monocul.us/de4dot-cex
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Remove invalid resources

Browse Source
This commit is contained in:
de4dot 2012-11-20 07:25:10 +01:00
parent 32f9a780c4
commit bde935c6d8
1 changed files with 14 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
de4dot.code/deobfuscators/MaxtoCode/Deobfuscator.cs
View File

@ -139,6 +139,7 @@ namespace de4dot.code.deobfuscators.MaxtoCode {
addCctorInitCallToBeRemoved(method);
addTypeToBeRemoved(mainType.Type, "Obfuscator type");
removeDuplicateEmbeddedResources();
removeInvalidResources();
}
static Encoding getEncoding(int cp) {
@ -160,6 +161,8 @@ namespace de4dot.code.deobfuscators.MaxtoCode {
public override int GetHashCode() {
int hash = 0;
if (resource.Offset != null)
hash ^= resource.Offset.GetHashCode();
hash ^= (int)resource.Data.Position;
hash ^= (int)resource.Data.Length;
return hash;
@ -184,7 +187,7 @@ namespace de4dot.code.deobfuscators.MaxtoCode {
var rsrc = tmp as EmbeddedResource;
if (rsrc == null)
continue;
if (rsrc.Data.FileOffset == 0)
if (rsrc.Offset == null)
continue;
List<EmbeddedResource> list;
var key = new ResourceKey(rsrc);
@ -216,6 +219,16 @@ namespace de4dot.code.deobfuscators.MaxtoCode {
}
}
void removeInvalidResources() {
foreach (var tmp in module.Resources) {
var resource = tmp as EmbeddedResource;
if (resource == null)
continue;
if (resource.Offset == null || (resource.Data.FileOffset == 0 && resource.Data.Length == 0))
addResourceToBeRemoved(resource, "Invalid resource");
}
}
public override IEnumerable<int> getStringDecrypterMethods() {
var list = new List<int>();
if (stringDecrypter != null && stringDecrypter.Detected)