Update code for GO 5.6.0

de4dot.code/deobfuscators/Goliath_NET/ArrayDecrypter.cs

@@ -27,11 +27,12 @@ namespace de4dot.code.deobfuscators.Goliath_NET {
 			: base(module) {
 		}
 
-		protected override string[] getRequiredFieldTypes() {
+		static string[] requiredFields = new string[] {
-			return new string[] {
+			"System.Byte[]",
-				"System.Byte[]",
+			"System.Collections.Generic.Dictionary`2<System.Int32,System.Byte[]>",
-				"System.Collections.Generic.Dictionary`2<System.Int32,System.Byte[]>",
+		};
-			};
+		protected override bool checkDecrypterType(TypeDefinition type) {
+			return new FieldTypes(type).exactly(requiredFields);
 		}
 
 		protected override bool checkDelegateInvokeMethod(MethodDefinition invokeMethod) {

de4dot.code/deobfuscators/Goliath_NET/DecrypterBase.cs

@@ -26,7 +26,7 @@ using de4dot.blocks;
 
 namespace de4dot.code.deobfuscators.Goliath_NET {
 	abstract class DecrypterBase {
-		ModuleDefinition module;
+		protected ModuleDefinition module;
 		EmbeddedResource encryptedResource;
 		TypeDefinition decrypterType;
 		TypeDefinition delegateType;
@@ -88,11 +88,7 @@ namespace de4dot.code.deobfuscators.Goliath_NET {
 			return info;
 		}
 
-		protected abstract string[] getRequiredFieldTypes();
-
 		public void find() {
-			var requiredFields = getRequiredFieldTypes();
-
 			foreach (var tmp in module.Resources) {
 				var resource = tmp as EmbeddedResource;
 				if (resource == null)
@@ -105,7 +101,7 @@ namespace de4dot.code.deobfuscators.Goliath_NET {
 				var type = DotNetUtils.getType(module, typeRef);
 				if (type == null)
 					continue;
-				if (!new FieldTypes(type).exactly(requiredFields))
+				if (!checkDecrypterType(type))
 					continue;
 
 				encryptedResource = resource;
@@ -114,6 +110,8 @@ namespace de4dot.code.deobfuscators.Goliath_NET {
 			}
 		}
 
+		protected abstract bool checkDecrypterType(TypeDefinition type);
+
 		void splitTypeName(string fullName, out string ns, out string name) {
 			int index = fullName.LastIndexOf('.');
 			if (index < 0) {

de4dot.code/deobfuscators/Goliath_NET/Deobfuscator.cs

@@ -223,6 +223,7 @@ namespace de4dot.code.deobfuscators.Goliath_NET {
 		}
 
 		public override void deobfuscateMethodEnd(Blocks blocks) {
+			stringDecrypter.deobfuscate(blocks);
 			if (integerValueInliner.HasHandlers)
 				integerValueInliner.decrypt(blocks);
 			if (arrayValueInliner.HasHandlers)
@@ -242,8 +243,10 @@ namespace de4dot.code.deobfuscators.Goliath_NET {
 			removeInlinedMethods();
 			addTypesToBeRemoved(localsRestorer.Types, "Method locals obfuscation type");
 
-			if (Operations.DecryptStrings != OpDecryptString.None)
+			if (Operations.DecryptStrings != OpDecryptString.None) {
 				removeDecrypterStuff(stringDecrypter, "String", "strings");
+				addTypeToBeRemoved(stringDecrypter.StringStruct, "String struct");
+			}
 			if (options.DecryptIntegers)
 				removeDecrypterStuff(integerDecrypter, "Integer", "integers");
 			if (options.DecryptArrays)

de4dot.code/deobfuscators/Goliath_NET/IntegerDecrypter.cs

@@ -27,11 +27,12 @@ namespace de4dot.code.deobfuscators.Goliath_NET {
 			: base(module) {
 		}
 
-		protected override string[] getRequiredFieldTypes() {
+		static string[] requiredFields = new string[] {
-			return new string[] {
+			"System.Byte[]",
-				"System.Byte[]",
+			"System.Collections.Generic.Dictionary`2<System.Int32,System.Object>",
-				"System.Collections.Generic.Dictionary`2<System.Int32,System.Object>",
+		};
-			};
+		protected override bool checkDecrypterType(TypeDefinition type) {
+			return new FieldTypes(type).exactly(requiredFields);
 		}
 
 		protected override bool checkDelegateInvokeMethod(MethodDefinition invokeMethod) {

de4dot.code/deobfuscators/Goliath_NET/StringDecrypter.cs

@@ -20,23 +20,68 @@
 using System;
 using System.Text;
 using Mono.Cecil;
+using Mono.Cecil.Cil;
 using de4dot.blocks;
 
 namespace de4dot.code.deobfuscators.Goliath_NET {
 	class StringDecrypter : DecrypterBase {
+		TypeReference delegateReturnType;
+		FieldDefinition stringStructField;
+
+		public TypeDefinition StringStruct {
+			get { return Detected && stringStructField != null ? stringStructField.DeclaringType : null; }
+		}
+
 		public StringDecrypter(ModuleDefinition module)
 			: base(module) {
 		}
 
-		protected override string[] getRequiredFieldTypes() {
+		static string[] requiredFields = new string[] {
-			return new string[] {
 				"System.Byte[]",
 				"System.Collections.Generic.Dictionary`2<System.Int32,System.String>",
-			};
+		};
+		protected override bool checkDecrypterType(TypeDefinition type) {
+			var fields = type.Fields;
+			if (fields.Count != 2)
+				return false;
+
+			if (fields[0].FieldType.FullName != "System.Byte[]")
+				return false;
+
+			var dict = fields[1].FieldType as GenericInstanceType;
+			if (dict == null || dict.GenericArguments.Count != 2)
+				return false;
+			if (dict.ElementType.FullName != "System.Collections.Generic.Dictionary`2")
+				return false;
+
+			if (dict.GenericArguments[0].FullName != "System.Int32")
+				return false;
+
+			var garg = dict.GenericArguments[1];
+			if (garg.FullName != "System.String") {
+				if (!garg.IsValueType)
+					return false;
+				var gargType = DotNetUtils.getType(module, garg);
+				if (gargType == null || !gargType.IsClass)
+					return false;
+				if (gargType.Fields.Count != 1)
+					return false;
+				var field = gargType.Fields[0];
+				if (field.FieldType.FullName != "System.String")
+					return false;
+				delegateReturnType = gargType;
+				stringStructField = field;
+			}
+			else {
+				delegateReturnType = garg;
+				stringStructField = null;
+			}
+
+			return true;
 		}
 
 		protected override bool checkDelegateInvokeMethod(MethodDefinition invokeMethod) {
-			return DotNetUtils.isMethod(invokeMethod, "System.String", "(System.Int32)");
+			return DotNetUtils.isMethod(invokeMethod, delegateReturnType.FullName, "(System.Int32)");
 		}
 
 		public string decrypt(MethodDefinition method) {
@@ -45,5 +90,27 @@ namespace de4dot.code.deobfuscators.Goliath_NET {
 			int len = decryptedReader.ReadInt32();
 			return Encoding.UTF8.GetString(decryptedReader.ReadBytes(len));
 		}
+
+		public void deobfuscate(Blocks blocks) {
+			if (!Detected)
+				return;
+			if (stringStructField == null)
+				return;
+
+			foreach (var block in blocks.MethodBlocks.getAllBlocks()) {
+				var instrs = block.Instructions;
+				for (int i = 0; i < instrs.Count - 1; i++) {
+					var ldstr = instrs[i];
+					if (ldstr.OpCode.Code != Code.Ldstr)
+						continue;
+					var ldfld = instrs[i + 1];
+					if (ldfld.OpCode.Code != Code.Ldfld)
+						continue;
+					if (!MemberReferenceHelper.compareFieldReferenceAndDeclaringType(stringStructField, ldfld.Operand as FieldReference))
+						continue;
+					block.remove(i + 1, 1);
+				}
+			}
+		}
 	}
 }