From b23c35e04969afc9d76cb31e8f0fbbed18656fea Mon Sep 17 00:00:00 2001
From: de4dot <de4dot@gmail.com>
Date: Sun, 1 Jan 2012 18:50:46 +0100
Subject: [PATCH] Update detection code

---
 .../Goliath_NET/DecrypterBase.cs              | 26 ++++++++++++++++---
 1 file changed, 23 insertions(+), 3 deletions(-)

diff --git a/de4dot.code/deobfuscators/Goliath_NET/DecrypterBase.cs b/de4dot.code/deobfuscators/Goliath_NET/DecrypterBase.cs
index d009a9f8..a84d0a7b 100644
--- a/de4dot.code/deobfuscators/Goliath_NET/DecrypterBase.cs
+++ b/de4dot.code/deobfuscators/Goliath_NET/DecrypterBase.cs
@@ -92,11 +92,19 @@ namespace de4dot.code.deobfuscators.Goliath_NET {
 
 		public void find() {
 			var requiredFields = getRequiredFieldTypes();
-			foreach (var type in module.Types) {
-				var resourceName = type.FullName + ".resources";
-				var resource = DotNetUtils.getResource(module, resourceName) as EmbeddedResource;
+
+			foreach (var tmp in module.Resources) {
+				var resource = tmp as EmbeddedResource;
 				if (resource == null)
 					continue;
+				if (!resource.Name.EndsWith(".resources", StringComparison.Ordinal))
+					continue;
+				string ns, name;
+				splitTypeName(resource.Name.Substring(0, resource.Name.Length - 10), out ns, out name);
+				var typeRef = new TypeReference(ns, name, module, module);
+				var type = DotNetUtils.getType(module, typeRef);
+				if (type == null)
+					continue;
 				if (!new FieldTypes(type).exactly(requiredFields))
 					continue;
 
@@ -106,6 +114,18 @@ namespace de4dot.code.deobfuscators.Goliath_NET {
 			}
 		}
 
+		void splitTypeName(string fullName, out string ns, out string name) {
+			int index = fullName.LastIndexOf('.');
+			if (index < 0) {
+				ns = "";
+				name = fullName;
+			}
+			else {
+				ns = fullName.Substring(0, index);
+				name = fullName.Substring(index + 1);
+			}
+		}
+
 		public void initialize() {
 			if (encryptedResource == null)
 				return;