Update DNR methods decrypter code
This commit is contained in:
parent
040410d7ce
commit
b57c93eae4
|
@ -58,7 +58,7 @@ namespace de4dot.deobfuscators.dotNET_Reactor {
|
||||||
var additionalTypes = new string[] {
|
var additionalTypes = new string[] {
|
||||||
// "System.Diagnostics.StackFrame", //TODO: Not in DNR <= 3.7.0.3
|
// "System.Diagnostics.StackFrame", //TODO: Not in DNR <= 3.7.0.3
|
||||||
"System.IntPtr",
|
"System.IntPtr",
|
||||||
"System.Reflection.Assembly",
|
// "System.Reflection.Assembly", //TODO: Not in unknown DNR version with jitter support
|
||||||
};
|
};
|
||||||
var checkedMethods = new Dictionary<MethodReferenceAndDeclaringTypeKey, bool>();
|
var checkedMethods = new Dictionary<MethodReferenceAndDeclaringTypeKey, bool>();
|
||||||
var callCounter = new CallCounter();
|
var callCounter = new CallCounter();
|
||||||
|
@ -100,6 +100,9 @@ namespace de4dot.deobfuscators.dotNET_Reactor {
|
||||||
initXorKey();
|
initXorKey();
|
||||||
var methodsData = encryptedResource.decrypt();
|
var methodsData = encryptedResource.decrypt();
|
||||||
|
|
||||||
|
ArrayFinder arrayFinder = new ArrayFinder(encryptedResource.ResourceDecrypterMethod);
|
||||||
|
bool hasJitter = arrayFinder.exists(new byte[] { (byte)'g', (byte)'e', (byte)'t', (byte)'J', (byte)'i', (byte)'t' });
|
||||||
|
|
||||||
if (useXorKey) {
|
if (useXorKey) {
|
||||||
var stream = new MemoryStream(methodsData);
|
var stream = new MemoryStream(methodsData);
|
||||||
var reader = new BinaryReader(stream);
|
var reader = new BinaryReader(stream);
|
||||||
|
@ -132,7 +135,7 @@ namespace de4dot.deobfuscators.dotNET_Reactor {
|
||||||
patchDwords(peImage, methodsDataReader, numDwords / 2);
|
patchDwords(peImage, methodsDataReader, numDwords / 2);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
else if (!useXorKey || mode == 1) {
|
else if (!hasJitter || mode == 1) {
|
||||||
// DNR 3.9.8.0, 4.0, 4.1, 4.2, 4.3, 4.4
|
// DNR 3.9.8.0, 4.0, 4.1, 4.2, 4.3, 4.4
|
||||||
patchDwords(peImage, methodsDataReader, patchCount);
|
patchDwords(peImage, methodsDataReader, patchCount);
|
||||||
while (methodsDataReader.BaseStream.Position < methodsData.Length - 1) {
|
while (methodsDataReader.BaseStream.Position < methodsData.Length - 1) {
|
||||||
|
|
Loading…
Reference in New Issue
Block a user