Support AN 6.0.0.5 (new build, same version)
This commit is contained in:
parent
f6c5ed1c0c
commit
c48b2d92c2
|
@ -18,6 +18,7 @@
|
|||
*/
|
||||
|
||||
using System;
|
||||
using System.Collections.Generic;
|
||||
using Mono.Cecil;
|
||||
using Mono.Cecil.Cil;
|
||||
using de4dot.blocks;
|
||||
|
@ -66,13 +67,34 @@ namespace de4dot.code.deobfuscators.CliSecure.vm {
|
|||
public UnknownHandlerInfo(TypeDefinition type, CsvmInfo csvmInfo) {
|
||||
this.type = type;
|
||||
this.csvmInfo = csvmInfo;
|
||||
fieldsInfo = new FieldsInfo(type);
|
||||
fieldsInfo = new FieldsInfo(getFields(type));
|
||||
countMethods();
|
||||
findOverrideMethods();
|
||||
executeMethodThrows = countThrows(executeMethod);
|
||||
executeMethodPops = countPops(executeMethod);
|
||||
}
|
||||
|
||||
static IEnumerable<FieldDefinition> getFields(TypeDefinition type) {
|
||||
var typeFields = new FieldDefinitionAndDeclaringTypeDict<FieldDefinition>();
|
||||
foreach (var field in type.Fields)
|
||||
typeFields.add(field, field);
|
||||
var realFields = new Dictionary<FieldDefinition, bool>();
|
||||
foreach (var method in type.Methods) {
|
||||
if (method.Body == null)
|
||||
continue;
|
||||
foreach (var instr in method.Body.Instructions) {
|
||||
var fieldRef = instr.Operand as FieldReference;
|
||||
if (fieldRef == null)
|
||||
continue;
|
||||
var field = typeFields.find(fieldRef);
|
||||
if (field == null)
|
||||
continue;
|
||||
realFields[field] = true;
|
||||
}
|
||||
}
|
||||
return realFields.Keys;
|
||||
}
|
||||
|
||||
void countMethods() {
|
||||
foreach (var method in type.Methods) {
|
||||
if (method.Name == ".cctor") {
|
||||
|
|
|
@ -242,12 +242,6 @@ namespace de4dot.mdecrypt {
|
|||
if (!compareName(textName, name, name.Length))
|
||||
continue;
|
||||
|
||||
uint oldProtect;
|
||||
if (!VirtualProtect(new IntPtr(pSection), sizeof(IMAGE_SECTION_HEADER), PAGE_EXECUTE_READWRITE, out oldProtect))
|
||||
throw new ApplicationException("Could not enable write access to jitter .text section");
|
||||
pSection->VirtualSize = (pSection->VirtualSize + sectionAlignment - 1) & ~(sectionAlignment - 1);
|
||||
VirtualProtect(new IntPtr(pSection), sizeof(IMAGE_SECTION_HEADER), oldProtect, out oldProtect);
|
||||
|
||||
uint size = pSection->VirtualSize;
|
||||
uint rva = pSection->VirtualAddress;
|
||||
return new IntPtr((byte*)hDll + rva + size);
|
||||
|
|
Loading…
Reference in New Issue
Block a user