monocul.us/de4dot-cex
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Detect Confuser 1.0 r42919 proxy methods creator

Browse Source
This commit is contained in:
de4dot 2012-08-10 20:14:47 +02:00
parent 612aeec0ab
commit be29d8aed2
1 changed files with 12 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
de4dot.code/deobfuscators/Confuser/ProxyCallFixer.cs
View File

@ -39,6 +39,7 @@ namespace de4dot.code.deobfuscators.Confuser {
enum ConfuserVersion { enum ConfuserVersion {
Unknown, Unknown,
v10_r42915, v10_r42915,
v10_r42919,
v10_r48717, v10_r48717,
v14_r58564, v14_r58564,
v14_r58857, v14_r58857,
@ -191,6 +192,7 @@ namespace de4dot.code.deobfuscators.Confuser {
switch (creatorInfo.version) { switch (creatorInfo.version) {
case ConfuserVersion.v10_r42915: case ConfuserVersion.v10_r42915:
case ConfuserVersion.v10_r42919:
getCallInfo_v10_r42915(info, creatorInfo, out calledMethod, out callOpcode); getCallInfo_v10_r42915(info, creatorInfo, out calledMethod, out callOpcode);
break; break;
@ -527,6 +529,10 @@ namespace de4dot.code.deobfuscators.Confuser {
continue; continue;
} }
} }
else if (theVersion == ConfuserVersion.v10_r42915) {
if (DeobUtils.hasInteger(method, 0x06000000))
theVersion = ConfuserVersion.v10_r42919;
}
setDelegateCreatorMethod(method); setDelegateCreatorMethod(method);
methodToInfo.add(method, new ProxyCreatorInfo(method, proxyType, theVersion, magic, nativeMethod, callvirtChar)); methodToInfo.add(method, new ProxyCreatorInfo(method, proxyType, theVersion, magic, nativeMethod, callvirtChar));
@ -807,6 +813,7 @@ namespace de4dot.code.deobfuscators.Confuser {
FieldDefinitionAndDeclaringTypeDict<DelegateInitInfo> createDelegateInitInfos(MethodDefinition method) { FieldDefinitionAndDeclaringTypeDict<DelegateInitInfo> createDelegateInitInfos(MethodDefinition method) {
switch (version) { switch (version) {
case ConfuserVersion.v10_r42915: case ConfuserVersion.v10_r42915:
case ConfuserVersion.v10_r42919:
return createDelegateInitInfos_v10_r42915(method); return createDelegateInitInfos_v10_r42915(method);
default: default:
return createDelegateInitInfos_v10_r48717(method); return createDelegateInitInfos_v10_r48717(method);
@ -954,6 +961,11 @@ namespace de4dot.code.deobfuscators.Confuser {
case ConfuserVersion.v10_r42915: case ConfuserVersion.v10_r42915:
minRev = 42915; minRev = 42915;
maxRev = 42917;
return true;
case ConfuserVersion.v10_r42919:
minRev = 42919;
maxRev = 48509; maxRev = 48509;
return true; return true;