From b33c2834dff4fae354841255b9d6f773d1c3740e Mon Sep 17 00:00:00 2001 From: de4dot Date: Mon, 30 Jul 2012 09:13:17 +0200 Subject: [PATCH] Don't deobfuscate cflow unless the method sig is void name() --- de4dot.code/deobfuscators/Confuser/AntiDebugger.cs | 2 ++ de4dot.code/deobfuscators/Confuser/AntiDumping.cs | 2 ++ 2 files changed, 4 insertions(+) diff --git a/de4dot.code/deobfuscators/Confuser/AntiDebugger.cs b/de4dot.code/deobfuscators/Confuser/AntiDebugger.cs index b9662f9c..ce067efa 100644 --- a/de4dot.code/deobfuscators/Confuser/AntiDebugger.cs +++ b/de4dot.code/deobfuscators/Confuser/AntiDebugger.cs @@ -57,6 +57,8 @@ namespace de4dot.code.deobfuscators.Confuser { var calledMethod = instr.Operand as MethodDefinition; if (calledMethod == null) continue; + if (!DotNetUtils.isMethod(calledMethod, "System.Void", "()")) + continue; if (checkInitMethod(calledMethod)) { initMethod = calledMethod; diff --git a/de4dot.code/deobfuscators/Confuser/AntiDumping.cs b/de4dot.code/deobfuscators/Confuser/AntiDumping.cs index d75602cc..fcccf25f 100644 --- a/de4dot.code/deobfuscators/Confuser/AntiDumping.cs +++ b/de4dot.code/deobfuscators/Confuser/AntiDumping.cs @@ -57,6 +57,8 @@ namespace de4dot.code.deobfuscators.Confuser { var calledMethod = instr.Operand as MethodDefinition; if (calledMethod == null) continue; + if (!DotNetUtils.isMethod(calledMethod, "System.Void", "()")) + continue; simpleDeobfuscator.deobfuscate(calledMethod, true); if (checkInitMethod(calledMethod)) {