Update code for GO 5.6.0
This commit is contained in:
parent
b23c35e049
commit
ba43220da2
|
@ -27,11 +27,12 @@ namespace de4dot.code.deobfuscators.Goliath_NET {
|
|||
: base(module) {
|
||||
}
|
||||
|
||||
protected override string[] getRequiredFieldTypes() {
|
||||
return new string[] {
|
||||
"System.Byte[]",
|
||||
"System.Collections.Generic.Dictionary`2<System.Int32,System.Byte[]>",
|
||||
};
|
||||
static string[] requiredFields = new string[] {
|
||||
"System.Byte[]",
|
||||
"System.Collections.Generic.Dictionary`2<System.Int32,System.Byte[]>",
|
||||
};
|
||||
protected override bool checkDecrypterType(TypeDefinition type) {
|
||||
return new FieldTypes(type).exactly(requiredFields);
|
||||
}
|
||||
|
||||
protected override bool checkDelegateInvokeMethod(MethodDefinition invokeMethod) {
|
||||
|
|
|
@ -26,7 +26,7 @@ using de4dot.blocks;
|
|||
|
||||
namespace de4dot.code.deobfuscators.Goliath_NET {
|
||||
abstract class DecrypterBase {
|
||||
ModuleDefinition module;
|
||||
protected ModuleDefinition module;
|
||||
EmbeddedResource encryptedResource;
|
||||
TypeDefinition decrypterType;
|
||||
TypeDefinition delegateType;
|
||||
|
@ -88,11 +88,7 @@ namespace de4dot.code.deobfuscators.Goliath_NET {
|
|||
return info;
|
||||
}
|
||||
|
||||
protected abstract string[] getRequiredFieldTypes();
|
||||
|
||||
public void find() {
|
||||
var requiredFields = getRequiredFieldTypes();
|
||||
|
||||
foreach (var tmp in module.Resources) {
|
||||
var resource = tmp as EmbeddedResource;
|
||||
if (resource == null)
|
||||
|
@ -105,7 +101,7 @@ namespace de4dot.code.deobfuscators.Goliath_NET {
|
|||
var type = DotNetUtils.getType(module, typeRef);
|
||||
if (type == null)
|
||||
continue;
|
||||
if (!new FieldTypes(type).exactly(requiredFields))
|
||||
if (!checkDecrypterType(type))
|
||||
continue;
|
||||
|
||||
encryptedResource = resource;
|
||||
|
@ -114,6 +110,8 @@ namespace de4dot.code.deobfuscators.Goliath_NET {
|
|||
}
|
||||
}
|
||||
|
||||
protected abstract bool checkDecrypterType(TypeDefinition type);
|
||||
|
||||
void splitTypeName(string fullName, out string ns, out string name) {
|
||||
int index = fullName.LastIndexOf('.');
|
||||
if (index < 0) {
|
||||
|
|
|
@ -223,6 +223,7 @@ namespace de4dot.code.deobfuscators.Goliath_NET {
|
|||
}
|
||||
|
||||
public override void deobfuscateMethodEnd(Blocks blocks) {
|
||||
stringDecrypter.deobfuscate(blocks);
|
||||
if (integerValueInliner.HasHandlers)
|
||||
integerValueInliner.decrypt(blocks);
|
||||
if (arrayValueInliner.HasHandlers)
|
||||
|
@ -242,8 +243,10 @@ namespace de4dot.code.deobfuscators.Goliath_NET {
|
|||
removeInlinedMethods();
|
||||
addTypesToBeRemoved(localsRestorer.Types, "Method locals obfuscation type");
|
||||
|
||||
if (Operations.DecryptStrings != OpDecryptString.None)
|
||||
if (Operations.DecryptStrings != OpDecryptString.None) {
|
||||
removeDecrypterStuff(stringDecrypter, "String", "strings");
|
||||
addTypeToBeRemoved(stringDecrypter.StringStruct, "String struct");
|
||||
}
|
||||
if (options.DecryptIntegers)
|
||||
removeDecrypterStuff(integerDecrypter, "Integer", "integers");
|
||||
if (options.DecryptArrays)
|
||||
|
|
|
@ -27,11 +27,12 @@ namespace de4dot.code.deobfuscators.Goliath_NET {
|
|||
: base(module) {
|
||||
}
|
||||
|
||||
protected override string[] getRequiredFieldTypes() {
|
||||
return new string[] {
|
||||
"System.Byte[]",
|
||||
"System.Collections.Generic.Dictionary`2<System.Int32,System.Object>",
|
||||
};
|
||||
static string[] requiredFields = new string[] {
|
||||
"System.Byte[]",
|
||||
"System.Collections.Generic.Dictionary`2<System.Int32,System.Object>",
|
||||
};
|
||||
protected override bool checkDecrypterType(TypeDefinition type) {
|
||||
return new FieldTypes(type).exactly(requiredFields);
|
||||
}
|
||||
|
||||
protected override bool checkDelegateInvokeMethod(MethodDefinition invokeMethod) {
|
||||
|
|
|
@ -20,23 +20,68 @@
|
|||
using System;
|
||||
using System.Text;
|
||||
using Mono.Cecil;
|
||||
using Mono.Cecil.Cil;
|
||||
using de4dot.blocks;
|
||||
|
||||
namespace de4dot.code.deobfuscators.Goliath_NET {
|
||||
class StringDecrypter : DecrypterBase {
|
||||
TypeReference delegateReturnType;
|
||||
FieldDefinition stringStructField;
|
||||
|
||||
public TypeDefinition StringStruct {
|
||||
get { return Detected && stringStructField != null ? stringStructField.DeclaringType : null; }
|
||||
}
|
||||
|
||||
public StringDecrypter(ModuleDefinition module)
|
||||
: base(module) {
|
||||
}
|
||||
|
||||
protected override string[] getRequiredFieldTypes() {
|
||||
return new string[] {
|
||||
static string[] requiredFields = new string[] {
|
||||
"System.Byte[]",
|
||||
"System.Collections.Generic.Dictionary`2<System.Int32,System.String>",
|
||||
};
|
||||
};
|
||||
protected override bool checkDecrypterType(TypeDefinition type) {
|
||||
var fields = type.Fields;
|
||||
if (fields.Count != 2)
|
||||
return false;
|
||||
|
||||
if (fields[0].FieldType.FullName != "System.Byte[]")
|
||||
return false;
|
||||
|
||||
var dict = fields[1].FieldType as GenericInstanceType;
|
||||
if (dict == null || dict.GenericArguments.Count != 2)
|
||||
return false;
|
||||
if (dict.ElementType.FullName != "System.Collections.Generic.Dictionary`2")
|
||||
return false;
|
||||
|
||||
if (dict.GenericArguments[0].FullName != "System.Int32")
|
||||
return false;
|
||||
|
||||
var garg = dict.GenericArguments[1];
|
||||
if (garg.FullName != "System.String") {
|
||||
if (!garg.IsValueType)
|
||||
return false;
|
||||
var gargType = DotNetUtils.getType(module, garg);
|
||||
if (gargType == null || !gargType.IsClass)
|
||||
return false;
|
||||
if (gargType.Fields.Count != 1)
|
||||
return false;
|
||||
var field = gargType.Fields[0];
|
||||
if (field.FieldType.FullName != "System.String")
|
||||
return false;
|
||||
delegateReturnType = gargType;
|
||||
stringStructField = field;
|
||||
}
|
||||
else {
|
||||
delegateReturnType = garg;
|
||||
stringStructField = null;
|
||||
}
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
protected override bool checkDelegateInvokeMethod(MethodDefinition invokeMethod) {
|
||||
return DotNetUtils.isMethod(invokeMethod, "System.String", "(System.Int32)");
|
||||
return DotNetUtils.isMethod(invokeMethod, delegateReturnType.FullName, "(System.Int32)");
|
||||
}
|
||||
|
||||
public string decrypt(MethodDefinition method) {
|
||||
|
@ -45,5 +90,27 @@ namespace de4dot.code.deobfuscators.Goliath_NET {
|
|||
int len = decryptedReader.ReadInt32();
|
||||
return Encoding.UTF8.GetString(decryptedReader.ReadBytes(len));
|
||||
}
|
||||
|
||||
public void deobfuscate(Blocks blocks) {
|
||||
if (!Detected)
|
||||
return;
|
||||
if (stringStructField == null)
|
||||
return;
|
||||
|
||||
foreach (var block in blocks.MethodBlocks.getAllBlocks()) {
|
||||
var instrs = block.Instructions;
|
||||
for (int i = 0; i < instrs.Count - 1; i++) {
|
||||
var ldstr = instrs[i];
|
||||
if (ldstr.OpCode.Code != Code.Ldstr)
|
||||
continue;
|
||||
var ldfld = instrs[i + 1];
|
||||
if (ldfld.OpCode.Code != Code.Ldfld)
|
||||
continue;
|
||||
if (!MemberReferenceHelper.compareFieldReferenceAndDeclaringType(stringStructField, ldfld.Operand as FieldReference))
|
||||
continue;
|
||||
block.remove(i + 1, 1);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
Loading…
Reference in New Issue
Block a user