diff --git a/de4dot.code/deobfuscators/MaxtoCode/Deobfuscator.cs b/de4dot.code/deobfuscators/MaxtoCode/Deobfuscator.cs index 08358493..c33dccb1 100644 --- a/de4dot.code/deobfuscators/MaxtoCode/Deobfuscator.cs +++ b/de4dot.code/deobfuscators/MaxtoCode/Deobfuscator.cs @@ -139,6 +139,7 @@ namespace de4dot.code.deobfuscators.MaxtoCode { addCctorInitCallToBeRemoved(method); addTypeToBeRemoved(mainType.Type, "Obfuscator type"); removeDuplicateEmbeddedResources(); + removeInvalidResources(); } static Encoding getEncoding(int cp) { @@ -160,6 +161,8 @@ namespace de4dot.code.deobfuscators.MaxtoCode { public override int GetHashCode() { int hash = 0; + if (resource.Offset != null) + hash ^= resource.Offset.GetHashCode(); hash ^= (int)resource.Data.Position; hash ^= (int)resource.Data.Length; return hash; @@ -184,7 +187,7 @@ namespace de4dot.code.deobfuscators.MaxtoCode { var rsrc = tmp as EmbeddedResource; if (rsrc == null) continue; - if (rsrc.Data.FileOffset == 0) + if (rsrc.Offset == null) continue; List list; var key = new ResourceKey(rsrc); @@ -216,6 +219,16 @@ namespace de4dot.code.deobfuscators.MaxtoCode { } } + void removeInvalidResources() { + foreach (var tmp in module.Resources) { + var resource = tmp as EmbeddedResource; + if (resource == null) + continue; + if (resource.Offset == null || (resource.Data.FileOffset == 0 && resource.Data.Length == 0)) + addResourceToBeRemoved(resource, "Invalid resource"); + } + } + public override IEnumerable getStringDecrypterMethods() { var list = new List(); if (stringDecrypter != null && stringDecrypter.Detected)