diff --git a/de4dot.code/deobfuscators/CliSecure/vm/UnknownHandlerInfo.cs b/de4dot.code/deobfuscators/CliSecure/vm/UnknownHandlerInfo.cs index 3a7b43f4..fa89cc93 100644 --- a/de4dot.code/deobfuscators/CliSecure/vm/UnknownHandlerInfo.cs +++ b/de4dot.code/deobfuscators/CliSecure/vm/UnknownHandlerInfo.cs @@ -18,6 +18,7 @@ */ using System; +using System.Collections.Generic; using Mono.Cecil; using Mono.Cecil.Cil; using de4dot.blocks; @@ -66,13 +67,34 @@ namespace de4dot.code.deobfuscators.CliSecure.vm { public UnknownHandlerInfo(TypeDefinition type, CsvmInfo csvmInfo) { this.type = type; this.csvmInfo = csvmInfo; - fieldsInfo = new FieldsInfo(type); + fieldsInfo = new FieldsInfo(getFields(type)); countMethods(); findOverrideMethods(); executeMethodThrows = countThrows(executeMethod); executeMethodPops = countPops(executeMethod); } + static IEnumerable getFields(TypeDefinition type) { + var typeFields = new FieldDefinitionAndDeclaringTypeDict(); + foreach (var field in type.Fields) + typeFields.add(field, field); + var realFields = new Dictionary(); + foreach (var method in type.Methods) { + if (method.Body == null) + continue; + foreach (var instr in method.Body.Instructions) { + var fieldRef = instr.Operand as FieldReference; + if (fieldRef == null) + continue; + var field = typeFields.find(fieldRef); + if (field == null) + continue; + realFields[field] = true; + } + } + return realFields.Keys; + } + void countMethods() { foreach (var method in type.Methods) { if (method.Name == ".cctor") { diff --git a/de4dot.mdecrypt/DynamicMethodsDecrypter.cs b/de4dot.mdecrypt/DynamicMethodsDecrypter.cs index efb0fac8..cf898c6c 100644 --- a/de4dot.mdecrypt/DynamicMethodsDecrypter.cs +++ b/de4dot.mdecrypt/DynamicMethodsDecrypter.cs @@ -242,12 +242,6 @@ namespace de4dot.mdecrypt { if (!compareName(textName, name, name.Length)) continue; - uint oldProtect; - if (!VirtualProtect(new IntPtr(pSection), sizeof(IMAGE_SECTION_HEADER), PAGE_EXECUTE_READWRITE, out oldProtect)) - throw new ApplicationException("Could not enable write access to jitter .text section"); - pSection->VirtualSize = (pSection->VirtualSize + sectionAlignment - 1) & ~(sectionAlignment - 1); - VirtualProtect(new IntPtr(pSection), sizeof(IMAGE_SECTION_HEADER), oldProtect, out oldProtect); - uint size = pSection->VirtualSize; uint rva = pSection->VirtualAddress; return new IntPtr((byte*)hDll + rva + size);