monocul.us/de4dot-cex
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Support AN 6.0.0.5 (new build, same version)

Browse Source
This commit is contained in:
de4dot 2012-05-19 08:56:08 +02:00
parent f6c5ed1c0c
commit c48b2d92c2
2 changed files with 23 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
de4dot.code/deobfuscators/CliSecure/vm/UnknownHandlerInfo.cs
View File

@ -18,6 +18,7 @@
*/
using System;
using System.Collections.Generic;
using Mono.Cecil;
using Mono.Cecil.Cil;
using de4dot.blocks;
@ -66,13 +67,34 @@ namespace de4dot.code.deobfuscators.CliSecure.vm {
public UnknownHandlerInfo(TypeDefinition type, CsvmInfo csvmInfo) {
this.type = type;
this.csvmInfo = csvmInfo;
fieldsInfo = new FieldsInfo(type);
fieldsInfo = new FieldsInfo(getFields(type));
countMethods();
findOverrideMethods();
executeMethodThrows = countThrows(executeMethod);
executeMethodPops = countPops(executeMethod);
}
static IEnumerable<FieldDefinition> getFields(TypeDefinition type) {
var typeFields = new FieldDefinitionAndDeclaringTypeDict<FieldDefinition>();
foreach (var field in type.Fields)
typeFields.add(field, field);
var realFields = new Dictionary<FieldDefinition, bool>();
foreach (var method in type.Methods) {
if (method.Body == null)
continue;
foreach (var instr in method.Body.Instructions) {
var fieldRef = instr.Operand as FieldReference;
if (fieldRef == null)
continue;
var field = typeFields.find(fieldRef);
if (field == null)
continue;
realFields[field] = true;
}
}
return realFields.Keys;
}
void countMethods() {
foreach (var method in type.Methods) {
if (method.Name == ".cctor") {

6
de4dot.mdecrypt/DynamicMethodsDecrypter.cs
View File

@ -242,12 +242,6 @@ namespace de4dot.mdecrypt {
if (!compareName(textName, name, name.Length))
continue;
uint oldProtect;
if (!VirtualProtect(new IntPtr(pSection), sizeof(IMAGE_SECTION_HEADER), PAGE_EXECUTE_READWRITE, out oldProtect))
throw new ApplicationException("Could not enable write access to jitter .text section");
pSection->VirtualSize = (pSection->VirtualSize + sectionAlignment - 1) & ~(sectionAlignment - 1);
VirtualProtect(new IntPtr(pSection), sizeof(IMAGE_SECTION_HEADER), oldProtect, out oldProtect);
uint size = pSection->VirtualSize;
uint rva = pSection->VirtualAddress;
return new IntPtr((byte*)hDll + rva + size);