diff --git a/de4dot.code/de4dot.code.csproj b/de4dot.code/de4dot.code.csproj index 38a9463e..187942ec 100644 --- a/de4dot.code/de4dot.code.csproj +++ b/de4dot.code/de4dot.code.csproj @@ -107,6 +107,7 @@ + diff --git a/de4dot.code/deobfuscators/InitializedDataCreator.cs b/de4dot.code/deobfuscators/InitializedDataCreator.cs new file mode 100644 index 00000000..ea619463 --- /dev/null +++ b/de4dot.code/deobfuscators/InitializedDataCreator.cs @@ -0,0 +1,81 @@ +/* + Copyright (C) 2011 de4dot@gmail.com + + This file is part of de4dot. + + de4dot is free software: you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation, either version 3 of the License, or + (at your option) any later version. + + de4dot is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with de4dot. If not, see . +*/ + +using System; +using System.Collections.Generic; +using Mono.Cecil; +using de4dot.blocks; + +namespace de4dot.code.deobfuscators { + class InitializedDataCreator { + ModuleDefinition module; + Dictionary sizeToArrayType = new Dictionary(); + TypeDefinition ourType; + TypeReference valueType; + int unique = 0; + + public InitializedDataCreator(ModuleDefinition module) { + this.module = module; + } + + void createOurType() { + if (ourType != null) + return; + + var attrs = TypeAttributes.NotPublic | TypeAttributes.AutoLayout | + TypeAttributes.Class | TypeAttributes.AnsiClass; + ourType = new TypeDefinition("", string.Format("{0}", Guid.NewGuid().ToString("B")), attrs, module.TypeSystem.Object); + ourType.MetadataToken = DotNetUtils.nextTypeDefToken(); + module.Types.Add(ourType); + } + + TypeDefinition getArrayType(long size) { + createOurType(); + + TypeDefinition arrayType; + if (sizeToArrayType.TryGetValue(size, out arrayType)) + return arrayType; + + if (valueType == null) + valueType = DotNetUtils.findOrCreateTypeReference(module, module.TypeSystem.Corlib as AssemblyNameReference, "System", "ValueType", false); + var attrs = TypeAttributes.NestedPrivate | TypeAttributes.ExplicitLayout | + TypeAttributes.Class | TypeAttributes.Sealed | TypeAttributes.AnsiClass; + arrayType = new TypeDefinition("", string.Format("__StaticArrayInitTypeSize={0}", size), attrs, valueType); + arrayType.MetadataToken = DotNetUtils.nextTypeDefToken(); + ourType.NestedTypes.Add(arrayType); + sizeToArrayType[size] = arrayType; + arrayType.ClassSize = (int)size; + arrayType.PackingSize = 1; + arrayType.IsValueType = true; + return arrayType; + } + + public FieldDefinition create(byte[] data) { + var arrayType = getArrayType(data.LongLength); + var attrs = FieldAttributes.Assembly | FieldAttributes.Static; + var field = new FieldDefinition(string.Format("field_{0}", unique++), attrs, arrayType); + field.MetadataToken = DotNetUtils.nextFieldToken(); + ourType.Fields.Add(field); + var iv = new byte[data.Length]; + Array.Copy(data, iv, data.Length); + field.InitialValue = iv; + return field; + } + } +}