monocul.us/de4dot-cex
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Detect ILP

Browse Source
This commit is contained in:
de4dot 2012-06-02 19:48:23 +02:00
parent bff92e02e7
commit b844dbc428
1 changed files with 25 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
de4dot.code/deobfuscators/Unknown/Deobfuscator.cs
View File

@ -19,6 +19,7 @@
using System.Collections.Generic;
using System.Text.RegularExpressions;
using de4dot.blocks;
namespace de4dot.code.deobfuscators.Unknown {
public class DeobfuscatorInfo : DeobfuscatorInfoBase {
@ -72,7 +73,7 @@ namespace de4dot.code.deobfuscators.Unknown {
void setName(string name) {
if (obfuscatorName == null && name != null)
obfuscatorName = name;
obfuscatorName = string.Format("{0} (not supported)", name);
}
public override int earlyDetect() {
@ -97,6 +98,8 @@ namespace de4dot.code.deobfuscators.Unknown {
}
string scanTypes() {
if (checkILProtector())
return "ILProtector";
foreach (var type in module.Types) {
if (type.FullName == "ZYXDNGuarder")
return "DNGuard HVM";
@ -110,6 +113,27 @@ namespace de4dot.code.deobfuscators.Unknown {
return null;
}
static string[] ilpLocals = new string[] {
"System.Boolean",
"System.IntPtr",
"System.Object[]",
};
bool checkILProtector() {
var cctor = DotNetUtils.getModuleTypeCctor(module);
if (cctor == null)
return false;
if (!new LocalTypes(cctor).exactly(ilpLocals))
return false;
var type = cctor.DeclaringType;
if (!DotNetUtils.hasPinvokeMethod(type, "Protect") && !DotNetUtils.hasPinvokeMethod(type, "P0"))
return false;
if (type.Fields.Count != 1)
return false;
return true;
}
public override IEnumerable<int> getStringDecrypterMethods() {
return new List<int>();
}