Ordinal);
|
||||||
|
int numIgnoredMessages;
|
||||||
|
bool canIgnoreMessages;
|
||||||
|
|
||||||
|
public int IndentLevel {
|
||||||
|
get { return indentLevel; }
|
||||||
|
set {
|
||||||
|
if (indentLevel == value)
|
||||||
|
return;
|
||||||
|
indentLevel = value;
|
||||||
|
initIndentString();
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
public LoggerEvent MaxLoggerEvent {
|
||||||
|
get { return maxLoggerEvent; }
|
||||||
|
set { maxLoggerEvent = value; }
|
||||||
|
}
|
||||||
|
|
||||||
|
public bool CanIgnoreMessages {
|
||||||
|
get { return canIgnoreMessages; }
|
||||||
|
set { canIgnoreMessages = value; }
|
||||||
|
}
|
||||||
|
|
||||||
|
public int NumIgnoredMessages {
|
||||||
|
get { return numIgnoredMessages; }
|
||||||
|
}
|
||||||
|
|
||||||
|
public Logger()
|
||||||
|
: this(2, true) {
|
||||||
|
}
|
||||||
|
|
||||||
|
public Logger(int indentSize, bool canIgnoreMessages) {
|
||||||
|
this.indentSize = indentSize;
|
||||||
|
this.canIgnoreMessages = canIgnoreMessages;
|
||||||
|
}
|
||||||
|
|
||||||
|
void initIndentString() {
|
||||||
|
if (indentLevel < 0)
|
||||||
|
indentLevel = 0;
|
||||||
|
indentString = new string(' ', indentLevel * indentSize);
|
||||||
|
}
|
||||||
|
|
||||||
|
public void indent() {
|
||||||
|
indentLevel++;
|
||||||
|
initIndentString();
|
||||||
|
}
|
||||||
|
|
||||||
|
public void deIndent() {
|
||||||
|
indentLevel--;
|
||||||
|
initIndentString();
|
||||||
|
}
|
||||||
|
|
||||||
|
public void Log(object sender, LoggerEvent loggerEvent, string format, params object[] args) {
|
||||||
|
Log(true, sender, loggerEvent, format, args);
|
||||||
|
}
|
||||||
|
|
||||||
|
public void Log(bool canIgnore, object sender, LoggerEvent loggerEvent, string format, params object[] args) {
|
||||||
|
if (IgnoresEvent(loggerEvent))
|
||||||
|
return;
|
||||||
|
if (canIgnore && ignoreMessage(loggerEvent, format, args))
|
||||||
|
return;
|
||||||
|
|
||||||
|
switch (loggerEvent) {
|
||||||
|
case LoggerEvent.Error:
|
||||||
|
foreach (var l in string.Format(format, args).Split('\n'))
|
||||||
|
LogMessage(string.Empty, string.Format("ERROR: {0}", l));
|
||||||
|
break;
|
||||||
|
|
||||||
|
case LoggerEvent.Warning:
|
||||||
|
foreach (var l in string.Format(format, args).Split('\n'))
|
||||||
|
LogMessage(string.Empty, string.Format("WARNING: {0}", l));
|
||||||
|
break;
|
||||||
|
|
||||||
|
default:
|
||||||
|
var indent = loggerEvent <= LoggerEvent.Warning ? "" : indentString;
|
||||||
|
LogMessage(indent, format, args);
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
bool ignoreMessage(LoggerEvent loggerEvent, string format, object[] args) {
|
||||||
|
if (loggerEvent != LoggerEvent.Error && loggerEvent != LoggerEvent.Warning)
|
||||||
|
return false;
|
||||||
|
if (!canIgnoreMessages)
|
||||||
|
return false;
|
||||||
|
if (ignoredMessages.ContainsKey(format)) {
|
||||||
|
numIgnoredMessages++;
|
||||||
|
return true;
|
||||||
|
}
|
||||||
|
ignoredMessages[format] = true;
|
||||||
|
return false;
|
||||||
|
}
|
||||||
|
|
||||||
|
void LogMessage(string indent, string format, params object[] args) {
|
||||||
|
if (args == null || args.Length == 0)
|
||||||
|
Console.WriteLine("{0}{1}", indent, format);
|
||||||
|
else
|
||||||
|
Console.WriteLine(indent + format, args);
|
||||||
|
}
|
||||||
|
|
||||||
|
public bool IgnoresEvent(LoggerEvent loggerEvent) {
|
||||||
|
return loggerEvent > maxLoggerEvent;
|
||||||
|
}
|
||||||
|
|
||||||
|
public static void log(LoggerEvent loggerEvent, string format, params object[] args) {
|
||||||
|
Instance.Log(null, loggerEvent, format, args);
|
||||||
|
}
|
||||||
|
|
||||||
|
public static void e(string format, params object[] args) {
|
||||||
|
Instance.Log(null, LoggerEvent.Error, format, args);
|
||||||
|
}
|
||||||
|
|
||||||
|
public static void w(string format, params object[] args) {
|
||||||
|
Instance.Log(null, LoggerEvent.Warning, format, args);
|
||||||
|
}
|
||||||
|
|
||||||
|
public static void n(string format, params object[] args) {
|
||||||
|
Instance.Log(null, LoggerEvent.Info, format, args);
|
||||||
|
}
|
||||||
|
|
||||||
|
public static void v(string format, params object[] args) {
|
||||||
|
Instance.Log(null, LoggerEvent.Verbose, format, args);
|
||||||
|
}
|
||||||
|
|
||||||
|
public static void vv(string format, params object[] args) {
|
||||||
|
Instance.Log(null, LoggerEvent.VeryVerbose, format, args);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
|
@ -25,7 +25,7 @@ using de4dot.blocks;
|
||||||
|
|
||||||
namespace de4dot.code {
|
namespace de4dot.code {
|
||||||
class MethodPrinter {
|
class MethodPrinter {
|
||||||
Log.LogLevel logLevel;
|
LoggerEvent loggerEvent;
|
||||||
IList<Instruction> allInstructions;
|
IList<Instruction> allInstructions;
|
||||||
IList<ExceptionHandler> allExceptionHandlers;
|
IList<ExceptionHandler> allExceptionHandlers;
|
||||||
Dictionary<Instruction, bool> targets = new Dictionary<Instruction, bool>();
|
Dictionary<Instruction, bool> targets = new Dictionary<Instruction, bool>();
|
||||||
|
@ -41,9 +41,9 @@ namespace de4dot.code {
|
||||||
Dictionary<Instruction, ExInfo> exInfos = new Dictionary<Instruction, ExInfo>();
|
Dictionary<Instruction, ExInfo> exInfos = new Dictionary<Instruction, ExInfo>();
|
||||||
ExInfo lastExInfo;
|
ExInfo lastExInfo;
|
||||||
|
|
||||||
public void print(Log.LogLevel logLevel, IList<Instruction> allInstructions, IList<ExceptionHandler> allExceptionHandlers) {
|
public void print(LoggerEvent loggerEvent, IList<Instruction> allInstructions, IList<ExceptionHandler> allExceptionHandlers) {
|
||||||
try {
|
try {
|
||||||
this.logLevel = logLevel;
|
this.loggerEvent = loggerEvent;
|
||||||
this.allInstructions = allInstructions;
|
this.allInstructions = allInstructions;
|
||||||
this.allExceptionHandlers = allExceptionHandlers;
|
this.allExceptionHandlers = allExceptionHandlers;
|
||||||
lastExInfo = new ExInfo();
|
lastExInfo = new ExInfo();
|
||||||
|
@ -121,12 +121,12 @@ namespace de4dot.code {
|
||||||
initTargets();
|
initTargets();
|
||||||
initExHandlers();
|
initExHandlers();
|
||||||
|
|
||||||
Log.indent();
|
Logger.Instance.indent();
|
||||||
foreach (var instr in allInstructions) {
|
foreach (var instr in allInstructions) {
|
||||||
if (targets.ContainsKey(instr)) {
|
if (targets.ContainsKey(instr)) {
|
||||||
Log.deIndent();
|
Logger.Instance.deIndent();
|
||||||
Log.log(logLevel, "{0}:", getLabel(instr));
|
Logger.log(loggerEvent, "{0}:", getLabel(instr));
|
||||||
Log.indent();
|
Logger.Instance.indent();
|
||||||
}
|
}
|
||||||
ExInfo exInfo;
|
ExInfo exInfo;
|
||||||
if (exInfos.TryGetValue(instr, out exInfo))
|
if (exInfos.TryGetValue(instr, out exInfo))
|
||||||
|
@ -135,14 +135,14 @@ namespace de4dot.code {
|
||||||
var operandString = getOperandString(instr);
|
var operandString = getOperandString(instr);
|
||||||
var memberReference = instr.Operand as ITokenOperand;
|
var memberReference = instr.Operand as ITokenOperand;
|
||||||
if (operandString == "")
|
if (operandString == "")
|
||||||
Log.log(logLevel, "{0}", instrString);
|
Logger.log(loggerEvent, "{0}", instrString);
|
||||||
else if (memberReference != null)
|
else if (memberReference != null)
|
||||||
Log.log(logLevel, "{0,-9} {1} // {2:X8}", instrString, Utils.removeNewlines(operandString), memberReference.MDToken.ToUInt32());
|
Logger.log(loggerEvent, "{0,-9} {1} // {2:X8}", instrString, Utils.removeNewlines(operandString), memberReference.MDToken.ToUInt32());
|
||||||
else
|
else
|
||||||
Log.log(logLevel, "{0,-9} {1}", instrString, Utils.removeNewlines(operandString));
|
Logger.log(loggerEvent, "{0,-9} {1}", instrString, Utils.removeNewlines(operandString));
|
||||||
}
|
}
|
||||||
printExInfo(lastExInfo);
|
printExInfo(lastExInfo);
|
||||||
Log.deIndent();
|
Logger.Instance.deIndent();
|
||||||
}
|
}
|
||||||
|
|
||||||
string getOperandString(Instruction instr) {
|
string getOperandString(Instruction instr) {
|
||||||
|
@ -172,18 +172,18 @@ namespace de4dot.code {
|
||||||
}
|
}
|
||||||
|
|
||||||
void printExInfo(ExInfo exInfo) {
|
void printExInfo(ExInfo exInfo) {
|
||||||
Log.deIndent();
|
Logger.Instance.deIndent();
|
||||||
foreach (var ex in exInfo.tryStarts)
|
foreach (var ex in exInfo.tryStarts)
|
||||||
Log.log(logLevel, "// try start: {0}", getExceptionString(ex));
|
Logger.log(loggerEvent, "// try start: {0}", getExceptionString(ex));
|
||||||
foreach (var ex in exInfo.tryEnds)
|
foreach (var ex in exInfo.tryEnds)
|
||||||
Log.log(logLevel, "// try end: {0}", getExceptionString(ex));
|
Logger.log(loggerEvent, "// try end: {0}", getExceptionString(ex));
|
||||||
foreach (var ex in exInfo.filterStarts)
|
foreach (var ex in exInfo.filterStarts)
|
||||||
Log.log(logLevel, "// filter start: {0}", getExceptionString(ex));
|
Logger.log(loggerEvent, "// filter start: {0}", getExceptionString(ex));
|
||||||
foreach (var ex in exInfo.handlerStarts)
|
foreach (var ex in exInfo.handlerStarts)
|
||||||
Log.log(logLevel, "// handler start: {0}", getExceptionString(ex));
|
Logger.log(loggerEvent, "// handler start: {0}", getExceptionString(ex));
|
||||||
foreach (var ex in exInfo.handlerEnds)
|
foreach (var ex in exInfo.handlerEnds)
|
||||||
Log.log(logLevel, "// handler end: {0}", getExceptionString(ex));
|
Logger.log(loggerEvent, "// handler end: {0}", getExceptionString(ex));
|
||||||
Log.indent();
|
Logger.Instance.indent();
|
||||||
}
|
}
|
||||||
|
|
||||||
string getExceptionString(ExceptionHandler ex) {
|
string getExceptionString(ExceptionHandler ex) {
|
||||||
|
|
|
@ -301,7 +301,7 @@ namespace de4dot.code {
|
||||||
// We're here if there were no cflow deobfuscation, or if there are two or
|
// We're here if there were no cflow deobfuscation, or if there are two or
|
||||||
// more blocks branching to the decrypter method, or the two blocks can't be
|
// more blocks branching to the decrypter method, or the two blocks can't be
|
||||||
// merged because one is outside the exception handler (eg. buggy obfuscator).
|
// merged because one is outside the exception handler (eg. buggy obfuscator).
|
||||||
Log.w("Could not find all arguments to method {0} ({1:X8})",
|
Logger.w("Could not find all arguments to method {0} ({1:X8})",
|
||||||
Utils.removeNewlines(method),
|
Utils.removeNewlines(method),
|
||||||
method.MDToken.ToInt32());
|
method.MDToken.ToInt32());
|
||||||
errors++;
|
errors++;
|
||||||
|
@ -354,7 +354,7 @@ namespace de4dot.code {
|
||||||
int pushes, pops;
|
int pushes, pops;
|
||||||
instr.Instruction.CalculateStackUsage(false, out pushes, out pops);
|
instr.Instruction.CalculateStackUsage(false, out pushes, out pops);
|
||||||
if (!useUnknownArgs || pushes != 1) {
|
if (!useUnknownArgs || pushes != 1) {
|
||||||
Log.w("Could not find all arguments to method {0} ({1:X8}), instr: {2}",
|
Logger.w("Could not find all arguments to method {0} ({1:X8}), instr: {2}",
|
||||||
Utils.removeNewlines(method),
|
Utils.removeNewlines(method),
|
||||||
method.MDToken.ToInt32(),
|
method.MDToken.ToInt32(),
|
||||||
instr);
|
instr);
|
||||||
|
|
|
@ -177,7 +177,7 @@ namespace de4dot.code {
|
||||||
catch (BadImageFormatException) {
|
catch (BadImageFormatException) {
|
||||||
if (!unpackNativeImage(deobfuscators))
|
if (!unpackNativeImage(deobfuscators))
|
||||||
throw new BadImageFormatException();
|
throw new BadImageFormatException();
|
||||||
Log.v("Unpacked native file");
|
Logger.v("Unpacked native file");
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -198,7 +198,7 @@ namespace de4dot.code {
|
||||||
module = assemblyModule.load(unpackedData);
|
module = assemblyModule.load(unpackedData);
|
||||||
}
|
}
|
||||||
catch {
|
catch {
|
||||||
Log.w("Could not load unpacked data. Deobfuscator: {0}", deob.TypeLong);
|
Logger.w("Could not load unpacked data. Deobfuscator: {0}", deob.TypeLong);
|
||||||
continue;
|
continue;
|
||||||
}
|
}
|
||||||
this.deob = deob;
|
this.deob = deob;
|
||||||
|
@ -283,7 +283,7 @@ namespace de4dot.code {
|
||||||
catch {
|
catch {
|
||||||
val = deob.Type == "un" ? 1 : 0;
|
val = deob.Type == "un" ? 1 : 0;
|
||||||
}
|
}
|
||||||
Log.v("{0,3}: {1}", val, deob.TypeLong);
|
Logger.v("{0,3}: {1}", val, deob.TypeLong);
|
||||||
if (val > 0 && deob.Type != "un")
|
if (val > 0 && deob.Type != "un")
|
||||||
allDetected.Add(deob);
|
allDetected.Add(deob);
|
||||||
if (val > detectVal) {
|
if (val > detectVal) {
|
||||||
|
@ -294,11 +294,11 @@ namespace de4dot.code {
|
||||||
this.deob = null;
|
this.deob = null;
|
||||||
|
|
||||||
if (allDetected.Count > 1) {
|
if (allDetected.Count > 1) {
|
||||||
Log.n("More than one obfuscator detected:");
|
Logger.n("More than one obfuscator detected:");
|
||||||
Log.indent();
|
Logger.Instance.indent();
|
||||||
foreach (var deob in allDetected)
|
foreach (var deob in allDetected)
|
||||||
Log.n("{0} (use: -p {1})", deob.Name, deob.Type);
|
Logger.n("{0} (use: -p {1})", deob.Name, deob.Type);
|
||||||
Log.deIndent();
|
Logger.Instance.deIndent();
|
||||||
}
|
}
|
||||||
|
|
||||||
return detected;
|
return detected;
|
||||||
|
@ -309,7 +309,7 @@ namespace de4dot.code {
|
||||||
}
|
}
|
||||||
|
|
||||||
public void save() {
|
public void save() {
|
||||||
Log.n("Saving {0}", options.NewFilename);
|
Logger.n("Saving {0}", options.NewFilename);
|
||||||
assemblyModule.save(options.NewFilename, ShouldPreserveTokens(), options.ControlFlowDeobfuscation, deob as IModuleWriterListener);
|
assemblyModule.save(options.NewFilename, ShouldPreserveTokens(), options.ControlFlowDeobfuscation, deob as IModuleWriterListener);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -353,7 +353,7 @@ namespace de4dot.code {
|
||||||
}
|
}
|
||||||
|
|
||||||
public void deobfuscate() {
|
public void deobfuscate() {
|
||||||
Log.n("Cleaning {0}", options.Filename);
|
Logger.n("Cleaning {0}", options.Filename);
|
||||||
initAssemblyClient();
|
initAssemblyClient();
|
||||||
|
|
||||||
for (int i = 0; ; i++) {
|
for (int i = 0; ; i++) {
|
||||||
|
@ -370,7 +370,7 @@ namespace de4dot.code {
|
||||||
}
|
}
|
||||||
|
|
||||||
void reloadModule(byte[] newModuleData, DumpedMethods dumpedMethods) {
|
void reloadModule(byte[] newModuleData, DumpedMethods dumpedMethods) {
|
||||||
Log.v("Reloading decrypted assembly (original filename: {0})", Filename);
|
Logger.v("Reloading decrypted assembly (original filename: {0})", Filename);
|
||||||
simpleDeobfuscatorFlags.Clear();
|
simpleDeobfuscatorFlags.Clear();
|
||||||
module = assemblyModule.reload(newModuleData, createDumpedMethodsRestorer(dumpedMethods), deob as IStringDecrypter);
|
module = assemblyModule.reload(newModuleData, createDumpedMethodsRestorer(dumpedMethods), deob as IStringDecrypter);
|
||||||
deob = deob.moduleReloaded(module);
|
deob = deob.moduleReloaded(module);
|
||||||
|
@ -460,7 +460,7 @@ namespace de4dot.code {
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
Log.v("Adding string decrypter; token: {0:X8}, method: {1}", method.MDToken.ToInt32(), Utils.removeNewlines(method.FullName));
|
Logger.v("Adding string decrypter; token: {0:X8}, method: {1}", method.MDToken.ToInt32(), Utils.removeNewlines(method.FullName));
|
||||||
tokens.Add(method.MDToken.ToInt32());
|
tokens.Add(method.MDToken.ToInt32());
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
@ -538,14 +538,14 @@ namespace de4dot.code {
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
|
|
||||||
Log.v("Deobfuscating methods");
|
Logger.v("Deobfuscating methods");
|
||||||
var methodPrinter = new MethodPrinter();
|
var methodPrinter = new MethodPrinter();
|
||||||
var cflowDeobfuscator = new BlocksCflowDeobfuscator(deob.BlocksDeobfuscators);
|
var cflowDeobfuscator = new BlocksCflowDeobfuscator(deob.BlocksDeobfuscators);
|
||||||
foreach (var method in getAllMethods()) {
|
foreach (var method in getAllMethods()) {
|
||||||
Log.v("Deobfuscating {0} ({1:X8})", Utils.removeNewlines(method), method.MDToken.ToUInt32());
|
Logger.v("Deobfuscating {0} ({1:X8})", Utils.removeNewlines(method), method.MDToken.ToUInt32());
|
||||||
Log.indent();
|
Logger.Instance.indent();
|
||||||
|
|
||||||
int oldIndentLevel = Log.indentLevel;
|
int oldIndentLevel = Logger.Instance.IndentLevel;
|
||||||
try {
|
try {
|
||||||
deobfuscate(method, cflowDeobfuscator, methodPrinter);
|
deobfuscate(method, cflowDeobfuscator, methodPrinter);
|
||||||
}
|
}
|
||||||
|
@ -554,21 +554,21 @@ namespace de4dot.code {
|
||||||
}
|
}
|
||||||
catch (Exception ex) {
|
catch (Exception ex) {
|
||||||
if (!canLoadMethodBody(method)) {
|
if (!canLoadMethodBody(method)) {
|
||||||
Log.v("Invalid method body. {0:X8}", method.MDToken.ToInt32());
|
Logger.v("Invalid method body. {0:X8}", method.MDToken.ToInt32());
|
||||||
method.Body = new CilBody();
|
method.Body = new CilBody();
|
||||||
}
|
}
|
||||||
else {
|
else {
|
||||||
Log.w("Could not deobfuscate method {0:X8}. Hello, E.T.: {1}", // E.T. = exception type
|
Logger.w("Could not deobfuscate method {0:X8}. Hello, E.T.: {1}", // E.T. = exception type
|
||||||
method.MDToken.ToInt32(),
|
method.MDToken.ToInt32(),
|
||||||
ex.GetType());
|
ex.GetType());
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
finally {
|
finally {
|
||||||
Log.indentLevel = oldIndentLevel;
|
Logger.Instance.IndentLevel = oldIndentLevel;
|
||||||
}
|
}
|
||||||
removeNoInliningAttribute(method);
|
removeNoInliningAttribute(method);
|
||||||
|
|
||||||
Log.deIndent();
|
Logger.Instance.deIndent();
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -616,17 +616,17 @@ namespace de4dot.code {
|
||||||
DotNetUtils.restoreBody(method, allInstructions, allExceptionHandlers);
|
DotNetUtils.restoreBody(method, allInstructions, allExceptionHandlers);
|
||||||
|
|
||||||
if (numRemovedLocals > 0)
|
if (numRemovedLocals > 0)
|
||||||
Log.v("Removed {0} unused local(s)", numRemovedLocals);
|
Logger.v("Removed {0} unused local(s)", numRemovedLocals);
|
||||||
int numRemovedInstructions = oldNumInstructions - method.Body.Instructions.Count;
|
int numRemovedInstructions = oldNumInstructions - method.Body.Instructions.Count;
|
||||||
if (numRemovedInstructions > 0)
|
if (numRemovedInstructions > 0)
|
||||||
Log.v("Removed {0} dead instruction(s)", numRemovedInstructions);
|
Logger.v("Removed {0} dead instruction(s)", numRemovedInstructions);
|
||||||
|
|
||||||
const Log.LogLevel dumpLogLevel = Log.LogLevel.veryverbose;
|
const LoggerEvent dumpLogLevel = LoggerEvent.VeryVerbose;
|
||||||
if (Log.isAtLeast(dumpLogLevel)) {
|
if (!Logger.Instance.IgnoresEvent(dumpLogLevel)) {
|
||||||
Log.log(dumpLogLevel, "Deobfuscated code:");
|
Logger.log(dumpLogLevel, "Deobfuscated code:");
|
||||||
Log.indent();
|
Logger.Instance.indent();
|
||||||
methodPrinter.print(dumpLogLevel, allInstructions, allExceptionHandlers);
|
methodPrinter.print(dumpLogLevel, allInstructions, allExceptionHandlers);
|
||||||
Log.deIndent();
|
Logger.Instance.deIndent();
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -713,8 +713,8 @@ namespace de4dot.code {
|
||||||
if (savedMethodBodies != null)
|
if (savedMethodBodies != null)
|
||||||
savedMethodBodies.save(method);
|
savedMethodBodies.save(method);
|
||||||
|
|
||||||
Log.v("{0}: {1} ({2:X8})", msg, Utils.removeNewlines(method), method.MDToken.ToUInt32());
|
Logger.v("{0}: {1} ({2:X8})", msg, Utils.removeNewlines(method), method.MDToken.ToUInt32());
|
||||||
Log.indent();
|
Logger.Instance.indent();
|
||||||
|
|
||||||
if (hasNonEmptyBody(method)) {
|
if (hasNonEmptyBody(method)) {
|
||||||
try {
|
try {
|
||||||
|
@ -728,11 +728,11 @@ namespace de4dot.code {
|
||||||
DotNetUtils.restoreBody(method, allInstructions, allExceptionHandlers);
|
DotNetUtils.restoreBody(method, allInstructions, allExceptionHandlers);
|
||||||
}
|
}
|
||||||
catch {
|
catch {
|
||||||
Log.v("Could not deobfuscate {0:X8}", method.MDToken.ToInt32());
|
Logger.v("Could not deobfuscate {0:X8}", method.MDToken.ToInt32());
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
Log.deIndent();
|
Logger.Instance.deIndent();
|
||||||
}
|
}
|
||||||
|
|
||||||
void ISimpleDeobfuscator.deobfuscate(MethodDef method) {
|
void ISimpleDeobfuscator.deobfuscate(MethodDef method) {
|
||||||
|
@ -759,7 +759,7 @@ namespace de4dot.code {
|
||||||
extension = ".dll";
|
extension = ".dll";
|
||||||
var baseDir = Utils.getDirName(options.NewFilename);
|
var baseDir = Utils.getDirName(options.NewFilename);
|
||||||
var newName = Path.Combine(baseDir, assemblyName + extension);
|
var newName = Path.Combine(baseDir, assemblyName + extension);
|
||||||
Log.n("Creating file {0}", newName);
|
Logger.n("Creating file {0}", newName);
|
||||||
using (var writer = new BinaryWriter(new FileStream(newName, FileMode.Create))) {
|
using (var writer = new BinaryWriter(new FileStream(newName, FileMode.Create))) {
|
||||||
writer.Write(data);
|
writer.Write(data);
|
||||||
}
|
}
|
||||||
|
|
|
@ -57,7 +57,7 @@ namespace de4dot.code {
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
Log.v("Decrypted string: {0}", Utils.toCsharpString(decryptedString));
|
Logger.v("Decrypted string: {0}", Utils.toCsharpString(decryptedString));
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
|
@ -265,7 +265,7 @@
|
||||||
<Compile Include="deobfuscators\Xenocode\StringDecrypter.cs" />
|
<Compile Include="deobfuscators\Xenocode\StringDecrypter.cs" />
|
||||||
<Compile Include="IDeobfuscatorContext.cs" />
|
<Compile Include="IDeobfuscatorContext.cs" />
|
||||||
<Compile Include="IObfuscatedFile.cs" />
|
<Compile Include="IObfuscatedFile.cs" />
|
||||||
<Compile Include="Log.cs" />
|
<Compile Include="Logger.cs" />
|
||||||
<Compile Include="DumpedMethodsRestorer.cs" />
|
<Compile Include="DumpedMethodsRestorer.cs" />
|
||||||
<Compile Include="MethodPrinter.cs" />
|
<Compile Include="MethodPrinter.cs" />
|
||||||
<Compile Include="MethodReturnValueInliner.cs" />
|
<Compile Include="MethodReturnValueInliner.cs" />
|
||||||
|
|
|
@ -219,7 +219,7 @@ namespace de4dot.code.deobfuscators.Agile_NET {
|
||||||
var peImage = new PeImage(fileData);
|
var peImage = new PeImage(fileData);
|
||||||
|
|
||||||
if (!new MethodsDecrypter().decrypt(peImage, module, cliSecureRtType, ref dumpedMethods)) {
|
if (!new MethodsDecrypter().decrypt(peImage, module, cliSecureRtType, ref dumpedMethods)) {
|
||||||
Log.v("Methods aren't encrypted or invalid signature");
|
Logger.v("Methods aren't encrypted or invalid signature");
|
||||||
return false;
|
return false;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -331,7 +331,7 @@ namespace de4dot.code.deobfuscators.Agile_NET {
|
||||||
if (!options.RemoveStackFrameHelper)
|
if (!options.RemoveStackFrameHelper)
|
||||||
return;
|
return;
|
||||||
if (stackFrameHelper.ExceptionLoggerRemover.remove(blocks))
|
if (stackFrameHelper.ExceptionLoggerRemover.remove(blocks))
|
||||||
Log.v("Removed StackFrameHelper code");
|
Logger.v("Removed StackFrameHelper code");
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
|
@ -444,7 +444,7 @@ namespace de4dot.code.deobfuscators.Agile_NET {
|
||||||
case DecryptResult.NotEncrypted: return false;
|
case DecryptResult.NotEncrypted: return false;
|
||||||
|
|
||||||
case DecryptResult.Error:
|
case DecryptResult.Error:
|
||||||
Log.w("Using dynamic method decryption");
|
Logger.w("Using dynamic method decryption");
|
||||||
byte[] moduleCctorBytes = getModuleCctorBytes(csRtType);
|
byte[] moduleCctorBytes = getModuleCctorBytes(csRtType);
|
||||||
dumpedMethods = de4dot.code.deobfuscators.MethodsDecrypter.decrypt(module.Location, moduleCctorBytes);
|
dumpedMethods = de4dot.code.deobfuscators.MethodsDecrypter.decrypt(module.Location, moduleCctorBytes);
|
||||||
return true;
|
return true;
|
||||||
|
|
|
@ -60,7 +60,7 @@ namespace de4dot.code.deobfuscators.Agile_NET {
|
||||||
|
|
||||||
int delegateToken = 0x02000001 + instrs[0].GetLdcI4Value();
|
int delegateToken = 0x02000001 + instrs[0].GetLdcI4Value();
|
||||||
if (type.MDToken.ToInt32() != delegateToken) {
|
if (type.MDToken.ToInt32() != delegateToken) {
|
||||||
Log.w("Delegate token is not current type");
|
Logger.w("Delegate token is not current type");
|
||||||
return null;
|
return null;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
@ -86,18 +86,18 @@ namespace de4dot.code.deobfuscators.Agile_NET.vm {
|
||||||
if (!Detected)
|
if (!Detected)
|
||||||
return;
|
return;
|
||||||
|
|
||||||
int oldIndent = Log.indentLevel;
|
int oldIndent = Logger.Instance.IndentLevel;
|
||||||
try {
|
try {
|
||||||
restore2();
|
restore2();
|
||||||
}
|
}
|
||||||
finally {
|
finally {
|
||||||
Log.indentLevel = oldIndent;
|
Logger.Instance.IndentLevel = oldIndent;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
void restore2() {
|
void restore2() {
|
||||||
Log.v("Restoring CSVM methods");
|
Logger.v("Restoring CSVM methods");
|
||||||
Log.indent();
|
Logger.Instance.indent();
|
||||||
|
|
||||||
var opcodeDetector = getVmOpCodeHandlerDetector();
|
var opcodeDetector = getVmOpCodeHandlerDetector();
|
||||||
var csvmMethods = new CsvmDataReader(resource.Data).read();
|
var csvmMethods = new CsvmDataReader(resource.Data).read();
|
||||||
|
@ -108,37 +108,37 @@ namespace de4dot.code.deobfuscators.Agile_NET.vm {
|
||||||
if (cilMethod == null)
|
if (cilMethod == null)
|
||||||
throw new ApplicationException(string.Format("Could not find method {0:X8}", csvmMethod.Token));
|
throw new ApplicationException(string.Format("Could not find method {0:X8}", csvmMethod.Token));
|
||||||
converter.convert(cilMethod, csvmMethod);
|
converter.convert(cilMethod, csvmMethod);
|
||||||
Log.v("Restored method {0:X8}", cilMethod.MDToken.ToInt32());
|
Logger.v("Restored method {0:X8}", cilMethod.MDToken.ToInt32());
|
||||||
printMethod(methodPrinter, cilMethod);
|
printMethod(methodPrinter, cilMethod);
|
||||||
}
|
}
|
||||||
Log.deIndent();
|
Logger.Instance.deIndent();
|
||||||
}
|
}
|
||||||
|
|
||||||
static void printMethod(MethodPrinter methodPrinter, MethodDef method) {
|
static void printMethod(MethodPrinter methodPrinter, MethodDef method) {
|
||||||
const Log.LogLevel dumpLogLevel = Log.LogLevel.verbose;
|
const LoggerEvent dumpLogLevel = LoggerEvent.Verbose;
|
||||||
if (!Log.isAtLeast(dumpLogLevel))
|
if (Logger.Instance.IgnoresEvent(dumpLogLevel))
|
||||||
return;
|
return;
|
||||||
|
|
||||||
Log.indent();
|
Logger.Instance.indent();
|
||||||
|
|
||||||
Log.v("Locals:");
|
Logger.v("Locals:");
|
||||||
Log.indent();
|
Logger.Instance.indent();
|
||||||
for (int i = 0; i < method.Body.LocalList.Count; i++)
|
for (int i = 0; i < method.Body.LocalList.Count; i++)
|
||||||
Log.v("#{0}: {1}", i, method.Body.LocalList[i].Type);
|
Logger.v("#{0}: {1}", i, method.Body.LocalList[i].Type);
|
||||||
Log.deIndent();
|
Logger.Instance.deIndent();
|
||||||
|
|
||||||
Log.v("Code:");
|
Logger.v("Code:");
|
||||||
Log.indent();
|
Logger.Instance.indent();
|
||||||
methodPrinter.print(dumpLogLevel, method.Body.Instructions, method.Body.ExceptionHandlers);
|
methodPrinter.print(dumpLogLevel, method.Body.Instructions, method.Body.ExceptionHandlers);
|
||||||
Log.deIndent();
|
Logger.Instance.deIndent();
|
||||||
|
|
||||||
Log.deIndent();
|
Logger.Instance.deIndent();
|
||||||
}
|
}
|
||||||
|
|
||||||
VmOpCodeHandlerDetector getVmOpCodeHandlerDetector() {
|
VmOpCodeHandlerDetector getVmOpCodeHandlerDetector() {
|
||||||
var vmFilename = vmAssemblyReference.Name + ".dll";
|
var vmFilename = vmAssemblyReference.Name + ".dll";
|
||||||
var vmModulePath = Path.Combine(Path.GetDirectoryName(module.Location), vmFilename);
|
var vmModulePath = Path.Combine(Path.GetDirectoryName(module.Location), vmFilename);
|
||||||
Log.v("CSVM filename: {0}", vmFilename);
|
Logger.v("CSVM filename: {0}", vmFilename);
|
||||||
|
|
||||||
var dataKey = "cs cached VmOpCodeHandlerDetector";
|
var dataKey = "cs cached VmOpCodeHandlerDetector";
|
||||||
var dict = (Dictionary<string, VmOpCodeHandlerDetector>)deobfuscatorContext.getData(dataKey);
|
var dict = (Dictionary<string, VmOpCodeHandlerDetector>)deobfuscatorContext.getData(dataKey);
|
||||||
|
@ -150,11 +150,11 @@ namespace de4dot.code.deobfuscators.Agile_NET.vm {
|
||||||
dict[vmModulePath] = detector = new VmOpCodeHandlerDetector(ModuleDefMD.Load(vmModulePath));
|
dict[vmModulePath] = detector = new VmOpCodeHandlerDetector(ModuleDefMD.Load(vmModulePath));
|
||||||
|
|
||||||
detector.findHandlers();
|
detector.findHandlers();
|
||||||
Log.v("CSVM opcodes:");
|
Logger.v("CSVM opcodes:");
|
||||||
Log.indent();
|
Logger.Instance.indent();
|
||||||
for (int i = 0; i < detector.Handlers.Count; i++)
|
for (int i = 0; i < detector.Handlers.Count; i++)
|
||||||
Log.v("{0:X4}: {1}", i, detector.Handlers[i].Name);
|
Logger.v("{0:X4}: {1}", i, detector.Handlers[i].Name);
|
||||||
Log.deIndent();
|
Logger.Instance.deIndent();
|
||||||
|
|
||||||
return detector;
|
return detector;
|
||||||
}
|
}
|
||||||
|
|
|
@ -49,7 +49,7 @@ namespace de4dot.code.deobfuscators.Agile_NET.vm {
|
||||||
DotNetUtils.restoreBody(cilMethod, newInstructions, newExceptions);
|
DotNetUtils.restoreBody(cilMethod, newInstructions, newExceptions);
|
||||||
|
|
||||||
if (!operandRestorer.restore(cilMethod))
|
if (!operandRestorer.restore(cilMethod))
|
||||||
Log.w("Failed to restore one or more instruction operands in CSVM method {0:X8}", cilMethod.MDToken.ToInt32());
|
Logger.w("Failed to restore one or more instruction operands in CSVM method {0:X8}", cilMethod.MDToken.ToInt32());
|
||||||
restoreConstrainedPrefix(cilMethod);
|
restoreConstrainedPrefix(cilMethod);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -378,7 +378,7 @@ namespace de4dot.code.deobfuscators.Agile_NET.vm {
|
||||||
var field = deobfuscatorContext.resolveField(fieldRef);
|
var field = deobfuscatorContext.resolveField(fieldRef);
|
||||||
bool isStatic;
|
bool isStatic;
|
||||||
if (field == null) {
|
if (field == null) {
|
||||||
Log.w("Could not resolve field {0:X8}. Assuming it's not static.", token);
|
Logger.w("Could not resolve field {0:X8}. Assuming it's not static.", token);
|
||||||
isStatic = false;
|
isStatic = false;
|
||||||
}
|
}
|
||||||
else
|
else
|
||||||
|
|
|
@ -111,7 +111,7 @@ namespace de4dot.code.deobfuscators.Babel_NET {
|
||||||
|
|
||||||
encryptedResource = BabelUtils.findEmbeddedResource(module, resolverType, simpleDeobfuscator, deob);
|
encryptedResource = BabelUtils.findEmbeddedResource(module, resolverType, simpleDeobfuscator, deob);
|
||||||
if (encryptedResource == null) {
|
if (encryptedResource == null) {
|
||||||
Log.w("Could not find embedded assemblies resource");
|
Logger.w("Could not find embedded assemblies resource");
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
@ -148,7 +148,7 @@ namespace de4dot.code.deobfuscators.Babel_NET {
|
||||||
|
|
||||||
encryptedResource = BabelUtils.findEmbeddedResource(module, decrypterType, simpleDeobfuscator, deob);
|
encryptedResource = BabelUtils.findEmbeddedResource(module, decrypterType, simpleDeobfuscator, deob);
|
||||||
if (encryptedResource == null) {
|
if (encryptedResource == null) {
|
||||||
Log.w("Could not find encrypted constants resource");
|
Logger.w("Could not find encrypted constants resource");
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -256,7 +256,7 @@ namespace de4dot.code.deobfuscators.Babel_NET {
|
||||||
if (arrayType == null)
|
if (arrayType == null)
|
||||||
continue;
|
continue;
|
||||||
if (arrayType.Next.ElementType.GetPrimitiveSize() == -1) {
|
if (arrayType.Next.ElementType.GetPrimitiveSize() == -1) {
|
||||||
Log.w("Can't decrypt non-primitive type array in method {0:X8}", blocks.Method.MDToken.ToInt32());
|
Logger.w("Can't decrypt non-primitive type array in method {0:X8}", blocks.Method.MDToken.ToInt32());
|
||||||
continue;
|
continue;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -269,7 +269,7 @@ namespace de4dot.code.deobfuscators.Babel_NET {
|
||||||
var decrypted = decryptArray(info.encryptedField.InitialValue, elemSize);
|
var decrypted = decryptArray(info.encryptedField.InitialValue, elemSize);
|
||||||
|
|
||||||
initializedDataCreator.addInitializeArrayCode(block, info.start, info.len, info.arrayType.Next.ToTypeDefOrRef(), decrypted);
|
initializedDataCreator.addInitializeArrayCode(block, info.start, info.len, info.arrayType.Next.ToTypeDefOrRef(), decrypted);
|
||||||
Log.v("Decrypted {0} array: {1} elements", info.arrayType.Next.ToString(), decrypted.Length / elemSize);
|
Logger.v("Decrypted {0} array: {1} elements", info.arrayType.Next.ToString(), decrypted.Length / elemSize);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
|
@ -206,7 +206,7 @@ namespace de4dot.code.deobfuscators.Babel_NET {
|
||||||
|
|
||||||
if (Operations.DecryptStrings != OpDecryptString.None) {
|
if (Operations.DecryptStrings != OpDecryptString.None) {
|
||||||
if (stringDecrypter.Resource != null)
|
if (stringDecrypter.Resource != null)
|
||||||
Log.v("Adding string decrypter. Resource: {0}", Utils.toCsharpString(stringDecrypter.Resource.Name));
|
Logger.v("Adding string decrypter. Resource: {0}", Utils.toCsharpString(stringDecrypter.Resource.Name));
|
||||||
staticStringInliner.add(stringDecrypter.DecryptMethod, (method, gim, args) => {
|
staticStringInliner.add(stringDecrypter.DecryptMethod, (method, gim, args) => {
|
||||||
return stringDecrypter.decrypt(args);
|
return stringDecrypter.decrypt(args);
|
||||||
});
|
});
|
||||||
|
|
|
@ -46,7 +46,7 @@ namespace de4dot.code.deobfuscators.Babel_NET {
|
||||||
|
|
||||||
static Inflater createNormal(bool noHeader, string errorMessage) {
|
static Inflater createNormal(bool noHeader, string errorMessage) {
|
||||||
if (errorMessage != null)
|
if (errorMessage != null)
|
||||||
Log.w("{0}", errorMessage);
|
Logger.w("{0}", errorMessage);
|
||||||
return new Inflater(noHeader);
|
return new Inflater(noHeader);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
@ -113,7 +113,7 @@ namespace de4dot.code.deobfuscators.Babel_NET {
|
||||||
ImageReader addImageReader(string name, byte[] data) {
|
ImageReader addImageReader(string name, byte[] data) {
|
||||||
var imageReader = new ImageReader(deobfuscatorContext, module, data);
|
var imageReader = new ImageReader(deobfuscatorContext, module, data);
|
||||||
if (!imageReader.initialize()) {
|
if (!imageReader.initialize()) {
|
||||||
Log.w("Could not read encrypted methods");
|
Logger.w("Could not read encrypted methods");
|
||||||
return null;
|
return null;
|
||||||
}
|
}
|
||||||
if (imageReaders.ContainsKey(name))
|
if (imageReaders.ContainsKey(name))
|
||||||
|
@ -159,11 +159,11 @@ namespace de4dot.code.deobfuscators.Babel_NET {
|
||||||
numNonDecryptedMethods++;
|
numNonDecryptedMethods++;
|
||||||
continue;
|
continue;
|
||||||
}
|
}
|
||||||
Log.v("Decrypting method {0:X8}", info.method.MDToken.ToInt32());
|
Logger.v("Decrypting method {0:X8}", info.method.MDToken.ToInt32());
|
||||||
imageReader.restore(info.FullName, info.method);
|
imageReader.restore(info.FullName, info.method);
|
||||||
}
|
}
|
||||||
if (numNonDecryptedMethods > 0)
|
if (numNonDecryptedMethods > 0)
|
||||||
Log.w("{0}/{1} methods not decrypted", numNonDecryptedMethods, totalEncryptedMethods);
|
Logger.w("{0}/{1} methods not decrypted", numNonDecryptedMethods, totalEncryptedMethods);
|
||||||
}
|
}
|
||||||
|
|
||||||
ImageReader getImageReader(string feature) {
|
ImageReader getImageReader(string feature) {
|
||||||
|
|
|
@ -131,7 +131,7 @@ namespace de4dot.code.deobfuscators.CodeVeil {
|
||||||
doc.Load(XmlReader.Create(bundleXmlFile.Data.CreateStream()));
|
doc.Load(XmlReader.Create(bundleXmlFile.Data.CreateStream()));
|
||||||
var manifest = doc.DocumentElement;
|
var manifest = doc.DocumentElement;
|
||||||
if (manifest.Name.ToLowerInvariant() != "manifest") {
|
if (manifest.Name.ToLowerInvariant() != "manifest") {
|
||||||
Log.w("Could not find Manifest element");
|
Logger.w("Could not find Manifest element");
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
foreach (var tmp in manifest.ChildNodes) {
|
foreach (var tmp in manifest.ChildNodes) {
|
||||||
|
@ -140,13 +140,13 @@ namespace de4dot.code.deobfuscators.CodeVeil {
|
||||||
continue;
|
continue;
|
||||||
|
|
||||||
if (assemblyElem.Name.ToLowerInvariant() != "assembly") {
|
if (assemblyElem.Name.ToLowerInvariant() != "assembly") {
|
||||||
Log.w("Unknown element: {0}", assemblyElem.Name);
|
Logger.w("Unknown element: {0}", assemblyElem.Name);
|
||||||
continue;
|
continue;
|
||||||
}
|
}
|
||||||
|
|
||||||
int offset = getAttributeValueInt32(assemblyElem, "offset");
|
int offset = getAttributeValueInt32(assemblyElem, "offset");
|
||||||
if (offset < 0) {
|
if (offset < 0) {
|
||||||
Log.w("Could not find offset attribute");
|
Logger.w("Could not find offset attribute");
|
||||||
continue;
|
continue;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
@ -323,7 +323,7 @@ namespace de4dot.code.deobfuscators.CodeVeil {
|
||||||
if (decrypted == null)
|
if (decrypted == null)
|
||||||
continue;
|
continue;
|
||||||
|
|
||||||
Log.v("Decrypted resource {0}", Utils.toCsharpString(resource.Name));
|
Logger.v("Decrypted resource {0}", Utils.toCsharpString(resource.Name));
|
||||||
module.Resources[i] = new EmbeddedResource(resource.Name, decrypted, resource.Flags);
|
module.Resources[i] = new EmbeddedResource(resource.Name, decrypted, resource.Flags);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
@ -343,7 +343,7 @@ namespace de4dot.code.deobfuscators.CodeVeil {
|
||||||
return null;
|
return null;
|
||||||
}
|
}
|
||||||
catch (Exception ex) {
|
catch (Exception ex) {
|
||||||
Log.w("Got an exception when decrypting resources: {0} - {1}", ex.GetType(), ex.Message);
|
Logger.w("Got an exception when decrypting resources: {0} - {1}", ex.GetType(), ex.Message);
|
||||||
return null;
|
return null;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
|
@ -248,7 +248,7 @@ namespace de4dot.code.deobfuscators.CodeWall {
|
||||||
simpleDeobfuscator.deobfuscate(info.Method);
|
simpleDeobfuscator.deobfuscate(info.Method);
|
||||||
info.Resource = findResource(info.Method);
|
info.Resource = findResource(info.Method);
|
||||||
if (info.Resource == null) {
|
if (info.Resource == null) {
|
||||||
Log.w("Could not find encrypted strings resource (Method {0:X8})", info.Method.MDToken.ToInt32());
|
Logger.w("Could not find encrypted strings resource (Method {0:X8})", info.Method.MDToken.ToInt32());
|
||||||
continue;
|
continue;
|
||||||
}
|
}
|
||||||
info.Magic1 = findMagic1(info.Method);
|
info.Magic1 = findMagic1(info.Method);
|
||||||
|
|
|
@ -122,8 +122,8 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
|
||||||
var decrypted = resourceDecrypter.decrypt(resource.GetResourceStream());
|
var decrypted = resourceDecrypter.decrypt(resource.GetResourceStream());
|
||||||
var reader = MemoryImageStream.Create(decrypted);
|
var reader = MemoryImageStream.Create(decrypted);
|
||||||
int numEncrypted = reader.ReadInt32();
|
int numEncrypted = reader.ReadInt32();
|
||||||
Log.v("Restoring {0} encrypted methods", numEncrypted);
|
Logger.v("Restoring {0} encrypted methods", numEncrypted);
|
||||||
Log.indent();
|
Logger.Instance.indent();
|
||||||
for (int i = 0; i < numEncrypted; i++) {
|
for (int i = 0; i < numEncrypted; i++) {
|
||||||
int delegateTypeToken = reader.ReadInt32();
|
int delegateTypeToken = reader.ReadInt32();
|
||||||
uint codeOffset = reader.ReadUInt32();
|
uint codeOffset = reader.ReadUInt32();
|
||||||
|
@ -132,7 +132,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
|
||||||
decrypt(reader, delegateTypeToken);
|
decrypt(reader, delegateTypeToken);
|
||||||
reader.Position = origOffset;
|
reader.Position = origOffset;
|
||||||
}
|
}
|
||||||
Log.deIndent();
|
Logger.Instance.deIndent();
|
||||||
}
|
}
|
||||||
|
|
||||||
void decrypt(IBinaryReader reader, int delegateTypeToken) {
|
void decrypt(IBinaryReader reader, int delegateTypeToken) {
|
||||||
|
@ -155,7 +155,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
|
||||||
var bodyReader = new MethodBodyReader(module, reader);
|
var bodyReader = new MethodBodyReader(module, reader);
|
||||||
bodyReader.read(encMethod);
|
bodyReader.read(encMethod);
|
||||||
bodyReader.RestoreMethod(encMethod);
|
bodyReader.RestoreMethod(encMethod);
|
||||||
Log.v("Restored method {0} ({1:X8}). Instrs:{2}, Locals:{3}, Exceptions:{4}",
|
Logger.v("Restored method {0} ({1:X8}). Instrs:{2}, Locals:{3}, Exceptions:{4}",
|
||||||
Utils.removeNewlines(encMethod.FullName),
|
Utils.removeNewlines(encMethod.FullName),
|
||||||
encMethod.MDToken.ToInt32(),
|
encMethod.MDToken.ToInt32(),
|
||||||
encMethod.Body.Instructions.Count,
|
encMethod.Body.Instructions.Count,
|
||||||
|
|
|
@ -328,7 +328,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
|
||||||
|
|
||||||
byte allFlags = (byte)(desEncryptedFlag | deflatedFlag | bitwiseNotEncryptedFlag);
|
byte allFlags = (byte)(desEncryptedFlag | deflatedFlag | bitwiseNotEncryptedFlag);
|
||||||
if ((flags & ~allFlags) != 0)
|
if ((flags & ~allFlags) != 0)
|
||||||
Log.w("Found unknown resource encryption flags: 0x{0:X2}", flags);
|
Logger.w("Found unknown resource encryption flags: 0x{0:X2}", flags);
|
||||||
|
|
||||||
if ((flags & desEncryptedFlag) != 0) {
|
if ((flags & desEncryptedFlag) != 0) {
|
||||||
var memStream = new MemoryStream((int)resourceStream.Length);
|
var memStream = new MemoryStream((int)resourceStream.Length);
|
||||||
|
|
|
@ -68,7 +68,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
|
||||||
stringResource = DotNetUtils.getResource(module, resourceName) as EmbeddedResource;
|
stringResource = DotNetUtils.getResource(module, resourceName) as EmbeddedResource;
|
||||||
if (stringResource == null)
|
if (stringResource == null)
|
||||||
return;
|
return;
|
||||||
Log.v("Adding string decrypter. Resource: {0}", Utils.toCsharpString(stringResource.Name));
|
Logger.v("Adding string decrypter. Resource: {0}", Utils.toCsharpString(stringResource.Name));
|
||||||
|
|
||||||
decryptedData = resourceDecrypter.decrypt(stringResource.GetResourceStream());
|
decryptedData = resourceDecrypter.decrypt(stringResource.GetResourceStream());
|
||||||
}
|
}
|
||||||
|
|
|
@ -308,7 +308,7 @@ namespace de4dot.code.deobfuscators.DeepSea {
|
||||||
data30 = new Data30();
|
data30 = new Data30();
|
||||||
data30.resource = DeobUtils.getEmbeddedResourceFromCodeStrings(module, resolveHandler);
|
data30.resource = DeobUtils.getEmbeddedResourceFromCodeStrings(module, resolveHandler);
|
||||||
if (data30.resource == null) {
|
if (data30.resource == null) {
|
||||||
Log.w("Could not find resource of encrypted resources");
|
Logger.w("Could not find resource of encrypted resources");
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
|
@ -30,18 +30,18 @@ using de4dot.blocks;
|
||||||
namespace de4dot.code.deobfuscators {
|
namespace de4dot.code.deobfuscators {
|
||||||
static class DeobUtils {
|
static class DeobUtils {
|
||||||
public static void decryptAndAddResources(ModuleDef module, string encryptedName, Func<byte[]> decryptResource) {
|
public static void decryptAndAddResources(ModuleDef module, string encryptedName, Func<byte[]> decryptResource) {
|
||||||
Log.v("Decrypting resources, name: {0}", Utils.toCsharpString(encryptedName));
|
Logger.v("Decrypting resources, name: {0}", Utils.toCsharpString(encryptedName));
|
||||||
var decryptedResourceData = decryptResource();
|
var decryptedResourceData = decryptResource();
|
||||||
if (decryptedResourceData == null)
|
if (decryptedResourceData == null)
|
||||||
throw new ApplicationException("decryptedResourceData is null");
|
throw new ApplicationException("decryptedResourceData is null");
|
||||||
var resourceModule = ModuleDefMD.Load(decryptedResourceData);
|
var resourceModule = ModuleDefMD.Load(decryptedResourceData);
|
||||||
|
|
||||||
Log.indent();
|
Logger.Instance.indent();
|
||||||
foreach (var rsrc in resourceModule.Resources) {
|
foreach (var rsrc in resourceModule.Resources) {
|
||||||
Log.v("Adding decrypted resource {0}", Utils.toCsharpString(rsrc.Name));
|
Logger.v("Adding decrypted resource {0}", Utils.toCsharpString(rsrc.Name));
|
||||||
module.Resources.Add(rsrc);
|
module.Resources.Add(rsrc);
|
||||||
}
|
}
|
||||||
Log.deIndent();
|
Logger.Instance.deIndent();
|
||||||
}
|
}
|
||||||
|
|
||||||
public static T lookup<T>(ModuleDefMD module, T def, string errorMessage) where T : class, ICodedToken {
|
public static T lookup<T>(ModuleDefMD module, T def, string errorMessage) where T : class, ICodedToken {
|
||||||
|
|
|
@ -189,7 +189,7 @@ namespace de4dot.code.deobfuscators {
|
||||||
foreach (var type in module.GetTypes()) {
|
foreach (var type in module.GetTypes()) {
|
||||||
if (!isTypeWithInvalidBaseType(moduleType, type))
|
if (!isTypeWithInvalidBaseType(moduleType, type))
|
||||||
continue;
|
continue;
|
||||||
Log.v("Adding System.Object as base type: {0} ({1:X8})",
|
Logger.v("Adding System.Object as base type: {0} ({1:X8})",
|
||||||
Utils.removeNewlines(type),
|
Utils.removeNewlines(type),
|
||||||
type.MDToken.ToInt32());
|
type.MDToken.ToInt32());
|
||||||
type.BaseType = module.CorLibTypes.Object.TypeDefOrRef;
|
type.BaseType = module.CorLibTypes.Object.TypeDefOrRef;
|
||||||
|
@ -298,7 +298,7 @@ namespace de4dot.code.deobfuscators {
|
||||||
continue;
|
continue;
|
||||||
|
|
||||||
if (info.find(destMethod)) {
|
if (info.find(destMethod)) {
|
||||||
Log.v("Removed call to {0}", Utils.removeNewlines(destMethod));
|
Logger.v("Removed call to {0}", Utils.removeNewlines(destMethod));
|
||||||
instrsToDelete.Add(i);
|
instrsToDelete.Add(i);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
@ -385,27 +385,27 @@ namespace de4dot.code.deobfuscators {
|
||||||
if (emptyCctorsToRemove.Count == 0)
|
if (emptyCctorsToRemove.Count == 0)
|
||||||
return;
|
return;
|
||||||
|
|
||||||
Log.v("Removing empty .cctor methods");
|
Logger.v("Removing empty .cctor methods");
|
||||||
Log.indent();
|
Logger.Instance.indent();
|
||||||
foreach (var cctor in emptyCctorsToRemove) {
|
foreach (var cctor in emptyCctorsToRemove) {
|
||||||
var type = cctor.DeclaringType;
|
var type = cctor.DeclaringType;
|
||||||
if (type == null)
|
if (type == null)
|
||||||
continue;
|
continue;
|
||||||
if (type.Methods.Remove(cctor))
|
if (type.Methods.Remove(cctor))
|
||||||
Log.v("{0:X8}, type: {1} ({2:X8})",
|
Logger.v("{0:X8}, type: {1} ({2:X8})",
|
||||||
cctor.MDToken.ToUInt32(),
|
cctor.MDToken.ToUInt32(),
|
||||||
Utils.removeNewlines(type),
|
Utils.removeNewlines(type),
|
||||||
type.MDToken.ToUInt32());
|
type.MDToken.ToUInt32());
|
||||||
}
|
}
|
||||||
Log.deIndent();
|
Logger.Instance.deIndent();
|
||||||
}
|
}
|
||||||
|
|
||||||
void deleteMethods() {
|
void deleteMethods() {
|
||||||
if (methodsToRemove.Count == 0)
|
if (methodsToRemove.Count == 0)
|
||||||
return;
|
return;
|
||||||
|
|
||||||
Log.v("Removing methods");
|
Logger.v("Removing methods");
|
||||||
Log.indent();
|
Logger.Instance.indent();
|
||||||
foreach (var info in methodsToRemove) {
|
foreach (var info in methodsToRemove) {
|
||||||
var method = info.obj;
|
var method = info.obj;
|
||||||
if (method == null)
|
if (method == null)
|
||||||
|
@ -414,21 +414,21 @@ namespace de4dot.code.deobfuscators {
|
||||||
if (type == null)
|
if (type == null)
|
||||||
continue;
|
continue;
|
||||||
if (type.Methods.Remove(method))
|
if (type.Methods.Remove(method))
|
||||||
Log.v("Removed method {0} ({1:X8}) (Type: {2}) (reason: {3})",
|
Logger.v("Removed method {0} ({1:X8}) (Type: {2}) (reason: {3})",
|
||||||
Utils.removeNewlines(method),
|
Utils.removeNewlines(method),
|
||||||
method.MDToken.ToUInt32(),
|
method.MDToken.ToUInt32(),
|
||||||
Utils.removeNewlines(type),
|
Utils.removeNewlines(type),
|
||||||
info.reason);
|
info.reason);
|
||||||
}
|
}
|
||||||
Log.deIndent();
|
Logger.Instance.deIndent();
|
||||||
}
|
}
|
||||||
|
|
||||||
void deleteFields() {
|
void deleteFields() {
|
||||||
if (fieldsToRemove.Count == 0)
|
if (fieldsToRemove.Count == 0)
|
||||||
return;
|
return;
|
||||||
|
|
||||||
Log.v("Removing fields");
|
Logger.v("Removing fields");
|
||||||
Log.indent();
|
Logger.Instance.indent();
|
||||||
foreach (var info in fieldsToRemove) {
|
foreach (var info in fieldsToRemove) {
|
||||||
var field = info.obj;
|
var field = info.obj;
|
||||||
if (field == null)
|
if (field == null)
|
||||||
|
@ -437,13 +437,13 @@ namespace de4dot.code.deobfuscators {
|
||||||
if (type == null)
|
if (type == null)
|
||||||
continue;
|
continue;
|
||||||
if (type.Fields.Remove(field))
|
if (type.Fields.Remove(field))
|
||||||
Log.v("Removed field {0} ({1:X8}) (Type: {2}) (reason: {3})",
|
Logger.v("Removed field {0} ({1:X8}) (Type: {2}) (reason: {3})",
|
||||||
Utils.removeNewlines(field),
|
Utils.removeNewlines(field),
|
||||||
field.MDToken.ToUInt32(),
|
field.MDToken.ToUInt32(),
|
||||||
Utils.removeNewlines(type),
|
Utils.removeNewlines(type),
|
||||||
info.reason);
|
info.reason);
|
||||||
}
|
}
|
||||||
Log.deIndent();
|
Logger.Instance.deIndent();
|
||||||
}
|
}
|
||||||
|
|
||||||
void deleteTypes() {
|
void deleteTypes() {
|
||||||
|
@ -451,8 +451,8 @@ namespace de4dot.code.deobfuscators {
|
||||||
if (types == null || typesToRemove.Count == 0)
|
if (types == null || typesToRemove.Count == 0)
|
||||||
return;
|
return;
|
||||||
|
|
||||||
Log.v("Removing types");
|
Logger.v("Removing types");
|
||||||
Log.indent();
|
Logger.Instance.indent();
|
||||||
var moduleType = DotNetUtils.getModuleType(module);
|
var moduleType = DotNetUtils.getModuleType(module);
|
||||||
foreach (var info in typesToRemove) {
|
foreach (var info in typesToRemove) {
|
||||||
var typeDef = info.obj;
|
var typeDef = info.obj;
|
||||||
|
@ -464,24 +464,24 @@ namespace de4dot.code.deobfuscators {
|
||||||
else
|
else
|
||||||
removed = types.Remove(typeDef);
|
removed = types.Remove(typeDef);
|
||||||
if (removed)
|
if (removed)
|
||||||
Log.v("Removed type {0} ({1:X8}) (reason: {2})",
|
Logger.v("Removed type {0} ({1:X8}) (reason: {2})",
|
||||||
Utils.removeNewlines(typeDef),
|
Utils.removeNewlines(typeDef),
|
||||||
typeDef.MDToken.ToUInt32(),
|
typeDef.MDToken.ToUInt32(),
|
||||||
info.reason);
|
info.reason);
|
||||||
}
|
}
|
||||||
Log.deIndent();
|
Logger.Instance.deIndent();
|
||||||
}
|
}
|
||||||
|
|
||||||
void deleteCustomAttributes() {
|
void deleteCustomAttributes() {
|
||||||
if (attrsToRemove.Count == 0)
|
if (attrsToRemove.Count == 0)
|
||||||
return;
|
return;
|
||||||
|
|
||||||
Log.v("Removing custom attributes");
|
Logger.v("Removing custom attributes");
|
||||||
Log.indent();
|
Logger.Instance.indent();
|
||||||
deleteCustomAttributes(module.CustomAttributes);
|
deleteCustomAttributes(module.CustomAttributes);
|
||||||
if (module.Assembly != null)
|
if (module.Assembly != null)
|
||||||
deleteCustomAttributes(module.Assembly.CustomAttributes);
|
deleteCustomAttributes(module.Assembly.CustomAttributes);
|
||||||
Log.deIndent();
|
Logger.Instance.deIndent();
|
||||||
}
|
}
|
||||||
|
|
||||||
void deleteCustomAttributes(IList<CustomAttribute> customAttrs) {
|
void deleteCustomAttributes(IList<CustomAttribute> customAttrs) {
|
||||||
|
@ -495,7 +495,7 @@ namespace de4dot.code.deobfuscators {
|
||||||
if (new SigComparer().Equals(typeDef, customAttrs[i].AttributeType)) {
|
if (new SigComparer().Equals(typeDef, customAttrs[i].AttributeType)) {
|
||||||
customAttrs.RemoveAt(i);
|
customAttrs.RemoveAt(i);
|
||||||
i--;
|
i--;
|
||||||
Log.v("Removed custom attribute {0} ({1:X8}) (reason: {2})",
|
Logger.v("Removed custom attribute {0} ({1:X8}) (reason: {2})",
|
||||||
Utils.removeNewlines(typeDef),
|
Utils.removeNewlines(typeDef),
|
||||||
typeDef.MDToken.ToUInt32(),
|
typeDef.MDToken.ToUInt32(),
|
||||||
info.reason);
|
info.reason);
|
||||||
|
@ -506,19 +506,19 @@ namespace de4dot.code.deobfuscators {
|
||||||
}
|
}
|
||||||
|
|
||||||
void deleteOtherAttributes() {
|
void deleteOtherAttributes() {
|
||||||
Log.v("Removing other attributes");
|
Logger.v("Removing other attributes");
|
||||||
Log.indent();
|
Logger.Instance.indent();
|
||||||
deleteOtherAttributes(module.CustomAttributes);
|
deleteOtherAttributes(module.CustomAttributes);
|
||||||
if (module.Assembly != null)
|
if (module.Assembly != null)
|
||||||
deleteOtherAttributes(module.Assembly.CustomAttributes);
|
deleteOtherAttributes(module.Assembly.CustomAttributes);
|
||||||
Log.deIndent();
|
Logger.Instance.deIndent();
|
||||||
}
|
}
|
||||||
|
|
||||||
void deleteOtherAttributes(IList<CustomAttribute> customAttributes) {
|
void deleteOtherAttributes(IList<CustomAttribute> customAttributes) {
|
||||||
for (int i = customAttributes.Count - 1; i >= 0; i--) {
|
for (int i = customAttributes.Count - 1; i >= 0; i--) {
|
||||||
var attr = customAttributes[i].TypeFullName;
|
var attr = customAttributes[i].TypeFullName;
|
||||||
if (attr == "System.Runtime.CompilerServices.SuppressIldasmAttribute") {
|
if (attr == "System.Runtime.CompilerServices.SuppressIldasmAttribute") {
|
||||||
Log.v("Removed attribute {0}", Utils.removeNewlines(attr));
|
Logger.v("Removed attribute {0}", Utils.removeNewlines(attr));
|
||||||
customAttributes.RemoveAt(i);
|
customAttributes.RemoveAt(i);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
@ -528,16 +528,16 @@ namespace de4dot.code.deobfuscators {
|
||||||
if (!module.HasResources || resourcesToRemove.Count == 0)
|
if (!module.HasResources || resourcesToRemove.Count == 0)
|
||||||
return;
|
return;
|
||||||
|
|
||||||
Log.v("Removing resources");
|
Logger.v("Removing resources");
|
||||||
Log.indent();
|
Logger.Instance.indent();
|
||||||
foreach (var info in resourcesToRemove) {
|
foreach (var info in resourcesToRemove) {
|
||||||
var resource = info.obj;
|
var resource = info.obj;
|
||||||
if (resource == null)
|
if (resource == null)
|
||||||
continue;
|
continue;
|
||||||
if (module.Resources.Remove(resource))
|
if (module.Resources.Remove(resource))
|
||||||
Log.v("Removed resource {0} (reason: {1})", Utils.toCsharpString(resource.Name), info.reason);
|
Logger.v("Removed resource {0} (reason: {1})", Utils.toCsharpString(resource.Name), info.reason);
|
||||||
}
|
}
|
||||||
Log.deIndent();
|
Logger.Instance.deIndent();
|
||||||
}
|
}
|
||||||
|
|
||||||
protected void setInitLocals() {
|
protected void setInitLocals() {
|
||||||
|
@ -608,7 +608,7 @@ namespace de4dot.code.deobfuscators {
|
||||||
|
|
||||||
protected bool removeProxyDelegates(ProxyCallFixerBase proxyCallFixer, bool removeCreators) {
|
protected bool removeProxyDelegates(ProxyCallFixerBase proxyCallFixer, bool removeCreators) {
|
||||||
if (proxyCallFixer.Errors != 0) {
|
if (proxyCallFixer.Errors != 0) {
|
||||||
Log.v("Not removing proxy delegates and creator type since errors were detected.");
|
Logger.v("Not removing proxy delegates and creator type since errors were detected.");
|
||||||
return false;
|
return false;
|
||||||
}
|
}
|
||||||
addTypesToBeRemoved(proxyCallFixer.DelegateTypes, "Proxy delegate type");
|
addTypesToBeRemoved(proxyCallFixer.DelegateTypes, "Proxy delegate type");
|
||||||
|
|
|
@ -85,7 +85,7 @@ namespace de4dot.code.deobfuscators.Dotfuscator {
|
||||||
|
|
||||||
var info = new StringDecrypterInfo(method, ldci4.GetLdcI4Value());
|
var info = new StringDecrypterInfo(method, ldci4.GetLdcI4Value());
|
||||||
stringDecrypterMethods.add(info.method, info);
|
stringDecrypterMethods.add(info.method, info);
|
||||||
Log.v("Found string decrypter method: {0}, magic: 0x{1:X8}", Utils.removeNewlines(info.method), info.magic);
|
Logger.v("Found string decrypter method: {0}, magic: 0x{1:X8}", Utils.removeNewlines(info.method), info.magic);
|
||||||
break;
|
break;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
|
@ -364,7 +364,7 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
|
||||||
}
|
}
|
||||||
catch {
|
catch {
|
||||||
}
|
}
|
||||||
Log.w("Could not load assembly from decrypted resource {0}", Utils.toCsharpString(info.ResourceName));
|
Logger.w("Could not load assembly from decrypted resource {0}", Utils.toCsharpString(info.ResourceName));
|
||||||
int index = info.Filename.LastIndexOf('.');
|
int index = info.Filename.LastIndexOf('.');
|
||||||
if (index < 0) {
|
if (index < 0) {
|
||||||
info.SimpleName = info.Filename;
|
info.SimpleName = info.Filename;
|
||||||
|
|
|
@ -210,9 +210,9 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
|
||||||
|
|
||||||
if (!findConstants(simpleDeobfuscator)) {
|
if (!findConstants(simpleDeobfuscator)) {
|
||||||
if (encryptedResource == null)
|
if (encryptedResource == null)
|
||||||
Log.w("Could not find encrypted resource. Strings cannot be decrypted.");
|
Logger.w("Could not find encrypted resource. Strings cannot be decrypted.");
|
||||||
else
|
else
|
||||||
Log.w("Can't decrypt strings. Possibly a new Eazfuscator.NET version.");
|
Logger.w("Can't decrypt strings. Possibly a new Eazfuscator.NET version.");
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
|
@ -40,7 +40,7 @@ namespace de4dot.code.deobfuscators.Goliath_NET {
|
||||||
|
|
||||||
var arrayData = (byte[])callResult.returnValue;
|
var arrayData = (byte[])callResult.returnValue;
|
||||||
initializedDataCreator.addInitializeArrayCode(block, callResult.callStartIndex, num, module.TypeSystem.Byte, arrayData);
|
initializedDataCreator.addInitializeArrayCode(block, callResult.callStartIndex, num, module.TypeSystem.Byte, arrayData);
|
||||||
Log.v("Decrypted array: {0} bytes", arrayData.Length);
|
Logger.v("Decrypted array: {0} bytes", arrayData.Length);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
|
@ -232,7 +232,7 @@ namespace de4dot.code.deobfuscators.Goliath_NET {
|
||||||
localsRestorer.deobfuscate(blocks);
|
localsRestorer.deobfuscate(blocks);
|
||||||
if (options.RemoveAntiStrongName) {
|
if (options.RemoveAntiStrongName) {
|
||||||
if (strongNameChecker.deobfuscate(blocks))
|
if (strongNameChecker.deobfuscate(blocks))
|
||||||
Log.v("Removed strong name checker code");
|
Logger.v("Removed strong name checker code");
|
||||||
}
|
}
|
||||||
logicalExpressionFixer.deobfuscate(blocks);
|
logicalExpressionFixer.deobfuscate(blocks);
|
||||||
base.deobfuscateMethodEnd(blocks);
|
base.deobfuscateMethodEnd(blocks);
|
||||||
|
|
|
@ -39,7 +39,7 @@ namespace de4dot.code.deobfuscators.Goliath_NET {
|
||||||
}
|
}
|
||||||
|
|
||||||
public new void find() {
|
public new void find() {
|
||||||
Log.v("Finding all proxy delegates");
|
Logger.v("Finding all proxy delegates");
|
||||||
var infos = new List<MyInfo>();
|
var infos = new List<MyInfo>();
|
||||||
foreach (var type in module.GetTypes()) {
|
foreach (var type in module.GetTypes()) {
|
||||||
if (type.BaseType == null || type.BaseType.FullName != "System.MulticastDelegate")
|
if (type.BaseType == null || type.BaseType.FullName != "System.MulticastDelegate")
|
||||||
|
@ -56,19 +56,19 @@ namespace de4dot.code.deobfuscators.Goliath_NET {
|
||||||
if (infos.Count == 0)
|
if (infos.Count == 0)
|
||||||
continue;
|
continue;
|
||||||
|
|
||||||
Log.v("Found proxy delegate: {0} ({1:X8})", Utils.removeNewlines(type), type.MDToken.ToUInt32());
|
Logger.v("Found proxy delegate: {0} ({1:X8})", Utils.removeNewlines(type), type.MDToken.ToUInt32());
|
||||||
RemovedDelegateCreatorCalls++;
|
RemovedDelegateCreatorCalls++;
|
||||||
Log.indent();
|
Logger.Instance.indent();
|
||||||
foreach (var info in infos) {
|
foreach (var info in infos) {
|
||||||
var di = info.delegateInfo;
|
var di = info.delegateInfo;
|
||||||
add(info.method, di);
|
add(info.method, di);
|
||||||
Log.v("Field: {0}, Opcode: {1}, Method: {2} ({3:X8})",
|
Logger.v("Field: {0}, Opcode: {1}, Method: {2} ({3:X8})",
|
||||||
Utils.removeNewlines(di.field.Name),
|
Utils.removeNewlines(di.field.Name),
|
||||||
di.callOpcode,
|
di.callOpcode,
|
||||||
Utils.removeNewlines(di.methodRef),
|
Utils.removeNewlines(di.methodRef),
|
||||||
di.methodRef.MDToken.ToUInt32());
|
di.methodRef.MDToken.ToUInt32());
|
||||||
}
|
}
|
||||||
Log.deIndent();
|
Logger.Instance.deIndent();
|
||||||
delegateTypesDict[type] = true;
|
delegateTypesDict[type] = true;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
|
@ -200,15 +200,15 @@ namespace de4dot.code.deobfuscators.ILProtector {
|
||||||
if (methodInfos.Count == 0)
|
if (methodInfos.Count == 0)
|
||||||
return;
|
return;
|
||||||
|
|
||||||
Log.v("Restoring {0} methods", methodInfos.Count);
|
Logger.v("Restoring {0} methods", methodInfos.Count);
|
||||||
Log.indent();
|
Logger.Instance.indent();
|
||||||
foreach (var type in module.GetTypes()) {
|
foreach (var type in module.GetTypes()) {
|
||||||
foreach (var method in type.Methods) {
|
foreach (var method in type.Methods) {
|
||||||
if (method.Body == null)
|
if (method.Body == null)
|
||||||
continue;
|
continue;
|
||||||
|
|
||||||
if (restoreMethod(method)) {
|
if (restoreMethod(method)) {
|
||||||
Log.v("Restored method {0} ({1:X8}). Instrs:{2}, Locals:{3}, Exceptions:{4}",
|
Logger.v("Restored method {0} ({1:X8}). Instrs:{2}, Locals:{3}, Exceptions:{4}",
|
||||||
Utils.removeNewlines(method.FullName),
|
Utils.removeNewlines(method.FullName),
|
||||||
method.MDToken.ToInt32(),
|
method.MDToken.ToInt32(),
|
||||||
method.Body.Instructions.Count,
|
method.Body.Instructions.Count,
|
||||||
|
@ -217,9 +217,9 @@ namespace de4dot.code.deobfuscators.ILProtector {
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
Log.deIndent();
|
Logger.Instance.deIndent();
|
||||||
if (methodInfos.Count != 0)
|
if (methodInfos.Count != 0)
|
||||||
Log.w("{0} methods weren't restored", methodInfos.Count);
|
Logger.w("{0} methods weren't restored", methodInfos.Count);
|
||||||
}
|
}
|
||||||
|
|
||||||
const int INVALID_METHOD_ID = -1;
|
const int INVALID_METHOD_ID = -1;
|
||||||
|
|
|
@ -251,7 +251,7 @@ namespace de4dot.code.deobfuscators.MPRESS {
|
||||||
BitConverter.ToInt16(hash, 6),
|
BitConverter.ToInt16(hash, 6),
|
||||||
hash[8], hash[9], hash[10], hash[11],
|
hash[8], hash[9], hash[10], hash[11],
|
||||||
hash[12], hash[13], hash[14], hash[15]);
|
hash[12], hash[13], hash[14], hash[15]);
|
||||||
Log.v("Updating MVID: {0}", guid.ToString("B"));
|
Logger.v("Updating MVID: {0}", guid.ToString("B"));
|
||||||
module.Mvid = guid;
|
module.Mvid = guid;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
|
@ -146,7 +146,7 @@ namespace de4dot.code.deobfuscators.MaxtoCode {
|
||||||
return Encoding.GetEncoding(cp);
|
return Encoding.GetEncoding(cp);
|
||||||
}
|
}
|
||||||
catch {
|
catch {
|
||||||
Log.w("Invalid code page {0}!", cp);
|
Logger.w("Invalid code page {0}!", cp);
|
||||||
return Encoding.Default;
|
return Encoding.Default;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
|
@ -106,7 +106,7 @@ namespace de4dot.code.deobfuscators.MaxtoCode {
|
||||||
return info.Version;
|
return info.Version;
|
||||||
}
|
}
|
||||||
|
|
||||||
Log.w("Could not detect MC version. Magic2: {0:X8} {1:X8}", m2lo, m2hi);
|
Logger.w("Could not detect MC version. Magic2: {0:X8} {1:X8}", m2lo, m2hi);
|
||||||
return EncryptionVersion.Unknown;
|
return EncryptionVersion.Unknown;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -531,10 +531,10 @@ namespace de4dot.code.deobfuscators.MaxtoCode {
|
||||||
return;
|
return;
|
||||||
if (resourceRva != peImage.Cor20Header.resources.virtualAddress ||
|
if (resourceRva != peImage.Cor20Header.resources.virtualAddress ||
|
||||||
resourceSize != peImage.Cor20Header.resources.size) {
|
resourceSize != peImage.Cor20Header.resources.size) {
|
||||||
Log.w("Invalid resource RVA and size found");
|
Logger.w("Invalid resource RVA and size found");
|
||||||
}
|
}
|
||||||
|
|
||||||
Log.v("Decrypting resources @ RVA {0:X8}, {1} bytes", resourceRva, resourceSize);
|
Logger.v("Decrypting resources @ RVA {0:X8}, {1} bytes", resourceRva, resourceSize);
|
||||||
|
|
||||||
int resourceOffset = (int)peImage.rvaToOffset(resourceRva);
|
int resourceOffset = (int)peImage.rvaToOffset(resourceRva);
|
||||||
for (int i = 0; i < resourceSize; i++)
|
for (int i = 0; i < resourceSize; i++)
|
||||||
|
@ -555,11 +555,11 @@ namespace de4dot.code.deobfuscators.MaxtoCode {
|
||||||
if (usHeap == null ||
|
if (usHeap == null ||
|
||||||
peImage.rvaToOffset(usHeapRva) != usHeap.fileOffset ||
|
peImage.rvaToOffset(usHeapRva) != usHeap.fileOffset ||
|
||||||
usHeapSize != usHeap.Length) {
|
usHeapSize != usHeap.Length) {
|
||||||
Log.w("Invalid #US heap RVA and size found");
|
Logger.w("Invalid #US heap RVA and size found");
|
||||||
}
|
}
|
||||||
|
|
||||||
Log.v("Decrypting strings @ RVA {0:X8}, {1} bytes", usHeapRva, usHeapSize);
|
Logger.v("Decrypting strings @ RVA {0:X8}, {1} bytes", usHeapRva, usHeapSize);
|
||||||
Log.indent();
|
Logger.Instance.indent();
|
||||||
|
|
||||||
int mcKeyOffset = 0;
|
int mcKeyOffset = 0;
|
||||||
int usHeapOffset = (int)peImage.rvaToOffset(usHeapRva);
|
int usHeapOffset = (int)peImage.rvaToOffset(usHeapRva);
|
||||||
|
@ -582,16 +582,16 @@ namespace de4dot.code.deobfuscators.MaxtoCode {
|
||||||
}
|
}
|
||||||
|
|
||||||
try {
|
try {
|
||||||
Log.v("Decrypted string: {0}", Utils.toCsharpString(Encoding.Unicode.GetString(fileData, usHeapOffsetString, stringDataLength - 1)));
|
Logger.v("Decrypted string: {0}", Utils.toCsharpString(Encoding.Unicode.GetString(fileData, usHeapOffsetString, stringDataLength - 1)));
|
||||||
}
|
}
|
||||||
catch {
|
catch {
|
||||||
Log.v("Could not decrypt string at offset {0:X8}", usHeapOffsetOrig);
|
Logger.v("Could not decrypt string at offset {0:X8}", usHeapOffsetOrig);
|
||||||
}
|
}
|
||||||
|
|
||||||
usHeapOffset++;
|
usHeapOffset++;
|
||||||
}
|
}
|
||||||
|
|
||||||
Log.deIndent();
|
Logger.Instance.deIndent();
|
||||||
}
|
}
|
||||||
|
|
||||||
byte rolb(byte b, int n) {
|
byte rolb(byte b, int n) {
|
||||||
|
|
|
@ -206,7 +206,7 @@ namespace de4dot.code.deobfuscators {
|
||||||
if (delegateCreatorMethods.Count == 0)
|
if (delegateCreatorMethods.Count == 0)
|
||||||
return;
|
return;
|
||||||
|
|
||||||
Log.v("Finding all proxy delegates");
|
Logger.v("Finding all proxy delegates");
|
||||||
foreach (var tmp in getDelegateTypes()) {
|
foreach (var tmp in getDelegateTypes()) {
|
||||||
var type = tmp;
|
var type = tmp;
|
||||||
var cctor = type.FindClassConstructor();
|
var cctor = type.FindClassConstructor();
|
||||||
|
@ -219,10 +219,10 @@ namespace de4dot.code.deobfuscators {
|
||||||
if (context == null)
|
if (context == null)
|
||||||
continue;
|
continue;
|
||||||
|
|
||||||
Log.v("Found proxy delegate: {0} ({1:X8})", Utils.removeNewlines(type), type.MDToken.ToUInt32());
|
Logger.v("Found proxy delegate: {0} ({1:X8})", Utils.removeNewlines(type), type.MDToken.ToUInt32());
|
||||||
RemovedDelegateCreatorCalls++;
|
RemovedDelegateCreatorCalls++;
|
||||||
|
|
||||||
Log.indent();
|
Logger.Instance.indent();
|
||||||
foreach (var field in type.Fields) {
|
foreach (var field in type.Fields) {
|
||||||
if (!field.IsStatic)
|
if (!field.IsStatic)
|
||||||
continue;
|
continue;
|
||||||
|
@ -234,13 +234,13 @@ namespace de4dot.code.deobfuscators {
|
||||||
if (calledMethod == null)
|
if (calledMethod == null)
|
||||||
continue;
|
continue;
|
||||||
addDelegateInfo(new DelegateInfo(field, calledMethod, callOpcode));
|
addDelegateInfo(new DelegateInfo(field, calledMethod, callOpcode));
|
||||||
Log.v("Field: {0}, Opcode: {1}, Method: {2} ({3:X8})",
|
Logger.v("Field: {0}, Opcode: {1}, Method: {2} ({3:X8})",
|
||||||
Utils.removeNewlines(field.Name),
|
Utils.removeNewlines(field.Name),
|
||||||
callOpcode,
|
callOpcode,
|
||||||
Utils.removeNewlines(calledMethod),
|
Utils.removeNewlines(calledMethod),
|
||||||
calledMethod.MDToken.Raw);
|
calledMethod.MDToken.Raw);
|
||||||
}
|
}
|
||||||
Log.deIndent();
|
Logger.Instance.deIndent();
|
||||||
delegateTypesDict[type] = true;
|
delegateTypesDict[type] = true;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
@ -269,7 +269,7 @@ namespace de4dot.code.deobfuscators {
|
||||||
}
|
}
|
||||||
else {
|
else {
|
||||||
errors++;
|
errors++;
|
||||||
Log.w("Could not fix proxy call. Method: {0} ({1:X8}), Proxy type: {2} ({3:X8})",
|
Logger.w("Could not fix proxy call. Method: {0} ({1:X8}), Proxy type: {2} ({3:X8})",
|
||||||
Utils.removeNewlines(blocks.Method),
|
Utils.removeNewlines(blocks.Method),
|
||||||
blocks.Method.MDToken.ToInt32(),
|
blocks.Method.MDToken.ToInt32(),
|
||||||
Utils.removeNewlines(di.field.DeclaringType),
|
Utils.removeNewlines(di.field.DeclaringType),
|
||||||
|
@ -354,7 +354,7 @@ namespace de4dot.code.deobfuscators {
|
||||||
|
|
||||||
// Oooops!!! The obfuscator is buggy. Well, let's hope it is, or it's my code. ;)
|
// Oooops!!! The obfuscator is buggy. Well, let's hope it is, or it's my code. ;)
|
||||||
|
|
||||||
Log.w("Holy obfuscator bugs, Batman! Found a proxy delegate call with no instance push in {0:X8}. Replacing it with a throw...", obfuscatedMethod.MDToken.ToInt32());
|
Logger.w("Holy obfuscator bugs, Batman! Found a proxy delegate call with no instance push in {0:X8}. Replacing it with a throw...", obfuscatedMethod.MDToken.ToInt32());
|
||||||
block.insert(i, Instruction.Create(OpCodes.Ldnull));
|
block.insert(i, Instruction.Create(OpCodes.Ldnull));
|
||||||
block.replace(i + 1, 1, Instruction.Create(OpCodes.Throw));
|
block.replace(i + 1, 1, Instruction.Create(OpCodes.Throw));
|
||||||
i++;
|
i++;
|
||||||
|
@ -387,7 +387,7 @@ namespace de4dot.code.deobfuscators {
|
||||||
if (delegateCreatorMethods.Count == 0)
|
if (delegateCreatorMethods.Count == 0)
|
||||||
return;
|
return;
|
||||||
|
|
||||||
Log.v("Finding all proxy delegates");
|
Logger.v("Finding all proxy delegates");
|
||||||
find2();
|
find2();
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -403,11 +403,11 @@ namespace de4dot.code.deobfuscators {
|
||||||
if (context == null)
|
if (context == null)
|
||||||
continue;
|
continue;
|
||||||
|
|
||||||
Log.v("Found proxy delegate: {0} ({1:X8})", Utils.removeNewlines(type), type.MDToken.ToUInt32());
|
Logger.v("Found proxy delegate: {0} ({1:X8})", Utils.removeNewlines(type), type.MDToken.ToUInt32());
|
||||||
RemovedDelegateCreatorCalls++;
|
RemovedDelegateCreatorCalls++;
|
||||||
var fieldToMethod = getFieldToMethodDictionary(type);
|
var fieldToMethod = getFieldToMethodDictionary(type);
|
||||||
|
|
||||||
Log.indent();
|
Logger.Instance.indent();
|
||||||
foreach (var field in type.Fields) {
|
foreach (var field in type.Fields) {
|
||||||
MethodDef proxyMethod;
|
MethodDef proxyMethod;
|
||||||
if (!fieldToMethod.TryGetValue(field, out proxyMethod))
|
if (!fieldToMethod.TryGetValue(field, out proxyMethod))
|
||||||
|
@ -420,13 +420,13 @@ namespace de4dot.code.deobfuscators {
|
||||||
if (calledMethod == null)
|
if (calledMethod == null)
|
||||||
continue;
|
continue;
|
||||||
add(proxyMethod, new DelegateInfo(field, calledMethod, callOpcode));
|
add(proxyMethod, new DelegateInfo(field, calledMethod, callOpcode));
|
||||||
Log.v("Field: {0}, Opcode: {1}, Method: {2} ({3:X8})",
|
Logger.v("Field: {0}, Opcode: {1}, Method: {2} ({3:X8})",
|
||||||
Utils.removeNewlines(field.Name),
|
Utils.removeNewlines(field.Name),
|
||||||
callOpcode,
|
callOpcode,
|
||||||
Utils.removeNewlines(calledMethod),
|
Utils.removeNewlines(calledMethod),
|
||||||
calledMethod.MDToken.ToUInt32());
|
calledMethod.MDToken.ToUInt32());
|
||||||
}
|
}
|
||||||
Log.deIndent();
|
Logger.Instance.deIndent();
|
||||||
delegateTypesDict[type] = true;
|
delegateTypesDict[type] = true;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
|
@ -219,7 +219,7 @@ namespace de4dot.code.deobfuscators.Rummage {
|
||||||
var decrypted = decrypt(info);
|
var decrypted = decrypt(info);
|
||||||
|
|
||||||
instrs[i] = new Instr(Instruction.Create(OpCodes.Ldstr, decrypted));
|
instrs[i] = new Instr(Instruction.Create(OpCodes.Ldstr, decrypted));
|
||||||
Log.v("Decrypted string: {0}", Utils.toCsharpString(decrypted));
|
Logger.v("Decrypted string: {0}", Utils.toCsharpString(decrypted));
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
|
@ -306,7 +306,7 @@ namespace de4dot.code.deobfuscators.Skater_NET {
|
||||||
continue;
|
continue;
|
||||||
|
|
||||||
instrs[i] = new Instr(Instruction.Create(OpCodes.Ldstr, decrypted));
|
instrs[i] = new Instr(Instruction.Create(OpCodes.Ldstr, decrypted));
|
||||||
Log.v("Decrypted string: {0}", Utils.toCsharpString(decrypted));
|
Logger.v("Decrypted string: {0}", Utils.toCsharpString(decrypted));
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
|
@ -45,7 +45,7 @@ namespace de4dot.code.deobfuscators.SmartAssembly {
|
||||||
var returned = new Dictionary<Resource, bool>();
|
var returned = new Dictionary<Resource, bool>();
|
||||||
foreach (var info in assemblyResolverInfo.EmbeddedAssemblyInfos) {
|
foreach (var info in assemblyResolverInfo.EmbeddedAssemblyInfos) {
|
||||||
if (info.resource == null) {
|
if (info.resource == null) {
|
||||||
Log.w("Could not find embedded resource {0}", Utils.toCsharpString(info.resourceName));
|
Logger.w("Could not find embedded resource {0}", Utils.toCsharpString(info.resourceName));
|
||||||
continue;
|
continue;
|
||||||
}
|
}
|
||||||
if (returned.ContainsKey(info.resource))
|
if (returned.ContainsKey(info.resource))
|
||||||
|
|
|
@ -145,11 +145,11 @@ namespace de4dot.code.deobfuscators.SmartAssembly {
|
||||||
list.Add(info);
|
list.Add(info);
|
||||||
}
|
}
|
||||||
|
|
||||||
Log.v("Found embedded assemblies:");
|
Logger.v("Found embedded assemblies:");
|
||||||
Log.indent();
|
Logger.Instance.indent();
|
||||||
foreach (var info in list)
|
foreach (var info in list)
|
||||||
Log.v("{0}", info.assemblyName);
|
Logger.v("{0}", info.assemblyName);
|
||||||
Log.deIndent();
|
Logger.Instance.deIndent();
|
||||||
|
|
||||||
return true;
|
return true;
|
||||||
}
|
}
|
||||||
|
|
|
@ -409,12 +409,12 @@ namespace de4dot.code.deobfuscators.SmartAssembly {
|
||||||
foreach (var info in stringDecrypterInfos) {
|
foreach (var info in stringDecrypterInfos) {
|
||||||
if (initd.ContainsKey(info))
|
if (initd.ContainsKey(info))
|
||||||
continue;
|
continue;
|
||||||
Log.v("String decrypter not initialized. Token {0:X8}", info.StringsEncodingClass.MDToken.ToInt32());
|
Logger.v("String decrypter not initialized. Token {0:X8}", info.StringsEncodingClass.MDToken.ToInt32());
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
void initStringDecrypter(StringDecrypterInfo info) {
|
void initStringDecrypter(StringDecrypterInfo info) {
|
||||||
Log.v("Adding string decrypter. Resource: {0}", Utils.toCsharpString(info.StringsResource.Name));
|
Logger.v("Adding string decrypter. Resource: {0}", Utils.toCsharpString(info.StringsResource.Name));
|
||||||
var decrypter = new StringDecrypter(info);
|
var decrypter = new StringDecrypter(info);
|
||||||
if (decrypter.CanDecrypt) {
|
if (decrypter.CanDecrypt) {
|
||||||
staticStringInliner.add(DotNetUtils.getMethod(info.GetStringDelegate, "Invoke"), (method, gim, args) => {
|
staticStringInliner.add(DotNetUtils.getMethod(info.GetStringDelegate, "Invoke"), (method, gim, args) => {
|
||||||
|
@ -489,14 +489,14 @@ namespace de4dot.code.deobfuscators.SmartAssembly {
|
||||||
if (!options.RemoveAutomatedErrorReporting)
|
if (!options.RemoveAutomatedErrorReporting)
|
||||||
return;
|
return;
|
||||||
if (automatedErrorReportingFinder.remove(blocks))
|
if (automatedErrorReportingFinder.remove(blocks))
|
||||||
Log.v("Removed Automated Error Reporting code");
|
Logger.v("Removed Automated Error Reporting code");
|
||||||
}
|
}
|
||||||
|
|
||||||
void removeTamperProtection(Blocks blocks) {
|
void removeTamperProtection(Blocks blocks) {
|
||||||
if (!options.RemoveTamperProtection)
|
if (!options.RemoveTamperProtection)
|
||||||
return;
|
return;
|
||||||
if (tamperProtectionRemover.remove(blocks))
|
if (tamperProtectionRemover.remove(blocks))
|
||||||
Log.v("Removed Tamper Protection code");
|
Logger.v("Removed Tamper Protection code");
|
||||||
}
|
}
|
||||||
|
|
||||||
void removeMemoryManagerStuff() {
|
void removeMemoryManagerStuff() {
|
||||||
|
|
|
@ -68,7 +68,7 @@ namespace de4dot.code.deobfuscators.SmartAssembly {
|
||||||
|
|
||||||
int delegateToken = 0x02000001 + DotNetUtils.getLdcI4Value(instrs[0]);
|
int delegateToken = 0x02000001 + DotNetUtils.getLdcI4Value(instrs[0]);
|
||||||
if (type.MDToken.ToInt32() != delegateToken) {
|
if (type.MDToken.ToInt32() != delegateToken) {
|
||||||
Log.w("Delegate token is not current type");
|
Logger.w("Delegate token is not current type");
|
||||||
return null;
|
return null;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -93,7 +93,7 @@ namespace de4dot.code.deobfuscators.SmartAssembly {
|
||||||
}
|
}
|
||||||
|
|
||||||
if (methodIndex >= memberReferences.Count) {
|
if (methodIndex >= memberReferences.Count) {
|
||||||
Log.w("Ignoring invalid methodIndex: {0:X8}, field: {1:X8}", methodIndex, field.MDToken.ToInt32());
|
Logger.w("Ignoring invalid methodIndex: {0:X8}, field: {1:X8}", methodIndex, field.MDToken.ToInt32());
|
||||||
calledMethod = null;
|
calledMethod = null;
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
|
|
|
@ -63,7 +63,7 @@ namespace de4dot.code.deobfuscators.SmartAssembly {
|
||||||
return false;
|
return false;
|
||||||
|
|
||||||
resourceInfo = info;
|
resourceInfo = info;
|
||||||
Log.v("Found embedded assemblies resource {0}", Utils.toCsharpString(info.resourceName));
|
Logger.v("Found embedded assemblies resource {0}", Utils.toCsharpString(info.resourceName));
|
||||||
return true;
|
return true;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
|
@ -296,7 +296,7 @@ namespace de4dot.code.deobfuscators.SmartAssembly {
|
||||||
|
|
||||||
if (tamperBlocks == null) {
|
if (tamperBlocks == null) {
|
||||||
if (isTamperProtected(allBlocks))
|
if (isTamperProtected(allBlocks))
|
||||||
Log.w("Could not remove tamper protection code: {0} ({1:X8})", Utils.removeNewlines(blocks.Method), blocks.Method.MDToken.ToUInt32());
|
Logger.w("Could not remove tamper protection code: {0} ({1:X8})", Utils.removeNewlines(blocks.Method), blocks.Method.MDToken.ToUInt32());
|
||||||
return false;
|
return false;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
@ -134,7 +134,7 @@ namespace de4dot.code.deobfuscators.Spices_Net {
|
||||||
if (resourceNamespace != ns)
|
if (resourceNamespace != ns)
|
||||||
return;
|
return;
|
||||||
|
|
||||||
Log.v("Restoring resource name: '{0}' => '{1}'",
|
Logger.v("Restoring resource name: '{0}' => '{1}'",
|
||||||
Utils.removeNewlines(resource.Name),
|
Utils.removeNewlines(resource.Name),
|
||||||
Utils.removeNewlines(newName));
|
Utils.removeNewlines(newName));
|
||||||
resource.Name = newName;
|
resource.Name = newName;
|
||||||
|
|
|
@ -91,7 +91,7 @@ namespace de4dot.code.deobfuscators.Spices_Net {
|
||||||
var list = methodToOrigMethods.find(calledMethod);
|
var list = methodToOrigMethods.find(calledMethod);
|
||||||
var method = list[0];
|
var method = list[0];
|
||||||
|
|
||||||
Log.v("Restored method body {0:X8} from method {1:X8}",
|
Logger.v("Restored method body {0:X8} from method {1:X8}",
|
||||||
method.MDToken.ToInt32(),
|
method.MDToken.ToInt32(),
|
||||||
calledMethod.MDToken.ToInt32());
|
calledMethod.MDToken.ToInt32());
|
||||||
DotNetUtils.copyBodyFromTo(calledMethod, method);
|
DotNetUtils.copyBodyFromTo(calledMethod, method);
|
||||||
|
|
|
@ -184,12 +184,12 @@ namespace de4dot.code.deobfuscators {
|
||||||
if (fields.Count == 0)
|
if (fields.Count == 0)
|
||||||
return;
|
return;
|
||||||
|
|
||||||
Log.v("Changing field types to real type");
|
Logger.v("Changing field types to real type");
|
||||||
fields.Sort((a, b) => a.token.CompareTo(b.token));
|
fields.Sort((a, b) => a.token.CompareTo(b.token));
|
||||||
Log.indent();
|
Logger.Instance.indent();
|
||||||
foreach (var updatedField in fields)
|
foreach (var updatedField in fields)
|
||||||
Log.v("Field {0:X8}: type {1} ({2:X8})", updatedField.token, Utils.removeNewlines(updatedField.newFieldType.FullName), updatedField.newFieldType.MDToken.ToInt32());
|
Logger.v("Field {0:X8}: type {1} ({2:X8})", updatedField.token, Utils.removeNewlines(updatedField.newFieldType.FullName), updatedField.newFieldType.MDToken.ToInt32());
|
||||||
Log.deIndent();
|
Logger.Instance.deIndent();
|
||||||
}
|
}
|
||||||
|
|
||||||
void restoreMethodTypes() {
|
void restoreMethodTypes() {
|
||||||
|
@ -197,14 +197,14 @@ namespace de4dot.code.deobfuscators {
|
||||||
if (methods.Count == 0)
|
if (methods.Count == 0)
|
||||||
return;
|
return;
|
||||||
|
|
||||||
Log.v("Changing method args and return types to real type");
|
Logger.v("Changing method args and return types to real type");
|
||||||
methods.Sort((a, b) => a.token.CompareTo(b.token));
|
methods.Sort((a, b) => a.token.CompareTo(b.token));
|
||||||
Log.indent();
|
Logger.Instance.indent();
|
||||||
foreach (var updatedMethod in methods) {
|
foreach (var updatedMethod in methods) {
|
||||||
Log.v("Method {0:X8}", updatedMethod.token);
|
Logger.v("Method {0:X8}", updatedMethod.token);
|
||||||
Log.indent();
|
Logger.Instance.indent();
|
||||||
if (updatedMethod.newReturnType != null) {
|
if (updatedMethod.newReturnType != null) {
|
||||||
Log.v("ret: {0} ({1:X8})",
|
Logger.v("ret: {0} ({1:X8})",
|
||||||
Utils.removeNewlines(updatedMethod.newReturnType.FullName),
|
Utils.removeNewlines(updatedMethod.newReturnType.FullName),
|
||||||
updatedMethod.newReturnType.MDToken.ToInt32());
|
updatedMethod.newReturnType.MDToken.ToInt32());
|
||||||
}
|
}
|
||||||
|
@ -212,14 +212,14 @@ namespace de4dot.code.deobfuscators {
|
||||||
var updatedArg = updatedMethod.newArgTypes[i];
|
var updatedArg = updatedMethod.newArgTypes[i];
|
||||||
if (updatedArg == null)
|
if (updatedArg == null)
|
||||||
continue;
|
continue;
|
||||||
Log.v("arg {0}: {1} ({2:X8})",
|
Logger.v("arg {0}: {1} ({2:X8})",
|
||||||
i,
|
i,
|
||||||
Utils.removeNewlines(updatedArg.FullName),
|
Utils.removeNewlines(updatedArg.FullName),
|
||||||
updatedArg.MDToken.ToInt32());
|
updatedArg.MDToken.ToInt32());
|
||||||
}
|
}
|
||||||
Log.deIndent();
|
Logger.Instance.deIndent();
|
||||||
}
|
}
|
||||||
Log.deIndent();
|
Logger.Instance.deIndent();
|
||||||
}
|
}
|
||||||
|
|
||||||
bool deobfuscateMethods() {
|
bool deobfuscateMethods() {
|
||||||
|
|
|
@ -99,7 +99,7 @@ namespace de4dot.code.deobfuscators {
|
||||||
|
|
||||||
block.replace(callResult.callStartIndex, num, Instruction.CreateLdcI4((bool)callResult.returnValue ? 1 : 0));
|
block.replace(callResult.callStartIndex, num, Instruction.CreateLdcI4((bool)callResult.returnValue ? 1 : 0));
|
||||||
removeUnboxInstruction(block, callResult.callStartIndex + 1, "System.Boolean");
|
removeUnboxInstruction(block, callResult.callStartIndex + 1, "System.Boolean");
|
||||||
Log.v("Decrypted boolean: {0}", callResult.returnValue);
|
Logger.v("Decrypted boolean: {0}", callResult.returnValue);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
@ -112,7 +112,7 @@ namespace de4dot.code.deobfuscators {
|
||||||
|
|
||||||
block.replace(callResult.callStartIndex, num, Instruction.CreateLdcI4((int)callResult.returnValue));
|
block.replace(callResult.callStartIndex, num, Instruction.CreateLdcI4((int)callResult.returnValue));
|
||||||
removeUnboxInstruction(block, callResult.callStartIndex + 1, "System.Int32");
|
removeUnboxInstruction(block, callResult.callStartIndex + 1, "System.Int32");
|
||||||
Log.v("Decrypted int32: {0}", callResult.returnValue);
|
Logger.v("Decrypted int32: {0}", callResult.returnValue);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
@ -125,7 +125,7 @@ namespace de4dot.code.deobfuscators {
|
||||||
|
|
||||||
block.replace(callResult.callStartIndex, num, Instruction.Create(OpCodes.Ldc_I8, (long)callResult.returnValue));
|
block.replace(callResult.callStartIndex, num, Instruction.Create(OpCodes.Ldc_I8, (long)callResult.returnValue));
|
||||||
removeUnboxInstruction(block, callResult.callStartIndex + 1, "System.Int64");
|
removeUnboxInstruction(block, callResult.callStartIndex + 1, "System.Int64");
|
||||||
Log.v("Decrypted int64: {0}", callResult.returnValue);
|
Logger.v("Decrypted int64: {0}", callResult.returnValue);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
@ -138,7 +138,7 @@ namespace de4dot.code.deobfuscators {
|
||||||
|
|
||||||
block.replace(callResult.callStartIndex, num, Instruction.Create(OpCodes.Ldc_R4, (float)callResult.returnValue));
|
block.replace(callResult.callStartIndex, num, Instruction.Create(OpCodes.Ldc_R4, (float)callResult.returnValue));
|
||||||
removeUnboxInstruction(block, callResult.callStartIndex + 1, "System.Single");
|
removeUnboxInstruction(block, callResult.callStartIndex + 1, "System.Single");
|
||||||
Log.v("Decrypted single: {0}", callResult.returnValue);
|
Logger.v("Decrypted single: {0}", callResult.returnValue);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
@ -151,7 +151,7 @@ namespace de4dot.code.deobfuscators {
|
||||||
|
|
||||||
block.replace(callResult.callStartIndex, num, Instruction.Create(OpCodes.Ldc_R8, (double)callResult.returnValue));
|
block.replace(callResult.callStartIndex, num, Instruction.Create(OpCodes.Ldc_R8, (double)callResult.returnValue));
|
||||||
removeUnboxInstruction(block, callResult.callStartIndex + 1, "System.Double");
|
removeUnboxInstruction(block, callResult.callStartIndex + 1, "System.Double");
|
||||||
Log.v("Decrypted double: {0}", callResult.returnValue);
|
Logger.v("Decrypted double: {0}", callResult.returnValue);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
|
@ -102,7 +102,7 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v3 {
|
||||||
return data;
|
return data;
|
||||||
|
|
||||||
if (shouldUnpack)
|
if (shouldUnpack)
|
||||||
Log.w("Could not unpack the file");
|
Logger.w("Could not unpack the file");
|
||||||
return null;
|
return null;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
@ -157,7 +157,7 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v3 {
|
||||||
return patch2(peImage);
|
return patch2(peImage);
|
||||||
}
|
}
|
||||||
catch {
|
catch {
|
||||||
Log.w("Could not patch the file");
|
Logger.w("Could not patch the file");
|
||||||
return false;
|
return false;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
|
@ -312,7 +312,7 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v3 {
|
||||||
public override void deobfuscateMethodEnd(Blocks blocks) {
|
public override void deobfuscateMethodEnd(Blocks blocks) {
|
||||||
if (options.RemoveAntiStrongName) {
|
if (options.RemoveAntiStrongName) {
|
||||||
if (antiStrongName.remove(blocks))
|
if (antiStrongName.remove(blocks))
|
||||||
Log.v("Removed Anti Strong Name code");
|
Logger.v("Removed Anti Strong Name code");
|
||||||
}
|
}
|
||||||
base.deobfuscateMethodEnd(blocks);
|
base.deobfuscateMethodEnd(blocks);
|
||||||
}
|
}
|
||||||
|
|
|
@ -84,7 +84,7 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 {
|
||||||
if (!encryptedResource.FoundResource)
|
if (!encryptedResource.FoundResource)
|
||||||
return;
|
return;
|
||||||
|
|
||||||
Log.v("Adding boolean decrypter. Resource: {0}", Utils.toCsharpString(encryptedResource.Resource.Name));
|
Logger.v("Adding boolean decrypter. Resource: {0}", Utils.toCsharpString(encryptedResource.Resource.Name));
|
||||||
decryptedData = encryptedResource.decrypt();
|
decryptedData = encryptedResource.decrypt();
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
@ -549,7 +549,7 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 {
|
||||||
if (!options.RemoveAntiStrongName)
|
if (!options.RemoveAntiStrongName)
|
||||||
return;
|
return;
|
||||||
if (antiStrongname.remove(blocks))
|
if (antiStrongname.remove(blocks))
|
||||||
Log.v("Removed anti strong name code");
|
Logger.v("Removed anti strong name code");
|
||||||
}
|
}
|
||||||
|
|
||||||
TypeDef getDecrypterType() {
|
TypeDef getDecrypterType() {
|
||||||
|
@ -587,7 +587,7 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 {
|
||||||
if (canRemoveDecrypterType)
|
if (canRemoveDecrypterType)
|
||||||
addTypeToBeRemoved(decrypterType, "Decrypter type");
|
addTypeToBeRemoved(decrypterType, "Decrypter type");
|
||||||
else
|
else
|
||||||
Log.v("Could not remove decrypter type");
|
Logger.v("Could not remove decrypter type");
|
||||||
|
|
||||||
base.deobfuscateEnd();
|
base.deobfuscateEnd();
|
||||||
}
|
}
|
||||||
|
|
|
@ -198,7 +198,7 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 {
|
||||||
|
|
||||||
int methodIndex;
|
int methodIndex;
|
||||||
if (!rvaToIndex.TryGetValue(rva, out methodIndex)) {
|
if (!rvaToIndex.TryGetValue(rva, out methodIndex)) {
|
||||||
Log.w("Could not find method having code RVA {0:X8}", rva);
|
Logger.w("Could not find method having code RVA {0:X8}", rva);
|
||||||
continue;
|
continue;
|
||||||
}
|
}
|
||||||
uint methodToken = 0x06000001 + (uint)methodIndex;
|
uint methodToken = 0x06000001 + (uint)methodIndex;
|
||||||
|
@ -301,7 +301,7 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 {
|
||||||
if (methodToNativeMethod.Count == 0)
|
if (methodToNativeMethod.Count == 0)
|
||||||
return;
|
return;
|
||||||
|
|
||||||
Log.v("Encrypting native methods");
|
Logger.v("Encrypting native methods");
|
||||||
|
|
||||||
var stream = new MemoryStream();
|
var stream = new MemoryStream();
|
||||||
var writer = new BinaryWriter(stream);
|
var writer = new BinaryWriter(stream);
|
||||||
|
@ -325,7 +325,7 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 {
|
||||||
else
|
else
|
||||||
codeRva += 4 * (uint)(codeWriter.ReadByteAtRva(codeRva + 1) >> 4);
|
codeRva += 4 * (uint)(codeWriter.ReadByteAtRva(codeRva + 1) >> 4);
|
||||||
|
|
||||||
Log.v("Native method {0:X8}, code RVA {1:X8}", method.MDToken.ToInt32(), codeRva);
|
Logger.v("Native method {0:X8}, code RVA {1:X8}", method.MDToken.ToInt32(), codeRva);
|
||||||
|
|
||||||
writer.Write(codeRva);
|
writer.Write(codeRva);
|
||||||
writer.Write(0x70000000 + index++);
|
writer.Write(0x70000000 + index++);
|
||||||
|
@ -334,7 +334,7 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 {
|
||||||
}
|
}
|
||||||
|
|
||||||
if (index != 0)
|
if (index != 0)
|
||||||
Log.n("Re-encrypted {0}/{1} native methods", index, totalEncryptedNativeMethods);
|
Logger.n("Re-encrypted {0}/{1} native methods", index, totalEncryptedNativeMethods);
|
||||||
|
|
||||||
var encryptedData = stream.ToArray();
|
var encryptedData = stream.ToArray();
|
||||||
xorEncrypt(encryptedData);
|
xorEncrypt(encryptedData);
|
||||||
|
|
|
@ -159,7 +159,7 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 {
|
||||||
encryptedResource.init(simpleDeobfuscator);
|
encryptedResource.init(simpleDeobfuscator);
|
||||||
if (!encryptedResource.FoundResource)
|
if (!encryptedResource.FoundResource)
|
||||||
return;
|
return;
|
||||||
Log.v("Adding string decrypter. Resource: {0}", Utils.toCsharpString(encryptedResource.Resource.Name));
|
Logger.v("Adding string decrypter. Resource: {0}", Utils.toCsharpString(encryptedResource.Resource.Name));
|
||||||
decryptedData = encryptedResource.decrypt();
|
decryptedData = encryptedResource.decrypt();
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
@ -75,7 +75,7 @@ namespace de4dot.code.renamer {
|
||||||
public void rename() {
|
public void rename() {
|
||||||
if (modules.Empty)
|
if (modules.Empty)
|
||||||
return;
|
return;
|
||||||
Log.n("Renaming all obfuscated symbols");
|
Logger.n("Renaming all obfuscated symbols");
|
||||||
|
|
||||||
modules.initialize();
|
modules.initialize();
|
||||||
renameResourceKeys();
|
renameResourceKeys();
|
||||||
|
@ -113,7 +113,7 @@ namespace de4dot.code.renamer {
|
||||||
var overrideMethod = overrides[i].MethodDeclaration;
|
var overrideMethod = overrides[i].MethodDeclaration;
|
||||||
if (method.MethodDef.Name != overrideMethod.Name)
|
if (method.MethodDef.Name != overrideMethod.Name)
|
||||||
continue;
|
continue;
|
||||||
Log.v("Removed useless override from method {0} ({1:X8}), override: {2:X8}",
|
Logger.v("Removed useless override from method {0} ({1:X8}), override: {2:X8}",
|
||||||
Utils.removeNewlines(method.MethodDef),
|
Utils.removeNewlines(method.MethodDef),
|
||||||
method.MethodDef.MDToken.ToInt32(),
|
method.MethodDef.MDToken.ToInt32(),
|
||||||
overrideMethod.MDToken.ToInt32());
|
overrideMethod.MDToken.ToInt32());
|
||||||
|
@ -125,7 +125,7 @@ namespace de4dot.code.renamer {
|
||||||
}
|
}
|
||||||
|
|
||||||
void renameTypeDefinitions() {
|
void renameTypeDefinitions() {
|
||||||
Log.v("Renaming obfuscated type definitions");
|
Logger.v("Renaming obfuscated type definitions");
|
||||||
|
|
||||||
foreach (var module in modules.TheModules) {
|
foreach (var module in modules.TheModules) {
|
||||||
if (module.ObfuscatedFile.RemoveNamespaceWithOneType)
|
if (module.ObfuscatedFile.RemoveNamespaceWithOneType)
|
||||||
|
@ -164,43 +164,43 @@ namespace de4dot.code.renamer {
|
||||||
if (list.Count != maxClasses)
|
if (list.Count != maxClasses)
|
||||||
continue;
|
continue;
|
||||||
var ns = list[0].TypeDef.Namespace;
|
var ns = list[0].TypeDef.Namespace;
|
||||||
Log.v("Removing namespace: {0}", Utils.removeNewlines(ns));
|
Logger.v("Removing namespace: {0}", Utils.removeNewlines(ns));
|
||||||
foreach (var type in list)
|
foreach (var type in list)
|
||||||
memberInfos.type(type).newNamespace = "";
|
memberInfos.type(type).newNamespace = "";
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
void renameTypeDefinitions(IEnumerable<MTypeDef> typeDefs) {
|
void renameTypeDefinitions(IEnumerable<MTypeDef> typeDefs) {
|
||||||
Log.indent();
|
Logger.Instance.indent();
|
||||||
foreach (var typeDef in typeDefs) {
|
foreach (var typeDef in typeDefs) {
|
||||||
rename(typeDef);
|
rename(typeDef);
|
||||||
renameTypeDefinitions(typeDef.NestedTypes);
|
renameTypeDefinitions(typeDef.NestedTypes);
|
||||||
}
|
}
|
||||||
Log.deIndent();
|
Logger.Instance.deIndent();
|
||||||
}
|
}
|
||||||
|
|
||||||
void rename(MTypeDef type) {
|
void rename(MTypeDef type) {
|
||||||
var typeDefinition = type.TypeDef;
|
var typeDefinition = type.TypeDef;
|
||||||
var info = memberInfos.type(type);
|
var info = memberInfos.type(type);
|
||||||
|
|
||||||
Log.v("Type: {0} ({1:X8})", Utils.removeNewlines(typeDefinition.FullName), typeDefinition.MDToken.ToUInt32());
|
Logger.v("Type: {0} ({1:X8})", Utils.removeNewlines(typeDefinition.FullName), typeDefinition.MDToken.ToUInt32());
|
||||||
Log.indent();
|
Logger.Instance.indent();
|
||||||
|
|
||||||
renameGenericParams(type.GenericParams);
|
renameGenericParams(type.GenericParams);
|
||||||
|
|
||||||
if (RenameTypes && info.gotNewName()) {
|
if (RenameTypes && info.gotNewName()) {
|
||||||
var old = typeDefinition.Name;
|
var old = typeDefinition.Name;
|
||||||
typeDefinition.Name = new UTF8String(info.newName);
|
typeDefinition.Name = new UTF8String(info.newName);
|
||||||
Log.v("Name: {0} => {1}", Utils.removeNewlines(old), Utils.removeNewlines(typeDefinition.Name));
|
Logger.v("Name: {0} => {1}", Utils.removeNewlines(old), Utils.removeNewlines(typeDefinition.Name));
|
||||||
}
|
}
|
||||||
|
|
||||||
if (RenameNamespaces && info.newNamespace != null) {
|
if (RenameNamespaces && info.newNamespace != null) {
|
||||||
var old = typeDefinition.Namespace;
|
var old = typeDefinition.Namespace;
|
||||||
typeDefinition.Namespace = new UTF8String(info.newNamespace);
|
typeDefinition.Namespace = new UTF8String(info.newNamespace);
|
||||||
Log.v("Namespace: {0} => {1}", Utils.removeNewlines(old), Utils.removeNewlines(typeDefinition.Namespace));
|
Logger.v("Namespace: {0} => {1}", Utils.removeNewlines(old), Utils.removeNewlines(typeDefinition.Namespace));
|
||||||
}
|
}
|
||||||
|
|
||||||
Log.deIndent();
|
Logger.Instance.deIndent();
|
||||||
}
|
}
|
||||||
|
|
||||||
void renameGenericParams(IEnumerable<MGenericParamDef> genericParams) {
|
void renameGenericParams(IEnumerable<MGenericParamDef> genericParams) {
|
||||||
|
@ -211,34 +211,34 @@ namespace de4dot.code.renamer {
|
||||||
if (!info.gotNewName())
|
if (!info.gotNewName())
|
||||||
continue;
|
continue;
|
||||||
param.GenericParam.Name = new UTF8String(info.newName);
|
param.GenericParam.Name = new UTF8String(info.newName);
|
||||||
Log.v("GenParam: {0} => {1}", Utils.removeNewlines(info.oldFullName), Utils.removeNewlines(param.GenericParam.FullName));
|
Logger.v("GenParam: {0} => {1}", Utils.removeNewlines(info.oldFullName), Utils.removeNewlines(param.GenericParam.FullName));
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
void renameMemberDefinitions() {
|
void renameMemberDefinitions() {
|
||||||
Log.v("Renaming member definitions #2");
|
Logger.v("Renaming member definitions #2");
|
||||||
|
|
||||||
var allTypes = new List<MTypeDef>(modules.AllTypes);
|
var allTypes = new List<MTypeDef>(modules.AllTypes);
|
||||||
allTypes.Sort((a, b) => a.Index.CompareTo(b.Index));
|
allTypes.Sort((a, b) => a.Index.CompareTo(b.Index));
|
||||||
|
|
||||||
Log.indent();
|
Logger.Instance.indent();
|
||||||
foreach (var typeDef in allTypes)
|
foreach (var typeDef in allTypes)
|
||||||
renameMembers(typeDef);
|
renameMembers(typeDef);
|
||||||
Log.deIndent();
|
Logger.Instance.deIndent();
|
||||||
}
|
}
|
||||||
|
|
||||||
void renameMembers(MTypeDef type) {
|
void renameMembers(MTypeDef type) {
|
||||||
var info = memberInfos.type(type);
|
var info = memberInfos.type(type);
|
||||||
|
|
||||||
Log.v("Type: {0}", Utils.removeNewlines(info.type.TypeDef.FullName));
|
Logger.v("Type: {0}", Utils.removeNewlines(info.type.TypeDef.FullName));
|
||||||
Log.indent();
|
Logger.Instance.indent();
|
||||||
|
|
||||||
renameFields(info);
|
renameFields(info);
|
||||||
renameProperties(info);
|
renameProperties(info);
|
||||||
renameEvents(info);
|
renameEvents(info);
|
||||||
renameMethods(info);
|
renameMethods(info);
|
||||||
|
|
||||||
Log.deIndent();
|
Logger.Instance.deIndent();
|
||||||
}
|
}
|
||||||
|
|
||||||
void renameFields(TypeInfo info) {
|
void renameFields(TypeInfo info) {
|
||||||
|
@ -249,7 +249,7 @@ namespace de4dot.code.renamer {
|
||||||
if (!fieldInfo.gotNewName())
|
if (!fieldInfo.gotNewName())
|
||||||
continue;
|
continue;
|
||||||
fieldDef.FieldDef.Name = new UTF8String(fieldInfo.newName);
|
fieldDef.FieldDef.Name = new UTF8String(fieldInfo.newName);
|
||||||
Log.v("Field: {0} ({1:X8}) => {2}",
|
Logger.v("Field: {0} ({1:X8}) => {2}",
|
||||||
Utils.removeNewlines(fieldInfo.oldFullName),
|
Utils.removeNewlines(fieldInfo.oldFullName),
|
||||||
fieldDef.FieldDef.MDToken.ToUInt32(),
|
fieldDef.FieldDef.MDToken.ToUInt32(),
|
||||||
Utils.removeNewlines(fieldDef.FieldDef.FullName));
|
Utils.removeNewlines(fieldDef.FieldDef.FullName));
|
||||||
|
@ -264,7 +264,7 @@ namespace de4dot.code.renamer {
|
||||||
if (!propInfo.gotNewName())
|
if (!propInfo.gotNewName())
|
||||||
continue;
|
continue;
|
||||||
propDef.PropertyDef.Name = new UTF8String(propInfo.newName);
|
propDef.PropertyDef.Name = new UTF8String(propInfo.newName);
|
||||||
Log.v("Property: {0} ({1:X8}) => {2}",
|
Logger.v("Property: {0} ({1:X8}) => {2}",
|
||||||
Utils.removeNewlines(propInfo.oldFullName),
|
Utils.removeNewlines(propInfo.oldFullName),
|
||||||
propDef.PropertyDef.MDToken.ToUInt32(),
|
propDef.PropertyDef.MDToken.ToUInt32(),
|
||||||
Utils.removeNewlines(propDef.PropertyDef.FullName));
|
Utils.removeNewlines(propDef.PropertyDef.FullName));
|
||||||
|
@ -279,7 +279,7 @@ namespace de4dot.code.renamer {
|
||||||
if (!eventInfo.gotNewName())
|
if (!eventInfo.gotNewName())
|
||||||
continue;
|
continue;
|
||||||
eventDef.EventDef.Name = new UTF8String(eventInfo.newName);
|
eventDef.EventDef.Name = new UTF8String(eventInfo.newName);
|
||||||
Log.v("Event: {0} ({1:X8}) => {2}",
|
Logger.v("Event: {0} ({1:X8}) => {2}",
|
||||||
Utils.removeNewlines(eventInfo.oldFullName),
|
Utils.removeNewlines(eventInfo.oldFullName),
|
||||||
eventDef.EventDef.MDToken.ToUInt32(),
|
eventDef.EventDef.MDToken.ToUInt32(),
|
||||||
Utils.removeNewlines(eventDef.EventDef.FullName));
|
Utils.removeNewlines(eventDef.EventDef.FullName));
|
||||||
|
@ -291,14 +291,14 @@ namespace de4dot.code.renamer {
|
||||||
return;
|
return;
|
||||||
foreach (var methodDef in info.type.AllMethodsSorted) {
|
foreach (var methodDef in info.type.AllMethodsSorted) {
|
||||||
var methodInfo = memberInfos.method(methodDef);
|
var methodInfo = memberInfos.method(methodDef);
|
||||||
Log.v("Method {0} ({1:X8})", Utils.removeNewlines(methodInfo.oldFullName), methodDef.MethodDef.MDToken.ToUInt32());
|
Logger.v("Method {0} ({1:X8})", Utils.removeNewlines(methodInfo.oldFullName), methodDef.MethodDef.MDToken.ToUInt32());
|
||||||
Log.indent();
|
Logger.Instance.indent();
|
||||||
|
|
||||||
renameGenericParams(methodDef.GenericParams);
|
renameGenericParams(methodDef.GenericParams);
|
||||||
|
|
||||||
if (RenameMethods && methodInfo.gotNewName()) {
|
if (RenameMethods && methodInfo.gotNewName()) {
|
||||||
methodDef.MethodDef.Name = new UTF8String(methodInfo.newName);
|
methodDef.MethodDef.Name = new UTF8String(methodInfo.newName);
|
||||||
Log.v("Name: {0} => {1}", Utils.removeNewlines(methodInfo.oldFullName), Utils.removeNewlines(methodDef.MethodDef.FullName));
|
Logger.v("Name: {0} => {1}", Utils.removeNewlines(methodInfo.oldFullName), Utils.removeNewlines(methodDef.MethodDef.FullName));
|
||||||
}
|
}
|
||||||
|
|
||||||
if (RenameMethodArgs) {
|
if (RenameMethodArgs) {
|
||||||
|
@ -309,22 +309,22 @@ namespace de4dot.code.renamer {
|
||||||
param.ParameterDefinition.CreateParamDef();
|
param.ParameterDefinition.CreateParamDef();
|
||||||
param.ParameterDefinition.Name = paramInfo.newName;
|
param.ParameterDefinition.Name = paramInfo.newName;
|
||||||
if (param.IsReturnParameter)
|
if (param.IsReturnParameter)
|
||||||
Log.v("RetParam: {0} => {1}", Utils.removeNewlines(paramInfo.oldName), Utils.removeNewlines(paramInfo.newName));
|
Logger.v("RetParam: {0} => {1}", Utils.removeNewlines(paramInfo.oldName), Utils.removeNewlines(paramInfo.newName));
|
||||||
else
|
else
|
||||||
Log.v("Param ({0}/{1}): {2} => {3}", param.ParameterDefinition.MethodSigIndex + 1, methodDef.MethodDef.MethodSig.GetParamCount(), Utils.removeNewlines(paramInfo.oldName), Utils.removeNewlines(paramInfo.newName));
|
Logger.v("Param ({0}/{1}): {2} => {3}", param.ParameterDefinition.MethodSigIndex + 1, methodDef.MethodDef.MethodSig.GetParamCount(), Utils.removeNewlines(paramInfo.oldName), Utils.removeNewlines(paramInfo.newName));
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
Log.deIndent();
|
Logger.Instance.deIndent();
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
void renameMemberReferences() {
|
void renameMemberReferences() {
|
||||||
Log.v("Renaming references to other definitions");
|
Logger.v("Renaming references to other definitions");
|
||||||
foreach (var module in modules.TheModules) {
|
foreach (var module in modules.TheModules) {
|
||||||
if (modules.TheModules.Count > 1)
|
if (modules.TheModules.Count > 1)
|
||||||
Log.v("Renaming references to other definitions ({0})", module.Filename);
|
Logger.v("Renaming references to other definitions ({0})", module.Filename);
|
||||||
Log.indent();
|
Logger.Instance.indent();
|
||||||
foreach (var refToDef in module.MethodRefsToRename)
|
foreach (var refToDef in module.MethodRefsToRename)
|
||||||
refToDef.reference.Name = refToDef.definition.Name;
|
refToDef.reference.Name = refToDef.definition.Name;
|
||||||
foreach (var refToDef in module.FieldRefsToRename)
|
foreach (var refToDef in module.FieldRefsToRename)
|
||||||
|
@ -333,18 +333,18 @@ namespace de4dot.code.renamer {
|
||||||
info.cattr.NamedArguments[info.index].Name = info.reference.Name;
|
info.cattr.NamedArguments[info.index].Name = info.reference.Name;
|
||||||
foreach (var info in module.CustomAttributePropertyReferences)
|
foreach (var info in module.CustomAttributePropertyReferences)
|
||||||
info.cattr.NamedArguments[info.index].Name = info.reference.Name;
|
info.cattr.NamedArguments[info.index].Name = info.reference.Name;
|
||||||
Log.deIndent();
|
Logger.Instance.deIndent();
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
void renameResources() {
|
void renameResources() {
|
||||||
Log.v("Renaming resources");
|
Logger.v("Renaming resources");
|
||||||
foreach (var module in modules.TheModules) {
|
foreach (var module in modules.TheModules) {
|
||||||
if (modules.TheModules.Count > 1)
|
if (modules.TheModules.Count > 1)
|
||||||
Log.v("Renaming resources ({0})", module.Filename);
|
Logger.v("Renaming resources ({0})", module.Filename);
|
||||||
Log.indent();
|
Logger.Instance.indent();
|
||||||
renameResources(module);
|
renameResources(module);
|
||||||
Log.deIndent();
|
Logger.Instance.deIndent();
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -387,17 +387,17 @@ namespace de4dot.code.renamer {
|
||||||
}
|
}
|
||||||
|
|
||||||
void renameTypeReferences() {
|
void renameTypeReferences() {
|
||||||
Log.v("Renaming references to type definitions");
|
Logger.v("Renaming references to type definitions");
|
||||||
var theModules = modules.TheModules;
|
var theModules = modules.TheModules;
|
||||||
foreach (var module in theModules) {
|
foreach (var module in theModules) {
|
||||||
if (theModules.Count > 1)
|
if (theModules.Count > 1)
|
||||||
Log.v("Renaming references to type definitions ({0})", module.Filename);
|
Logger.v("Renaming references to type definitions ({0})", module.Filename);
|
||||||
Log.indent();
|
Logger.Instance.indent();
|
||||||
foreach (var refToDef in module.TypeRefsToRename) {
|
foreach (var refToDef in module.TypeRefsToRename) {
|
||||||
refToDef.reference.Name = refToDef.definition.Name;
|
refToDef.reference.Name = refToDef.definition.Name;
|
||||||
refToDef.reference.Namespace = refToDef.definition.Namespace;
|
refToDef.reference.Namespace = refToDef.definition.Namespace;
|
||||||
}
|
}
|
||||||
Log.deIndent();
|
Logger.Instance.deIndent();
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -581,7 +581,7 @@ namespace de4dot.code.renamer {
|
||||||
return null;
|
return null;
|
||||||
if (propDef.GetMethod != null)
|
if (propDef.GetMethod != null)
|
||||||
return null;
|
return null;
|
||||||
Log.v("Restoring property getter {0} ({1:X8}), Property: {2} ({3:X8})",
|
Logger.v("Restoring property getter {0} ({1:X8}), Property: {2} ({3:X8})",
|
||||||
Utils.removeNewlines(propMethod),
|
Utils.removeNewlines(propMethod),
|
||||||
propMethod.MethodDef.MDToken.ToInt32(),
|
propMethod.MethodDef.MDToken.ToInt32(),
|
||||||
Utils.removeNewlines(propDef.PropertyDef),
|
Utils.removeNewlines(propDef.PropertyDef),
|
||||||
|
@ -610,7 +610,7 @@ namespace de4dot.code.renamer {
|
||||||
return null;
|
return null;
|
||||||
if (propDef.SetMethod != null)
|
if (propDef.SetMethod != null)
|
||||||
return null;
|
return null;
|
||||||
Log.v("Restoring property setter {0} ({1:X8}), Property: {2} ({3:X8})",
|
Logger.v("Restoring property setter {0} ({1:X8}), Property: {2} ({3:X8})",
|
||||||
Utils.removeNewlines(propMethod),
|
Utils.removeNewlines(propMethod),
|
||||||
propMethod.MethodDef.MDToken.ToInt32(),
|
propMethod.MethodDef.MDToken.ToInt32(),
|
||||||
Utils.removeNewlines(propDef.PropertyDef),
|
Utils.removeNewlines(propDef.PropertyDef),
|
||||||
|
@ -636,7 +636,7 @@ namespace de4dot.code.renamer {
|
||||||
|
|
||||||
propDef = ownerType.create(newProp);
|
propDef = ownerType.create(newProp);
|
||||||
memberInfos.add(propDef);
|
memberInfos.add(propDef);
|
||||||
Log.v("Restoring property: {0}", Utils.removeNewlines(newProp));
|
Logger.v("Restoring property: {0}", Utils.removeNewlines(newProp));
|
||||||
return propDef;
|
return propDef;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -805,7 +805,7 @@ namespace de4dot.code.renamer {
|
||||||
return null;
|
return null;
|
||||||
if (eventDef.AddMethod != null)
|
if (eventDef.AddMethod != null)
|
||||||
return null;
|
return null;
|
||||||
Log.v("Restoring event adder {0} ({1:X8}), Event: {2} ({3:X8})",
|
Logger.v("Restoring event adder {0} ({1:X8}), Event: {2} ({3:X8})",
|
||||||
Utils.removeNewlines(eventMethod),
|
Utils.removeNewlines(eventMethod),
|
||||||
eventMethod.MethodDef.MDToken.ToInt32(),
|
eventMethod.MethodDef.MDToken.ToInt32(),
|
||||||
Utils.removeNewlines(eventDef.EventDef),
|
Utils.removeNewlines(eventDef.EventDef),
|
||||||
|
@ -831,7 +831,7 @@ namespace de4dot.code.renamer {
|
||||||
return null;
|
return null;
|
||||||
if (eventDef.RemoveMethod != null)
|
if (eventDef.RemoveMethod != null)
|
||||||
return null;
|
return null;
|
||||||
Log.v("Restoring event remover {0} ({1:X8}), Event: {2} ({3:X8})",
|
Logger.v("Restoring event remover {0} ({1:X8}), Event: {2} ({3:X8})",
|
||||||
Utils.removeNewlines(eventMethod),
|
Utils.removeNewlines(eventMethod),
|
||||||
eventMethod.MethodDef.MDToken.ToInt32(),
|
eventMethod.MethodDef.MDToken.ToInt32(),
|
||||||
Utils.removeNewlines(eventDef.EventDef),
|
Utils.removeNewlines(eventDef.EventDef),
|
||||||
|
@ -861,12 +861,12 @@ namespace de4dot.code.renamer {
|
||||||
|
|
||||||
eventDef = ownerType.create(newEvent);
|
eventDef = ownerType.create(newEvent);
|
||||||
memberInfos.add(eventDef);
|
memberInfos.add(eventDef);
|
||||||
Log.v("Restoring event: {0}", Utils.removeNewlines(newEvent));
|
Logger.v("Restoring event: {0}", Utils.removeNewlines(newEvent));
|
||||||
return eventDef;
|
return eventDef;
|
||||||
}
|
}
|
||||||
|
|
||||||
void prepareRenameMemberDefinitions(MethodNameGroups groups) {
|
void prepareRenameMemberDefinitions(MethodNameGroups groups) {
|
||||||
Log.v("Renaming member definitions #1");
|
Logger.v("Renaming member definitions #1");
|
||||||
|
|
||||||
prepareRenameEntryPoints();
|
prepareRenameEntryPoints();
|
||||||
|
|
||||||
|
@ -1578,7 +1578,7 @@ namespace de4dot.code.renamer {
|
||||||
continue;
|
continue;
|
||||||
var methodDef = modules.resolveMethod(entryPoint);
|
var methodDef = modules.resolveMethod(entryPoint);
|
||||||
if (methodDef == null) {
|
if (methodDef == null) {
|
||||||
Log.w(string.Format("Could not find entry point. Module: {0}, Method: {1}", module.ModuleDefMD.Location, Utils.removeNewlines(entryPoint)));
|
Logger.w(string.Format("Could not find entry point. Module: {0}, Method: {1}", module.ModuleDefMD.Location, Utils.removeNewlines(entryPoint)));
|
||||||
continue;
|
continue;
|
||||||
}
|
}
|
||||||
if (!methodDef.isStatic())
|
if (!methodDef.isStatic())
|
||||||
|
|
|
@ -43,23 +43,23 @@ namespace de4dot.code.renamer {
|
||||||
}
|
}
|
||||||
|
|
||||||
public void rename() {
|
public void rename() {
|
||||||
Log.v("Renaming resource keys ({0})", module);
|
Logger.v("Renaming resource keys ({0})", module);
|
||||||
Log.indent();
|
Logger.Instance.indent();
|
||||||
foreach (var type in module.GetTypes()) {
|
foreach (var type in module.GetTypes()) {
|
||||||
string resourceName = getResourceName(type);
|
string resourceName = getResourceName(type);
|
||||||
if (resourceName == null)
|
if (resourceName == null)
|
||||||
continue;
|
continue;
|
||||||
var resource = getResource(resourceName);
|
var resource = getResource(resourceName);
|
||||||
if (resource == null) {
|
if (resource == null) {
|
||||||
Log.w("Could not find resource {0}", Utils.removeNewlines(resourceName));
|
Logger.w("Could not find resource {0}", Utils.removeNewlines(resourceName));
|
||||||
continue;
|
continue;
|
||||||
}
|
}
|
||||||
Log.v("Resource: {0}", Utils.toCsharpString(resource.Name));
|
Logger.v("Resource: {0}", Utils.toCsharpString(resource.Name));
|
||||||
Log.indent();
|
Logger.Instance.indent();
|
||||||
rename(type, resource);
|
rename(type, resource);
|
||||||
Log.deIndent();
|
Logger.Instance.deIndent();
|
||||||
}
|
}
|
||||||
Log.deIndent();
|
Logger.Instance.deIndent();
|
||||||
}
|
}
|
||||||
|
|
||||||
EmbeddedResource getResource(string resourceName) {
|
EmbeddedResource getResource(string resourceName) {
|
||||||
|
@ -97,7 +97,7 @@ namespace de4dot.code.renamer {
|
||||||
if (ctor.FullName != "System.Void System.Resources.ResourceManager::.ctor(System.String,System.Reflection.Assembly)")
|
if (ctor.FullName != "System.Void System.Resources.ResourceManager::.ctor(System.String,System.Reflection.Assembly)")
|
||||||
continue;
|
continue;
|
||||||
if (resourceName == null) {
|
if (resourceName == null) {
|
||||||
Log.w("Could not find resource name");
|
Logger.w("Could not find resource name");
|
||||||
continue;
|
continue;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -190,7 +190,7 @@ namespace de4dot.code.renamer {
|
||||||
if (ldstrIndex >= 0)
|
if (ldstrIndex >= 0)
|
||||||
ldstr = instrs[ldstrIndex];
|
ldstr = instrs[ldstrIndex];
|
||||||
if (ldstr == null || (name = ldstr.Operand as string) == null) {
|
if (ldstr == null || (name = ldstr.Operand as string) == null) {
|
||||||
Log.w("Could not find string argument to method {0}", calledMethod);
|
Logger.w("Could not find string argument to method {0}", calledMethod);
|
||||||
continue;
|
continue;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -199,7 +199,7 @@ namespace de4dot.code.renamer {
|
||||||
continue; // should not be renamed
|
continue; // should not be renamed
|
||||||
|
|
||||||
ldstr.Operand = info.newName;
|
ldstr.Operand = info.newName;
|
||||||
Log.v("Renamed resource key {0} => {1}", Utils.toCsharpString(info.element.Name), Utils.toCsharpString(info.newName));
|
Logger.v("Renamed resource key {0} => {1}", Utils.toCsharpString(info.element.Name), Utils.toCsharpString(info.newName));
|
||||||
info.element.Name = info.newName;
|
info.element.Name = info.newName;
|
||||||
info.foundInCode = true;
|
info.foundInCode = true;
|
||||||
}
|
}
|
||||||
|
@ -207,7 +207,7 @@ namespace de4dot.code.renamer {
|
||||||
|
|
||||||
foreach (var info in renamed) {
|
foreach (var info in renamed) {
|
||||||
if (!info.foundInCode)
|
if (!info.foundInCode)
|
||||||
Log.w("Could not find resource key {0} in code", Utils.removeNewlines(info.element.Name));
|
Logger.w("Could not find resource key {0} in code", Utils.removeNewlines(info.element.Name));
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
@ -82,10 +82,10 @@ namespace de4dot.code.renamer {
|
||||||
bool renameCodeString = module.ObfuscatedFile.RenameResourcesInCode ||
|
bool renameCodeString = module.ObfuscatedFile.RenameResourcesInCode ||
|
||||||
isCallingResourceManagerCtor(instrs, i, typeInfo);
|
isCallingResourceManagerCtor(instrs, i, typeInfo);
|
||||||
if (!renameCodeString)
|
if (!renameCodeString)
|
||||||
Log.v("Possible resource name in code: '{0}' => '{1}' in method {2}", Utils.removeNewlines(codeString), newName, Utils.removeNewlines(method));
|
Logger.v("Possible resource name in code: '{0}' => '{1}' in method {2}", Utils.removeNewlines(codeString), newName, Utils.removeNewlines(method));
|
||||||
else {
|
else {
|
||||||
instr.Operand = newName;
|
instr.Operand = newName;
|
||||||
Log.v("Renamed resource string in code: '{0}' => '{1}' ({2})", Utils.removeNewlines(codeString), newName, Utils.removeNewlines(method));
|
Logger.v("Renamed resource string in code: '{0}' => '{1}' ({2})", Utils.removeNewlines(codeString), newName, Utils.removeNewlines(method));
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
@ -155,7 +155,7 @@ namespace de4dot.code.renamer {
|
||||||
var newName = newTypeName + resource.Name.String.Substring(oldFullName.Length);
|
var newName = newTypeName + resource.Name.String.Substring(oldFullName.Length);
|
||||||
newNames[resource] = new RenameInfo(resource, info, newName);
|
newNames[resource] = new RenameInfo(resource, info, newName);
|
||||||
|
|
||||||
Log.v("Renamed resource in resources: {0} => {1}", Utils.removeNewlines(resource.Name), newName);
|
Logger.v("Renamed resource in resources: {0} => {1}", Utils.removeNewlines(resource.Name), newName);
|
||||||
resource.Name = new UTF8String(newName);
|
resource.Name = new UTF8String(newName);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
|
@ -162,7 +162,7 @@ namespace de4dot.code.renamer.asmmodules {
|
||||||
if (namedArg.IsField) {
|
if (namedArg.IsField) {
|
||||||
var fieldDef = findField(typeDef, namedArg.Name, namedArg.Type);
|
var fieldDef = findField(typeDef, namedArg.Name, namedArg.Type);
|
||||||
if (fieldDef == null) {
|
if (fieldDef == null) {
|
||||||
Log.w("Could not find field {0} in attribute {1} ({2:X8})",
|
Logger.w("Could not find field {0} in attribute {1} ({2:X8})",
|
||||||
Utils.toCsharpString(namedArg.Name),
|
Utils.toCsharpString(namedArg.Name),
|
||||||
Utils.toCsharpString(typeDef.TypeDef.Name),
|
Utils.toCsharpString(typeDef.TypeDef.Name),
|
||||||
typeDef.TypeDef.MDToken.ToInt32());
|
typeDef.TypeDef.MDToken.ToInt32());
|
||||||
|
@ -174,7 +174,7 @@ namespace de4dot.code.renamer.asmmodules {
|
||||||
else {
|
else {
|
||||||
var propDef = findProperty(typeDef, namedArg.Name, namedArg.Type);
|
var propDef = findProperty(typeDef, namedArg.Name, namedArg.Type);
|
||||||
if (propDef == null) {
|
if (propDef == null) {
|
||||||
Log.w("Could not find property {0} in attribute {1} ({2:X8})",
|
Logger.w("Could not find property {0} in attribute {1} ({2:X8})",
|
||||||
Utils.toCsharpString(namedArg.Name),
|
Utils.toCsharpString(namedArg.Name),
|
||||||
Utils.toCsharpString(typeDef.TypeDef.Name),
|
Utils.toCsharpString(typeDef.TypeDef.Name),
|
||||||
typeDef.TypeDef.MDToken.ToInt32());
|
typeDef.TypeDef.MDToken.ToInt32());
|
||||||
|
|
|
@ -155,25 +155,25 @@ namespace de4dot.code.renamer.asmmodules {
|
||||||
}
|
}
|
||||||
|
|
||||||
void findAllMemberReferences() {
|
void findAllMemberReferences() {
|
||||||
Log.v("Finding all MemberReferences");
|
Logger.v("Finding all MemberReferences");
|
||||||
int index = 0;
|
int index = 0;
|
||||||
foreach (var module in modules) {
|
foreach (var module in modules) {
|
||||||
if (modules.Count > 1)
|
if (modules.Count > 1)
|
||||||
Log.v("Finding all MemberReferences ({0})", module.Filename);
|
Logger.v("Finding all MemberReferences ({0})", module.Filename);
|
||||||
Log.indent();
|
Logger.Instance.indent();
|
||||||
module.findAllMemberReferences(ref index);
|
module.findAllMemberReferences(ref index);
|
||||||
Log.deIndent();
|
Logger.Instance.deIndent();
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
void resolveAllRefs() {
|
void resolveAllRefs() {
|
||||||
Log.v("Resolving references");
|
Logger.v("Resolving references");
|
||||||
foreach (var module in modules) {
|
foreach (var module in modules) {
|
||||||
if (modules.Count > 1)
|
if (modules.Count > 1)
|
||||||
Log.v("Resolving references ({0})", module.Filename);
|
Logger.v("Resolving references ({0})", module.Filename);
|
||||||
Log.indent();
|
Logger.Instance.indent();
|
||||||
module.resolveAllRefs(this);
|
module.resolveAllRefs(this);
|
||||||
Log.deIndent();
|
Logger.Instance.deIndent();
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -449,7 +449,7 @@ namespace de4dot.code.renamer.asmmodules {
|
||||||
}
|
}
|
||||||
if (isAutoCreatedType(typeRef))
|
if (isAutoCreatedType(typeRef))
|
||||||
return null;
|
return null;
|
||||||
Log.e("Could not resolve TypeReference {0} ({1:X8}) (from {2} -> {3})",
|
Logger.e("Could not resolve TypeReference {0} ({1:X8}) (from {2} -> {3})",
|
||||||
Utils.removeNewlines(typeRef),
|
Utils.removeNewlines(typeRef),
|
||||||
typeRef.MDToken.ToInt32(),
|
typeRef.MDToken.ToInt32(),
|
||||||
typeRef.OwnerModule,
|
typeRef.OwnerModule,
|
||||||
|
@ -470,7 +470,7 @@ namespace de4dot.code.renamer.asmmodules {
|
||||||
}
|
}
|
||||||
if (isAutoCreatedType(methodRef.DeclaringType))
|
if (isAutoCreatedType(methodRef.DeclaringType))
|
||||||
return null;
|
return null;
|
||||||
Log.e("Could not resolve MethodReference {0} ({1:X8}) (from {2} -> {3})",
|
Logger.e("Could not resolve MethodReference {0} ({1:X8}) (from {2} -> {3})",
|
||||||
Utils.removeNewlines(methodRef),
|
Utils.removeNewlines(methodRef),
|
||||||
methodRef.MDToken.ToInt32(),
|
methodRef.MDToken.ToInt32(),
|
||||||
methodRef.DeclaringType.OwnerModule,
|
methodRef.DeclaringType.OwnerModule,
|
||||||
|
@ -491,7 +491,7 @@ namespace de4dot.code.renamer.asmmodules {
|
||||||
}
|
}
|
||||||
if (isAutoCreatedType(fieldReference.DeclaringType))
|
if (isAutoCreatedType(fieldReference.DeclaringType))
|
||||||
return null;
|
return null;
|
||||||
Log.e("Could not resolve FieldReference {0} ({1:X8}) (from {2} -> {3})",
|
Logger.e("Could not resolve FieldReference {0} ({1:X8}) (from {2} -> {3})",
|
||||||
Utils.removeNewlines(fieldReference),
|
Utils.removeNewlines(fieldReference),
|
||||||
fieldReference.MDToken.ToInt32(),
|
fieldReference.MDToken.ToInt32(),
|
||||||
fieldReference.DeclaringType.OwnerModule,
|
fieldReference.DeclaringType.OwnerModule,
|
||||||
|
|
|
@ -625,7 +625,7 @@ namespace de4dot.code.renamer.asmmodules {
|
||||||
if (!TypeDef.IsImport &&
|
if (!TypeDef.IsImport &&
|
||||||
!hasAttribute("System.Runtime.InteropServices.ComImportAttribute") &&
|
!hasAttribute("System.Runtime.InteropServices.ComImportAttribute") &&
|
||||||
!hasAttribute("System.Runtime.InteropServices.TypeLibTypeAttribute")) {
|
!hasAttribute("System.Runtime.InteropServices.TypeLibTypeAttribute")) {
|
||||||
Log.w("Could not find interface method {0} ({1:X8}). Type: {2} ({3:X8})",
|
Logger.w("Could not find interface method {0} ({1:X8}). Type: {2} ({3:X8})",
|
||||||
Utils.removeNewlines(pair.Key.methodDef.MethodDef),
|
Utils.removeNewlines(pair.Key.methodDef.MethodDef),
|
||||||
pair.Key.methodDef.MethodDef.MDToken.ToInt32(),
|
pair.Key.methodDef.MethodDef.MDToken.ToInt32(),
|
||||||
Utils.removeNewlines(TypeDef),
|
Utils.removeNewlines(TypeDef),
|
||||||
|
|
|
@ -20,6 +20,7 @@
|
||||||
using System;
|
using System;
|
||||||
using System.IO;
|
using System.IO;
|
||||||
using System.Collections.Generic;
|
using System.Collections.Generic;
|
||||||
|
using dot10.DotNet;
|
||||||
using de4dot.code;
|
using de4dot.code;
|
||||||
using de4dot.code.deobfuscators;
|
using de4dot.code.deobfuscators;
|
||||||
using de4dot.code.AssemblyClient;
|
using de4dot.code.AssemblyClient;
|
||||||
|
@ -144,10 +145,10 @@ namespace de4dot.cui {
|
||||||
filesOptions.OneFileAtATime = true;
|
filesOptions.OneFileAtATime = true;
|
||||||
}));
|
}));
|
||||||
miscOptions.Add(new NoArgOption("v", null, "Verbose", () => {
|
miscOptions.Add(new NoArgOption("v", null, "Verbose", () => {
|
||||||
Log.logLevel = Log.LogLevel.verbose;
|
Logger.Instance.MaxLoggerEvent = LoggerEvent.Verbose;
|
||||||
}));
|
}));
|
||||||
miscOptions.Add(new NoArgOption("vv", null, "Very verbose", () => {
|
miscOptions.Add(new NoArgOption("vv", null, "Very verbose", () => {
|
||||||
Log.logLevel = Log.LogLevel.veryverbose;
|
Logger.Instance.MaxLoggerEvent = LoggerEvent.VeryVerbose;
|
||||||
}));
|
}));
|
||||||
miscOptions.Add(new NoArgOption("h", "help", "Show this help message", () => {
|
miscOptions.Add(new NoArgOption("h", "help", "Show this help message", () => {
|
||||||
usage();
|
usage();
|
||||||
|
@ -275,7 +276,7 @@ namespace de4dot.cui {
|
||||||
|
|
||||||
void exitError(string msg) {
|
void exitError(string msg) {
|
||||||
usage();
|
usage();
|
||||||
Log.e("\n\nERROR: {0}\n", msg);
|
Logger.Instance.Log(false, null, LoggerEvent.Error, "\n\nERROR: {0}\n", msg);
|
||||||
exit(2);
|
exit(2);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -285,35 +286,35 @@ namespace de4dot.cui {
|
||||||
|
|
||||||
void usage() {
|
void usage() {
|
||||||
string progName = getProgramBaseName();
|
string progName = getProgramBaseName();
|
||||||
Log.n("Some of the advanced options may be incompatible, causing a nice exception.");
|
Logger.n("Some of the advanced options may be incompatible, causing a nice exception.");
|
||||||
Log.n("With great power comes great responsibility.");
|
Logger.n("With great power comes great responsibility.");
|
||||||
Log.n("");
|
Logger.n("");
|
||||||
Log.n("{0} <options> <file options>", progName);
|
Logger.n("{0} <options> <file options>", progName);
|
||||||
Log.n("Options:");
|
Logger.n("Options:");
|
||||||
foreach (var option in miscOptions)
|
foreach (var option in miscOptions)
|
||||||
printOption(option);
|
printOption(option);
|
||||||
Log.n("");
|
Logger.n("");
|
||||||
Log.n("File options:");
|
Logger.n("File options:");
|
||||||
foreach (var option in fileOptions)
|
foreach (var option in fileOptions)
|
||||||
printOption(option);
|
printOption(option);
|
||||||
Log.n("");
|
Logger.n("");
|
||||||
Log.n("Deobfuscator options:");
|
Logger.n("Deobfuscator options:");
|
||||||
foreach (var info in deobfuscatorInfos) {
|
foreach (var info in deobfuscatorInfos) {
|
||||||
Log.n("Type {0} ({1})", info.Type, info.Name);
|
Logger.n("Type {0} ({1})", info.Type, info.Name);
|
||||||
foreach (var option in info.getOptions())
|
foreach (var option in info.getOptions())
|
||||||
printOption(option);
|
printOption(option);
|
||||||
Log.n("");
|
Logger.n("");
|
||||||
}
|
}
|
||||||
printInfos("String decrypter types", stringDecrypterTypes);
|
printInfos("String decrypter types", stringDecrypterTypes);
|
||||||
Log.n("");
|
Logger.n("");
|
||||||
Log.n("Multiple regexes can be used if separated by '{0}'.", NameRegexes.regexSeparatorChar);
|
Logger.n("Multiple regexes can be used if separated by '{0}'.", NameRegexes.regexSeparatorChar);
|
||||||
Log.n("Use '{0}' if you want to invert the regex. Example: {0}^[a-z\\d]{{1,2}}${1}{0}^[A-Z]_\\d+${1}^[\\w.]+$", NameRegex.invertChar, NameRegexes.regexSeparatorChar);
|
Logger.n("Use '{0}' if you want to invert the regex. Example: {0}^[a-z\\d]{{1,2}}${1}{0}^[A-Z]_\\d+${1}^[\\w.]+$", NameRegex.invertChar, NameRegexes.regexSeparatorChar);
|
||||||
Log.n("");
|
Logger.n("");
|
||||||
Log.n("Examples:");
|
Logger.n("Examples:");
|
||||||
Log.n("{0} -r c:\\my\\files -ro c:\\my\\output", progName);
|
Logger.n("{0} -r c:\\my\\files -ro c:\\my\\output", progName);
|
||||||
Log.n("{0} file1 file2 file3", progName);
|
Logger.n("{0} file1 file2 file3", progName);
|
||||||
Log.n("{0} file1 -f file2 -o file2.out -f file3 -o file3.out", progName);
|
Logger.n("{0} file1 -f file2 -o file2.out -f file3 -o file3.out", progName);
|
||||||
Log.n("{0} file1 --strtyp delegate --strtok 06000123", progName);
|
Logger.n("{0} file1 --strtyp delegate --strtok 06000123", progName);
|
||||||
}
|
}
|
||||||
|
|
||||||
string getProgramBaseName() {
|
string getProgramBaseName() {
|
||||||
|
@ -321,7 +322,7 @@ namespace de4dot.cui {
|
||||||
}
|
}
|
||||||
|
|
||||||
void printInfos(string desc, Infos infos) {
|
void printInfos(string desc, Infos infos) {
|
||||||
Log.n("{0}", desc);
|
Logger.n("{0}", desc);
|
||||||
foreach (var info in infos.getInfos())
|
foreach (var info in infos.getInfos())
|
||||||
printOptionAndExplanation(info.name, info.desc);
|
printOptionAndExplanation(info.name, info.desc);
|
||||||
}
|
}
|
||||||
|
@ -342,11 +343,11 @@ namespace de4dot.cui {
|
||||||
const string prefix = " ";
|
const string prefix = " ";
|
||||||
string left = string.Format(string.Format("{{0,-{0}}}", maxCols), option);
|
string left = string.Format(string.Format("{{0,-{0}}}", maxCols), option);
|
||||||
if (option.Length > maxCols) {
|
if (option.Length > maxCols) {
|
||||||
Log.n("{0}{1}", prefix, left);
|
Logger.n("{0}{1}", prefix, left);
|
||||||
Log.n("{0}{1} {2}", prefix, new string(' ', maxCols), explanation);
|
Logger.n("{0}{1} {2}", prefix, new string(' ', maxCols), explanation);
|
||||||
}
|
}
|
||||||
else
|
else
|
||||||
Log.n("{0}{1} {2}", prefix, left, explanation);
|
Logger.n("{0}{1} {2}", prefix, left, explanation);
|
||||||
}
|
}
|
||||||
|
|
||||||
string getOptionAndArgName(Option option, string optionName) {
|
string getOptionAndArgName(Option option, string optionName) {
|
||||||
|
|
|
@ -91,7 +91,7 @@ namespace de4dot.cui {
|
||||||
|
|
||||||
void deobfuscateOneAtATime() {
|
void deobfuscateOneAtATime() {
|
||||||
foreach (var file in loadAllFiles()) {
|
foreach (var file in loadAllFiles()) {
|
||||||
int oldIndentLevel = Log.indentLevel;
|
int oldIndentLevel = Logger.Instance.IndentLevel;
|
||||||
try {
|
try {
|
||||||
file.deobfuscateBegin();
|
file.deobfuscateBegin();
|
||||||
file.deobfuscate();
|
file.deobfuscate();
|
||||||
|
@ -104,12 +104,12 @@ namespace de4dot.cui {
|
||||||
deobfuscatorContext.clear();
|
deobfuscatorContext.clear();
|
||||||
}
|
}
|
||||||
catch (Exception ex) {
|
catch (Exception ex) {
|
||||||
Log.w("Could not deobfuscate {0}. Use -v to see stack trace", file.Filename);
|
Logger.Instance.Log(false, null, LoggerEvent.Warning, "Could not deobfuscate {0}. Use -v to see stack trace", file.Filename);
|
||||||
Program.printStackTrace(ex, Log.LogLevel.verbose);
|
Program.printStackTrace(ex, LoggerEvent.Verbose);
|
||||||
}
|
}
|
||||||
finally {
|
finally {
|
||||||
file.deobfuscateCleanUp();
|
file.deobfuscateCleanUp();
|
||||||
Log.indentLevel = oldIndentLevel;
|
Logger.Instance.IndentLevel = oldIndentLevel;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
@ -182,12 +182,12 @@ namespace de4dot.cui {
|
||||||
bool add(IObfuscatedFile file, bool skipUnknownObfuscator, bool isFromPossibleFiles) {
|
bool add(IObfuscatedFile file, bool skipUnknownObfuscator, bool isFromPossibleFiles) {
|
||||||
var key = Utils.getFullPath(file.Filename);
|
var key = Utils.getFullPath(file.Filename);
|
||||||
if (allFiles.ContainsKey(key)) {
|
if (allFiles.ContainsKey(key)) {
|
||||||
Log.w("Ingoring duplicate file: {0}", file.Filename);
|
Logger.Instance.Log(false, null, LoggerEvent.Warning, "Ingoring duplicate file: {0}", file.Filename);
|
||||||
return false;
|
return false;
|
||||||
}
|
}
|
||||||
allFiles[key] = true;
|
allFiles[key] = true;
|
||||||
|
|
||||||
int oldIndentLevel = Log.indentLevel;
|
int oldIndentLevel = Logger.Instance.IndentLevel;
|
||||||
try {
|
try {
|
||||||
file.DeobfuscatorContext = options.DeobfuscatorContext;
|
file.DeobfuscatorContext = options.DeobfuscatorContext;
|
||||||
file.load(options.CreateDeobfuscators());
|
file.load(options.CreateDeobfuscators());
|
||||||
|
@ -197,28 +197,28 @@ namespace de4dot.cui {
|
||||||
}
|
}
|
||||||
catch (BadImageFormatException) {
|
catch (BadImageFormatException) {
|
||||||
if (isFromPossibleFiles)
|
if (isFromPossibleFiles)
|
||||||
Log.w("The file isn't a .NET PE file: {0}", file.Filename);
|
Logger.Instance.Log(false, null, LoggerEvent.Warning, "The file isn't a .NET PE file: {0}", file.Filename);
|
||||||
return false; // Not a .NET file
|
return false; // Not a .NET file
|
||||||
}
|
}
|
||||||
catch (EndOfStreamException) {
|
catch (EndOfStreamException) {
|
||||||
return false;
|
return false;
|
||||||
}
|
}
|
||||||
catch (Exception ex) {
|
catch (Exception ex) {
|
||||||
Log.w("Could not load file ({0}): {1}", ex.GetType(), file.Filename);
|
Logger.Instance.Log(false, null, LoggerEvent.Warning, "Could not load file ({0}): {1}", ex.GetType(), file.Filename);
|
||||||
return false;
|
return false;
|
||||||
}
|
}
|
||||||
finally {
|
finally {
|
||||||
Log.indentLevel = oldIndentLevel;
|
Logger.Instance.IndentLevel = oldIndentLevel;
|
||||||
}
|
}
|
||||||
|
|
||||||
var deob = file.Deobfuscator;
|
var deob = file.Deobfuscator;
|
||||||
if (skipUnknownObfuscator && deob.Type == "un") {
|
if (skipUnknownObfuscator && deob.Type == "un") {
|
||||||
Log.v("Skipping unknown obfuscator: {0}", file.Filename);
|
Logger.v("Skipping unknown obfuscator: {0}", file.Filename);
|
||||||
removeModule(file.ModuleDefMD);
|
removeModule(file.ModuleDefMD);
|
||||||
return false;
|
return false;
|
||||||
}
|
}
|
||||||
else {
|
else {
|
||||||
Log.n("Detected {0} ({1})", deob.Name, file.Filename);
|
Logger.n("Detected {0} ({1})", deob.Name, file.Filename);
|
||||||
if (options.CreateDestinationDir)
|
if (options.CreateDestinationDir)
|
||||||
createDirectories(Path.GetDirectoryName(file.NewFilename));
|
createDirectories(Path.GetDirectoryName(file.NewFilename));
|
||||||
return true;
|
return true;
|
||||||
|
|
|
@ -20,6 +20,7 @@
|
||||||
using System;
|
using System;
|
||||||
using System.Collections.Generic;
|
using System.Collections.Generic;
|
||||||
using System.Text;
|
using System.Text;
|
||||||
|
using dot10.DotNet;
|
||||||
using de4dot.code;
|
using de4dot.code;
|
||||||
using de4dot.code.deobfuscators;
|
using de4dot.code.deobfuscators;
|
||||||
|
|
||||||
|
@ -67,14 +68,17 @@ namespace de4dot.cui {
|
||||||
public static int main(string[] args) {
|
public static int main(string[] args) {
|
||||||
int exitCode = 0;
|
int exitCode = 0;
|
||||||
|
|
||||||
|
const string showAllMessagesEnvName = "SHOWALLMESSAGES";
|
||||||
try {
|
try {
|
||||||
if (Console.OutputEncoding.IsSingleByte)
|
if (Console.OutputEncoding.IsSingleByte)
|
||||||
Console.OutputEncoding = new UTF8Encoding(false);
|
Console.OutputEncoding = new UTF8Encoding(false);
|
||||||
|
|
||||||
Log.n("");
|
Logger.Instance.CanIgnoreMessages = !hasEnv(showAllMessagesEnvName);
|
||||||
Log.n("de4dot v{0} Copyright (C) 2011-2012 de4dot@gmail.com", System.Reflection.Assembly.GetExecutingAssembly().GetName().Version);
|
|
||||||
Log.n("Latest version and source code: https://github.com/0xd4d/de4dot");
|
Logger.n("");
|
||||||
Log.n("");
|
Logger.n("de4dot v{0} Copyright (C) 2011-2012 de4dot@gmail.com", System.Reflection.Assembly.GetExecutingAssembly().GetName().Version);
|
||||||
|
Logger.n("Latest version and source code: https://github.com/0xd4d/de4dot");
|
||||||
|
Logger.n("");
|
||||||
|
|
||||||
var options = new FilesDeobfuscator.Options();
|
var options = new FilesDeobfuscator.Options();
|
||||||
parseCommandLine(args, options);
|
parseCommandLine(args, options);
|
||||||
|
@ -84,26 +88,31 @@ namespace de4dot.cui {
|
||||||
exitCode = ex.code;
|
exitCode = ex.code;
|
||||||
}
|
}
|
||||||
catch (UserException ex) {
|
catch (UserException ex) {
|
||||||
Log.e("ERROR: {0}", ex.Message);
|
Logger.Instance.Log(false, null, LoggerEvent.Error, "ERROR: {0}", ex.Message);
|
||||||
exitCode = 1;
|
exitCode = 1;
|
||||||
}
|
}
|
||||||
catch (Exception ex) {
|
catch (Exception ex) {
|
||||||
if (printFullStackTrace()) {
|
if (printFullStackTrace()) {
|
||||||
printStackTrace(ex);
|
printStackTrace(ex);
|
||||||
Log.e("\nTry the latest version before reporting this problem!");
|
Logger.Instance.Log(false, null, LoggerEvent.Error, "\nTry the latest version before reporting this problem!");
|
||||||
Log.e("Send bug reports to de4dot@gmail.com or go to https://github.com/0xd4d/de4dot/issues");
|
Logger.Instance.Log(false, null, LoggerEvent.Error, "Send bug reports to de4dot@gmail.com or go to https://github.com/0xd4d/de4dot/issues");
|
||||||
}
|
}
|
||||||
else {
|
else {
|
||||||
Log.e("\n\n");
|
Logger.Instance.Log(false, null, LoggerEvent.Error, "\n\n");
|
||||||
Log.e("Hmmmm... something didn't work. Try the latest version.");
|
Logger.Instance.Log(false, null, LoggerEvent.Error, "Hmmmm... something didn't work. Try the latest version.");
|
||||||
Log.e(" EX: {0} : message: {1}", ex.GetType(), ex.Message);
|
Logger.Instance.Log(false, null, LoggerEvent.Error, " EX: {0} : message: {1}", ex.GetType(), ex.Message);
|
||||||
Log.e("If it's a supported obfuscator, it could be a bug or a new obfuscator version.");
|
Logger.Instance.Log(false, null, LoggerEvent.Error, "If it's a supported obfuscator, it could be a bug or a new obfuscator version.");
|
||||||
Log.e("If it's an unsupported obfuscator, make sure the methods are decrypted!");
|
Logger.Instance.Log(false, null, LoggerEvent.Error, "If it's an unsupported obfuscator, make sure the methods are decrypted!");
|
||||||
Log.e("Send bug reports to de4dot@gmail.com or go to https://github.com/0xd4d/de4dot/issues");
|
Logger.Instance.Log(false, null, LoggerEvent.Error, "Send bug reports to de4dot@gmail.com or go to https://github.com/0xd4d/de4dot/issues");
|
||||||
}
|
}
|
||||||
exitCode = 1;
|
exitCode = 1;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
if (Logger.Instance.NumIgnoredMessages > 0) {
|
||||||
|
Logger.n("Ignored {0} warnings/errors", Logger.Instance.NumIgnoredMessages);
|
||||||
|
Logger.n("Set environment variable {0}=1 to see all messages", showAllMessagesEnvName);
|
||||||
|
}
|
||||||
|
|
||||||
if (isN00bUser()) {
|
if (isN00bUser()) {
|
||||||
Console.Error.WriteLine("\n\nPress any key to exit...\n");
|
Console.Error.WriteLine("\n\nPress any key to exit...\n");
|
||||||
try {
|
try {
|
||||||
|
@ -117,7 +126,7 @@ namespace de4dot.cui {
|
||||||
}
|
}
|
||||||
|
|
||||||
static bool printFullStackTrace() {
|
static bool printFullStackTrace() {
|
||||||
if (Log.isAtLeast(Log.LogLevel.verbose))
|
if (!Logger.Instance.IgnoresEvent(LoggerEvent.Verbose))
|
||||||
return true;
|
return true;
|
||||||
if (hasEnv("STACKTRACE"))
|
if (hasEnv("STACKTRACE"))
|
||||||
return true;
|
return true;
|
||||||
|
@ -143,31 +152,31 @@ namespace de4dot.cui {
|
||||||
}
|
}
|
||||||
|
|
||||||
public static void printStackTrace(Exception ex) {
|
public static void printStackTrace(Exception ex) {
|
||||||
printStackTrace(ex, Log.LogLevel.error);
|
printStackTrace(ex, LoggerEvent.Error);
|
||||||
}
|
}
|
||||||
|
|
||||||
public static void printStackTrace(Exception ex, Log.LogLevel logLevel) {
|
public static void printStackTrace(Exception ex, LoggerEvent loggerEvent) {
|
||||||
var line = new string('-', 78);
|
var line = new string('-', 78);
|
||||||
Log.log(logLevel, "\n\n");
|
Logger.Instance.Log(false, null, loggerEvent, "\n\n");
|
||||||
Log.log(logLevel, line);
|
Logger.Instance.Log(false, null, loggerEvent, line);
|
||||||
Log.log(logLevel, "Stack trace:\n{0}", ex.StackTrace);
|
Logger.Instance.Log(false, null, loggerEvent, "Stack trace:\n{0}", ex.StackTrace);
|
||||||
Log.log(logLevel, "\n\nERROR: Caught an exception:\n");
|
Logger.Instance.Log(false, null, loggerEvent, "\n\nERROR: Caught an exception:\n");
|
||||||
Log.log(logLevel, line);
|
Logger.Instance.Log(false, null, loggerEvent, line);
|
||||||
Log.log(logLevel, "Message:");
|
Logger.Instance.Log(false, null, loggerEvent, "Message:");
|
||||||
Log.log(logLevel, " {0}", ex.Message);
|
Logger.Instance.Log(false, null, loggerEvent, " {0}", ex.Message);
|
||||||
Log.log(logLevel, "Type:");
|
Logger.Instance.Log(false, null, loggerEvent, "Type:");
|
||||||
Log.log(logLevel, " {0}", ex.GetType());
|
Logger.Instance.Log(false, null, loggerEvent, " {0}", ex.GetType());
|
||||||
Log.log(logLevel, line);
|
Logger.Instance.Log(false, null, loggerEvent, line);
|
||||||
}
|
}
|
||||||
|
|
||||||
static void parseCommandLine(string[] args, FilesDeobfuscator.Options options) {
|
static void parseCommandLine(string[] args, FilesDeobfuscator.Options options) {
|
||||||
new CommandLineParser(deobfuscatorInfos, options).parse(args);
|
new CommandLineParser(deobfuscatorInfos, options).parse(args);
|
||||||
|
|
||||||
Log.vv("Args:");
|
Logger.vv("Args:");
|
||||||
Log.indent();
|
Logger.Instance.indent();
|
||||||
foreach (var arg in args)
|
foreach (var arg in args)
|
||||||
Log.vv("{0}", Utils.toCsharpString(arg));
|
Logger.vv("{0}", Utils.toCsharpString(arg));
|
||||||
Log.deIndent();
|
Logger.Instance.deIndent();
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
2
dot10
2
dot10
|
@ -1 +1 @@
|
||||||
Subproject commit b7407502ce4ed0ca05e445d12b5b003d95de2e03
|
Subproject commit ea0f778fdbfc57fc95f328c60d6406b2f1995b77
|
Loading…
Reference in New Issue
Block a user