Update detection code
This commit is contained in:
parent
417fe04bba
commit
b23c35e049
|
@ -92,11 +92,19 @@ namespace de4dot.code.deobfuscators.Goliath_NET {
|
||||||
|
|
||||||
public void find() {
|
public void find() {
|
||||||
var requiredFields = getRequiredFieldTypes();
|
var requiredFields = getRequiredFieldTypes();
|
||||||
foreach (var type in module.Types) {
|
|
||||||
var resourceName = type.FullName + ".resources";
|
foreach (var tmp in module.Resources) {
|
||||||
var resource = DotNetUtils.getResource(module, resourceName) as EmbeddedResource;
|
var resource = tmp as EmbeddedResource;
|
||||||
if (resource == null)
|
if (resource == null)
|
||||||
continue;
|
continue;
|
||||||
|
if (!resource.Name.EndsWith(".resources", StringComparison.Ordinal))
|
||||||
|
continue;
|
||||||
|
string ns, name;
|
||||||
|
splitTypeName(resource.Name.Substring(0, resource.Name.Length - 10), out ns, out name);
|
||||||
|
var typeRef = new TypeReference(ns, name, module, module);
|
||||||
|
var type = DotNetUtils.getType(module, typeRef);
|
||||||
|
if (type == null)
|
||||||
|
continue;
|
||||||
if (!new FieldTypes(type).exactly(requiredFields))
|
if (!new FieldTypes(type).exactly(requiredFields))
|
||||||
continue;
|
continue;
|
||||||
|
|
||||||
|
@ -106,6 +114,18 @@ namespace de4dot.code.deobfuscators.Goliath_NET {
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
void splitTypeName(string fullName, out string ns, out string name) {
|
||||||
|
int index = fullName.LastIndexOf('.');
|
||||||
|
if (index < 0) {
|
||||||
|
ns = "";
|
||||||
|
name = fullName;
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
ns = fullName.Substring(0, index);
|
||||||
|
name = fullName.Substring(index + 1);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
public void initialize() {
|
public void initialize() {
|
||||||
if (encryptedResource == null)
|
if (encryptedResource == null)
|
||||||
return;
|
return;
|
||||||
|
|
Loading…
Reference in New Issue
Block a user