monocul.us/de4dot-cex
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Update detection code

Browse Source
This commit is contained in:
de4dot 2012-01-01 18:50:46 +01:00
parent 417fe04bba
commit b23c35e049
1 changed files with 23 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
de4dot.code/deobfuscators/Goliath_NET/DecrypterBase.cs
View File

@ -92,11 +92,19 @@ namespace de4dot.code.deobfuscators.Goliath_NET {
public void find() {
var requiredFields = getRequiredFieldTypes();
foreach (var type in module.Types) {
var resourceName = type.FullName + ".resources";
var resource = DotNetUtils.getResource(module, resourceName) as EmbeddedResource;
foreach (var tmp in module.Resources) {
var resource = tmp as EmbeddedResource;
if (resource == null)
continue;
if (!resource.Name.EndsWith(".resources", StringComparison.Ordinal))
continue;
string ns, name;
splitTypeName(resource.Name.Substring(0, resource.Name.Length - 10), out ns, out name);
var typeRef = new TypeReference(ns, name, module, module);
var type = DotNetUtils.getType(module, typeRef);
if (type == null)
continue;
if (!new FieldTypes(type).exactly(requiredFields))
continue;
@ -106,6 +114,18 @@ namespace de4dot.code.deobfuscators.Goliath_NET {
}
}
void splitTypeName(string fullName, out string ns, out string name) {
int index = fullName.LastIndexOf('.');
if (index < 0) {
ns = "";
name = fullName;
}
else {
ns = fullName.Substring(0, index);
name = fullName.Substring(index + 1);
}
}
public void initialize() {
if (encryptedResource == null)
return;