monocul.us/de4dot-cex
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add assembly string separator detection code

Browse Source
This commit is contained in:
de4dot 2013-09-24 21:44:21 +02:00
parent aabe7f0ad4
commit b7255bc3b5
1 changed files with 23 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
de4dot.code/deobfuscators/CryptoObfuscator/AssemblyResolver.cs
View File

@ -30,6 +30,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
TypeDef resolverType;
MethodDef resolverMethod;
List<AssemblyInfo> assemblyInfos = new List<AssemblyInfo>();
string asmSeparator;
public class AssemblyInfo {
public string assemblyName;
@ -86,6 +87,8 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
return false;
if (!CheckInitMethod(initMethod))
return false;
if ((asmSeparator = FindAssemblySeparator(initMethod)) == null)
return false;
List<AssemblyInfo> newAssemblyInfos = null;
foreach (var s in DotNetUtils.GetCodeStrings(initMethod)) {
@ -134,7 +137,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
var sb = new StringBuilder(s.Length);
foreach (var c in s)
sb.Append((char)~c);
var tmpAssemblyInfos = sb.ToString().Split(new string[] { "##" }, StringSplitOptions.RemoveEmptyEntries);
var tmpAssemblyInfos = sb.ToString().Split(new string[] { asmSeparator }, StringSplitOptions.RemoveEmptyEntries);
if (tmpAssemblyInfos.Length == 0 || (tmpAssemblyInfos.Length & 1) == 1)
return null;
@ -151,5 +154,24 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
return newAssemblyInfos;
}
string FindAssemblySeparator(MethodDef initMethod) {
if (!initMethod.HasBody)
return null;
foreach (var instr in initMethod.Body.Instructions) {
if (instr.OpCode.Code != Code.Newarr)
continue;
var op = module.CorLibTypes.GetCorLibTypeSig(instr.Operand as ITypeDefOrRef);
if (op == null)
continue;
if (op.ElementType == ElementType.String)
return "##";
if (op.ElementType == ElementType.Char)
return "`";
}
return null;
}
}
}