Remove resources with an invalid RVA
This commit is contained in:
parent
4b2da13972
commit
bb9e4cbf26
|
@ -276,9 +276,22 @@ namespace de4dot.code.deobfuscators.Confuser {
|
||||||
if (proxyCallFixerV1 != null)
|
if (proxyCallFixerV1 != null)
|
||||||
proxyCallFixerV1.find();
|
proxyCallFixerV1.find();
|
||||||
|
|
||||||
|
removeInvalidResources();
|
||||||
|
|
||||||
startedDeobfuscating = true;
|
startedDeobfuscating = true;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
void removeInvalidResources() {
|
||||||
|
foreach (var rsrc in module.Resources) {
|
||||||
|
var resource = rsrc as EmbeddedResource;
|
||||||
|
if (resource == null)
|
||||||
|
continue;
|
||||||
|
if (resource.Offset != 0xFFFFFFFF)
|
||||||
|
continue;
|
||||||
|
addResourceToBeRemoved(resource, "Invalid resource");
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
bool hasInitializedStringDecrypter = false;
|
bool hasInitializedStringDecrypter = false;
|
||||||
void initializeStringDecrypter() {
|
void initializeStringDecrypter() {
|
||||||
if (hasInitializedStringDecrypter)
|
if (hasInitializedStringDecrypter)
|
||||||
|
|
Loading…
Reference in New Issue
Block a user