monocul.us/de4dot-cex
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Port Eazfuscator.NET deobfuscator

Browse Source
This commit is contained in:
de4dot 2012-11-18 01:09:07 +01:00
parent 33645432f1
commit c596f5ddfc
10 changed files with 110 additions and 113 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
de4dot.code/de4dot.code.csproj
View File

@ -177,16 +177,16 @@
<Compile Include="deobfuscators\dotNET_Reactor\v4\ProxyCallFixer.cs" />
<Compile Include="deobfuscators\dotNET_Reactor\v4\ResourceResolver.cs" />
<Compile Include="deobfuscators\dotNET_Reactor\v4\StringDecrypter.cs" />
<None Include="deobfuscators\Eazfuscator_NET\AssemblyResolver.cs" />
<None Include="deobfuscators\Eazfuscator_NET\CodeCompilerMethodCallRestorer.cs" />
<None Include="deobfuscators\Eazfuscator_NET\DecrypterType.cs" />
<None Include="deobfuscators\Eazfuscator_NET\Deobfuscator.cs" />
<None Include="deobfuscators\Eazfuscator_NET\EfConstantsReader.cs" />
<None Include="deobfuscators\Eazfuscator_NET\EfUtils.cs" />
<None Include="deobfuscators\Eazfuscator_NET\ResourceMethodsRestorer.cs" />
<None Include="deobfuscators\Eazfuscator_NET\ResourceResolver.cs" />
<None Include="deobfuscators\Eazfuscator_NET\StringDecrypter.cs" />
<None Include="deobfuscators\Eazfuscator_NET\VersionDetector.cs" />
<Compile Include="deobfuscators\Eazfuscator_NET\AssemblyResolver.cs" />
<Compile Include="deobfuscators\Eazfuscator_NET\CodeCompilerMethodCallRestorer.cs" />
<Compile Include="deobfuscators\Eazfuscator_NET\DecrypterType.cs" />
<Compile Include="deobfuscators\Eazfuscator_NET\Deobfuscator.cs" />
<Compile Include="deobfuscators\Eazfuscator_NET\EfConstantsReader.cs" />
<Compile Include="deobfuscators\Eazfuscator_NET\EfUtils.cs" />
<Compile Include="deobfuscators\Eazfuscator_NET\ResourceMethodsRestorer.cs" />
<Compile Include="deobfuscators\Eazfuscator_NET\ResourceResolver.cs" />
<Compile Include="deobfuscators\Eazfuscator_NET\StringDecrypter.cs" />
<Compile Include="deobfuscators\Eazfuscator_NET\VersionDetector.cs" />
<Compile Include="deobfuscators\ExceptionLoggerRemover.cs" />
<None Include="deobfuscators\Goliath_NET\ArrayDecrypter.cs" />
<None Include="deobfuscators\Goliath_NET\ArrayValueInliner.cs" />

8
de4dot.code/deobfuscators/Eazfuscator_NET/AssemblyResolver.cs
View File

@ -28,7 +28,7 @@ using de4dot.blocks;
namespace de4dot.code.deobfuscators.Eazfuscator_NET {
class AssemblyResolver {
ModuleDefinition module;
ModuleDefMD module;
DecrypterType decrypterType;
TypeDef resolverType;
MethodDef initMethod;
@ -76,7 +76,7 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
get { return resolverType != null; }
}
public AssemblyResolver(ModuleDefinition module, DecrypterType decrypterType) {
public AssemblyResolver(ModuleDefMD module, DecrypterType decrypterType) {
this.module = module;
this.frameworkType = DotNetUtils.getFrameworkType(module);
this.decrypterType = decrypterType;
@ -356,9 +356,9 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
static void initializeNameAndExtension(AssemblyInfo info) {
try {
var mod = ModuleDefinition.ReadModule(new MemoryStream(info.Data));
var mod = ModuleDefMD.Load(info.Data);
info.AssemblyFullName = mod.Assembly.FullName;
info.SimpleName = mod.Assembly.Name.Name;
info.SimpleName = mod.Assembly.Name.String;
info.Extension = DeobUtils.getExtension(mod.Kind);
return;
}

20
de4dot.code/deobfuscators/Eazfuscator_NET/CodeCompilerMethodCallRestorer.cs
View File

@ -21,45 +21,45 @@ using dot10.DotNet;
namespace de4dot.code.deobfuscators.Eazfuscator_NET {
class CodeCompilerMethodCallRestorer : MethodCallRestorerBase {
TypeReference CodeDomProvider {
ITypeDefOrRef CodeDomProvider {
get {
return builder.type("System.CodeDom.Compiler", "CodeDomProvider", "System");
return builder.type("System.CodeDom.Compiler", "CodeDomProvider", "System").ToTypeDefOrRef();
}
}
TypeReference ICodeCompiler {
ITypeDefOrRef ICodeCompiler {
get {
return builder.type("System.CodeDom.Compiler", "ICodeCompiler", "System");
return builder.type("System.CodeDom.Compiler", "ICodeCompiler", "System").ToTypeDefOrRef();
}
}
TypeReference CompilerResults {
TypeSig CompilerResults {
get {
return builder.type("System.CodeDom.Compiler", "CompilerResults", "System");
}
}
TypeReference CompilerParameters {
TypeSig CompilerParameters {
get {
return builder.type("System.CodeDom.Compiler", "CompilerParameters", "System");
}
}
TypeReference CodeCompileUnit {
TypeSig CodeCompileUnit {
get {
return builder.type("System.CodeDom", "CodeCompileUnit", "System");
}
}
TypeReference CodeCompileUnitArray {
TypeSig CodeCompileUnitArray {
get { return builder.array(CodeCompileUnit); }
}
TypeReference StringArray {
TypeSig StringArray {
get { return builder.array(builder.String); }
}
public CodeCompilerMethodCallRestorer(ModuleDefinition module)
public CodeCompilerMethodCallRestorer(ModuleDefMD module)
: base(module) {
}

10
de4dot.code/deobfuscators/Eazfuscator_NET/DecrypterType.cs
View File

@ -26,7 +26,7 @@ using de4dot.blocks;
namespace de4dot.code.deobfuscators.Eazfuscator_NET {
class DecrypterType {
ModuleDefinition module;
ModuleDefMD module;
ISimpleDeobfuscator simpleDeobfuscator;
TypeDef type;
MethodDef int64Method;
@ -50,7 +50,7 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
get { return type != null; }
}
public DecrypterType(ModuleDefinition module, ISimpleDeobfuscator simpleDeobfuscator) {
public DecrypterType(ModuleDefMD module, ISimpleDeobfuscator simpleDeobfuscator) {
this.module = module;
this.simpleDeobfuscator = simpleDeobfuscator;
}
@ -338,9 +338,9 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
var bytes = new List<byte>();
if (module.Assembly != null) {
if (module.Assembly.Name.PublicKeyToken != null)
bytes.AddRange(module.Assembly.Name.PublicKeyToken);
bytes.AddRange(Encoding.Unicode.GetBytes(module.Assembly.Name.Name));
if (!PublicKeyBase.IsNullOrEmpty2(module.Assembly.PublicKey))
bytes.AddRange(module.Assembly.PublicKeyToken.Data);
bytes.AddRange(Encoding.Unicode.GetBytes(module.Assembly.Name.String));
}
int cm1 = constMethod1();
bytes.Add((byte)(type.MDToken.ToInt32() >> 24));

7
de4dot.code/deobfuscators/Eazfuscator_NET/EfConstantsReader.cs
View File

@ -18,7 +18,6 @@
*/
using dot10.DotNet;
using Mono.Cecil.Metadata;
using de4dot.blocks;
namespace de4dot.code.deobfuscators.Eazfuscator_NET {
@ -38,10 +37,10 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
if (!getInt32(ref index, out value))
break;
var stloc = instructions[index];
if (!DotNetUtils.isStloc(stloc))
if (!stloc.IsStloc())
break;
var local = DotNetUtils.getLocalVar(locals, stloc);
if (local == null || local.VariableType.EType != ElementType.I4)
var local = stloc.GetLocal(locals);
if (local == null || local.Type.GetElementType() != ElementType.I4)
break;
localsValuesInt32[local] = value;
index++;

4
de4dot.code/deobfuscators/Eazfuscator_NET/ResourceMethodsRestorer.cs
View File

@ -33,7 +33,7 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
get { return getManifestResourceStreamTypeResource; }
}
public ResourceMethodsRestorer(ModuleDefinition module)
public ResourceMethodsRestorer(ModuleDefMD module)
: base(module) {
}
@ -45,7 +45,7 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
continue;
if (DotNetUtils.getField(type, "System.Reflection.Assembly") == null)
continue;
if (DotNetUtils.getMethod(type, ".cctor") == null)
if (type.FindStaticConstructor() == null)
continue;
var getStream2 = getTheOnlyMethod(type, "System.IO.Stream", "(System.Reflection.Assembly,System.Type,System.String)");

4
de4dot.code/deobfuscators/Eazfuscator_NET/ResourceResolver.cs
View File

@ -26,7 +26,7 @@ using de4dot.blocks;
namespace de4dot.code.deobfuscators.Eazfuscator_NET {
class ResourceResolver {
ModuleDefinition module;
ModuleDefMD module;
AssemblyResolver assemblyResolver;
TypeDef resolverType;
MethodDef initMethod;
@ -45,7 +45,7 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
get { return resolverType != null; }
}
public ResourceResolver(ModuleDefinition module, AssemblyResolver assemblyResolver) {
public ResourceResolver(ModuleDefMD module, AssemblyResolver assemblyResolver) {
this.module = module;
this.assemblyResolver = assemblyResolver;
}

59
de4dot.code/deobfuscators/Eazfuscator_NET/StringDecrypter.cs
View File

@ -23,12 +23,11 @@ using System.IO;
using System.Text;
using dot10.DotNet;
using dot10.DotNet.Emit;
using Mono.Cecil.Metadata;
using de4dot.blocks;
namespace de4dot.code.deobfuscators.Eazfuscator_NET {
class StringDecrypter {
ModuleDefinition module;
ModuleDefMD module;
TypeDef stringType;
MethodDef stringMethod;
TypeDef dataDecrypterType;
@ -102,7 +101,7 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
get { return stringType != null; }
}
public StringDecrypter(ModuleDefinition module, DecrypterType decrypterType) {
public StringDecrypter(ModuleDefMD module, DecrypterType decrypterType) {
this.module = module;
this.decrypterType = decrypterType;
}
@ -110,7 +109,7 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
static bool checkIfV32OrLater(TypeDef type) {
int numInts = 0;
foreach (var field in type.Fields) {
if (field.FieldType.EType == ElementType.I4)
if (field.FieldSig.GetFieldType().GetElementType() == ElementType.I4)
numInts++;
}
return numInts >= 2;
@ -161,7 +160,7 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
};
static StreamHelperType findStreamHelperType(TypeDef type) {
foreach (var field in type.Fields) {
var nested = field.FieldType as TypeDef;
var nested = field.FieldSig.GetFieldType().TryGetTypeDef();
if (nested == null)
continue;
if (nested.DeclaringType != type)
@ -197,7 +196,7 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
foreach (var instr in method.Body.Instructions) {
if (instr.OpCode != OpCodes.Callvirt)
continue;
var calledMethod = instr.Operand as MethodReference;
var calledMethod = instr.Operand as IMethod;
if (calledMethod != null && calledMethod.FullName == "System.IO.Stream System.Reflection.Assembly::GetManifestResourceStream(System.String)")
return true;
}
@ -248,7 +247,7 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
if (!findInts(out initializedAll))
return false;
var cctor = DotNetUtils.getMethod(stringType, ".cctor");
var cctor = stringType.FindStaticConstructor();
if (!initializedAll && cctor != null) {
simpleDeobfuscator.deobfuscate(cctor);
if (!findIntsCctor(cctor))
@ -292,10 +291,10 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
}
class FlagsInfo {
public VariableDefinition Local { get; set; }
public Local Local { get; set; }
public uint Value { get; set; }
public int Offset { get; set; }
public FlagsInfo(VariableDefinition local, uint value, int offset) {
public FlagsInfo(Local local, uint value, int offset) {
Local = local;
Value = value;
Offset = offset;
@ -307,7 +306,7 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
if (flags == null)
return false;
flags.Sort((a, b) => Utils.compareInt32(a.Offset, b.Offset));
flags.Sort((a, b) => a.Offset.CompareTo(b.Offset));
rldFlag = flags[0].Value;
bytesFlag = flags[1].Value;
@ -344,13 +343,13 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
return null;
}
static int getFlagsOffset(MethodDef method, int index, VariableDefinition local) {
static int getFlagsOffset(MethodDef method, int index, Local local) {
var instrs = method.Body.Instructions;
for (; index < instrs.Count; index++) {
var ldloc = instrs[index];
if (!DotNetUtils.isLdloc(ldloc))
if (!ldloc.IsLdloc())
continue;
if (DotNetUtils.getLocalVar(method.Body.Variables, ldloc) != local)
if (ldloc.GetLocal(method.Body.LocalList) != local)
continue;
return index;
@ -358,7 +357,7 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
return -1;
}
static VariableDefinition getFlagsLocal(MethodDef method, int index) {
static Local getFlagsLocal(MethodDef method, int index) {
var instrs = method.Body.Instructions;
if (index + 5 >= instrs.Count)
return null;
@ -373,9 +372,9 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
if (instrs[index++].OpCode.Code != Code.Ceq)
return null;
var stloc = instrs[index++];
if (!DotNetUtils.isStloc(stloc))
if (!stloc.IsStloc())
return null;
return DotNetUtils.getLocalVar(method.Body.Variables, stloc);
return stloc.GetLocal(method.Body.LocalList);
}
void initialize() {
@ -415,10 +414,10 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
var bytes = reader.ReadBytes(flags & 0x1FFFFFFF);
decrypt1(bytes, tmpKey);
var pkt = module.Assembly.Name.PublicKeyToken;
if (usePublicKeyToken && pkt != null && pkt.Length != 0) {
var pkt = PublicKeyBase.ToPublicKeyToken(module.Assembly.PublicKey);
if (usePublicKeyToken && !PublicKeyBase.IsNullOrEmpty2(pkt)) {
for (int i = 0; i < bytes.Length; i++)
bytes[i] ^= (byte)((pkt[i & 7] >> 5) + (pkt[i & 7] << 3));
bytes[i] ^= (byte)((pkt.Data[i & 7] >> 5) + (pkt.Data[i & 7] << 3));
}
if ((flags & rldFlag) != 0)
@ -605,9 +604,9 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
int tmp;
if (!stringMethodConsts.getNextInt32(ref i, out tmp))
continue;
if ((instrs[i - 1].OpCode.Code == Code.Xor && DotNetUtils.isStloc(instrs[i])) ||
(instrs[i].OpCode.Code == Code.Xor && DotNetUtils.isStloc(instrs[i + 1])) ||
DotNetUtils.isLdloc(instrs[i])) {
if ((instrs[i - 1].OpCode.Code == Code.Xor && instrs[i].IsStloc()) ||
(instrs[i].OpCode.Code == Code.Xor && instrs[i + 1].IsStloc()) ||
instrs[i].IsLdloc()) {
i2 ^= tmp;
returnValue = true;
}
@ -637,10 +636,10 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
var instr = instrs[i + 2];
if (instr.OpCode.Code == Code.Ldsfld) {
var loadField = instr.Operand as FieldDef;
if (loadField == null || loadField.FieldType.EType != ElementType.I4)
if (loadField == null || loadField.FieldType.GetElementType() != ElementType.I4)
continue;
}
else if (DotNetUtils.isLdcI4(instr)) {
else if (instr.IsLdcI4()) {
initializedAll = true;
}
else
@ -674,7 +673,7 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
int tmp4;
if (!constantsReader.getNextInt32(ref index, out tmp4))
break;
if (index < instrs.Count && DotNetUtils.isLdloc(instrs[index]))
if (index < instrs.Count && instrs[index].IsLdloc())
tmp3 = tmp4;
}
@ -715,7 +714,7 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
continue;
var ldci4 = instrs[i + 1];
if (!DotNetUtils.isLdcI4(ldci4))
if (!ldci4.IsLdcI4())
continue;
int index = i + 1;
@ -755,7 +754,7 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
if (instrs[index++].OpCode.Code != Code.Xor)
continue;
if (!DotNetUtils.isLdloc(instrs[index++]))
if (!instrs[index++].IsLdloc())
continue;
if (instrs[index++].OpCode.Code != Code.Xor)
@ -811,9 +810,9 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
if (index <= 0)
continue;
var ldci4 = stringMethod.Body.Instructions[index - 1];
if (!DotNetUtils.isLdcI4(ldci4))
if (!ldci4.IsLdcI4())
continue;
if (DotNetUtils.getLdcI4Value(ldci4) != 4)
if (ldci4.GetLdcI4Value() != 4)
continue;
if (!stringMethodConsts.getNextInt32(ref index, out i5))
return false;
@ -848,7 +847,7 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
if (!findCallvirt(method, ref index))
return false;
var calledMethod = method.Body.Instructions[index].Operand as MethodReference;
var calledMethod = method.Body.Instructions[index].Operand as IMethod;
if (calledMethod == null)
continue;
if (calledMethod.ToString() != methodFullName)

89
de4dot.code/deobfuscators/Eazfuscator_NET/VersionDetector.cs
View File

@ -27,7 +27,7 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
StringDecrypter stringDecrypter;
FrameworkType frameworkType;
public VersionDetector(ModuleDefinition module, StringDecrypter stringDecrypter) {
public VersionDetector(ModuleDefMD module, StringDecrypter stringDecrypter) {
this.stringDecrypter = stringDecrypter;
this.frameworkType = DotNetUtils.getFrameworkType(module);
}
@ -52,7 +52,6 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
return null;
bool hasConstantM2 = DeobUtils.hasInteger(decryptStringMethod, -2);
var frameworkType = DotNetUtils.getFrameworkType(decryptStringType.Module);
/////////////////////////////////////////////////////////////////
/////////////////////////////////////////////////////////////////
@ -77,11 +76,11 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
if (otherMethods.Count == 0 &&
decryptStringType.NestedTypes.Count == 0 &&
!hasConstantM2 &&
!decryptStringMethod.NoInlining &&
!decryptStringMethod.IsNoInlining &&
decryptStringMethod.IsPublic &&
decryptStringMethod.IsSynchronized &&
decryptStringMethod.Body.MaxStackSize >= 35 &&
decryptStringMethod.Body.MaxStackSize <= 50 &&
decryptStringMethod.Body.MaxStack >= 35 &&
decryptStringMethod.Body.MaxStack <= 50 &&
decryptStringMethod.Body.ExceptionHandlers.Count == 0 &&
new LocalTypes(decryptStringMethod).exactly(locals11) &&
checkTypeFields(fields11)) {
@ -113,11 +112,11 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
if (otherMethods.Count == 0 &&
decryptStringType.NestedTypes.Count == 0 &&
!hasConstantM2 &&
!decryptStringMethod.NoInlining &&
!decryptStringMethod.IsNoInlining &&
decryptStringMethod.IsPublic &&
decryptStringMethod.IsSynchronized &&
decryptStringMethod.Body.MaxStackSize >= 35 &&
decryptStringMethod.Body.MaxStackSize <= 50 &&
decryptStringMethod.Body.MaxStack >= 35 &&
decryptStringMethod.Body.MaxStack <= 50 &&
decryptStringMethod.Body.ExceptionHandlers.Count == 0 &&
new LocalTypes(decryptStringMethod).exactly(locals13) &&
checkTypeFields(fields13)) {
@ -149,11 +148,11 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
if (otherMethods.Count == 0 &&
decryptStringType.NestedTypes.Count == 0 &&
!hasConstantM2 &&
!decryptStringMethod.NoInlining &&
!decryptStringMethod.IsNoInlining &&
decryptStringMethod.IsPublic &&
decryptStringMethod.IsSynchronized &&
decryptStringMethod.Body.MaxStackSize >= 150 &&
decryptStringMethod.Body.MaxStackSize <= 200 &&
decryptStringMethod.Body.MaxStack >= 150 &&
decryptStringMethod.Body.MaxStack <= 200 &&
decryptStringMethod.Body.ExceptionHandlers.Count == 0 &&
new LocalTypes(decryptStringMethod).exactly(locals14) &&
checkTypeFields(fields14)) {
@ -186,11 +185,11 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
if (otherMethods.Count == 0 &&
decryptStringType.NestedTypes.Count == 0 &&
!hasConstantM2 &&
!decryptStringMethod.NoInlining &&
!decryptStringMethod.IsNoInlining &&
decryptStringMethod.IsPublic &&
decryptStringMethod.IsSynchronized &&
decryptStringMethod.Body.MaxStackSize >= 1 &&
decryptStringMethod.Body.MaxStackSize <= 8 &&
decryptStringMethod.Body.MaxStack >= 1 &&
decryptStringMethod.Body.MaxStack <= 8 &&
decryptStringMethod.Body.ExceptionHandlers.Count == 0 &&
new LocalTypes(decryptStringMethod).exactly(locals24) &&
checkTypeFields(fields24)) {
@ -224,11 +223,11 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
if (otherMethods.Count == 0 &&
decryptStringType.NestedTypes.Count == 0 &&
!hasConstantM2 &&
!decryptStringMethod.NoInlining &&
!decryptStringMethod.IsNoInlining &&
decryptStringMethod.IsPublic &&
!decryptStringMethod.IsSynchronized &&
decryptStringMethod.Body.MaxStackSize >= 1 &&
decryptStringMethod.Body.MaxStackSize <= 8 &&
decryptStringMethod.Body.MaxStack >= 1 &&
decryptStringMethod.Body.MaxStack <= 8 &&
decryptStringMethod.Body.ExceptionHandlers.Count == 1 &&
new LocalTypes(decryptStringMethod).exactly(locals26) &&
checkTypeFields(fields26)) {
@ -262,11 +261,11 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
if (otherMethods.Count == 0 &&
decryptStringType.NestedTypes.Count == 0 &&
!hasConstantM2 &&
decryptStringMethod.NoInlining &&
decryptStringMethod.IsNoInlining &&
decryptStringMethod.IsPublic &&
!decryptStringMethod.IsSynchronized &&
decryptStringMethod.Body.MaxStackSize >= 1 &&
decryptStringMethod.Body.MaxStackSize <= 8 &&
decryptStringMethod.Body.MaxStack >= 1 &&
decryptStringMethod.Body.MaxStack <= 8 &&
decryptStringMethod.Body.ExceptionHandlers.Count == 1 &&
new LocalTypes(decryptStringMethod).exactly(locals27) &&
checkTypeFields(fields27)) {
@ -301,11 +300,11 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
if (otherMethods.Count == 0 &&
decryptStringType.NestedTypes.Count == 0 &&
!hasConstantM2 &&
decryptStringMethod.NoInlining &&
decryptStringMethod.IsNoInlining &&
decryptStringMethod.IsAssembly &&
!decryptStringMethod.IsSynchronized &&
decryptStringMethod.Body.MaxStackSize >= 1 &&
decryptStringMethod.Body.MaxStackSize <= 8 &&
decryptStringMethod.Body.MaxStack >= 1 &&
decryptStringMethod.Body.MaxStack <= 8 &&
decryptStringMethod.Body.ExceptionHandlers.Count == 1 &&
new LocalTypes(decryptStringMethod).exactly(locals28) &&
checkTypeFields(fields28)) {
@ -344,11 +343,11 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
if (otherMethods.Count == 0 &&
decryptStringType.NestedTypes.Count == 0 &&
!hasConstantM2 &&
decryptStringMethod.NoInlining &&
decryptStringMethod.IsNoInlining &&
decryptStringMethod.IsAssembly &&
!decryptStringMethod.IsSynchronized &&
decryptStringMethod.Body.MaxStackSize >= 1 &&
decryptStringMethod.Body.MaxStackSize <= 8 &&
decryptStringMethod.Body.MaxStack >= 1 &&
decryptStringMethod.Body.MaxStack <= 8 &&
(decryptStringMethod.Body.ExceptionHandlers.Count == 1 || decryptStringMethod.Body.ExceptionHandlers.Count == 2) &&
new LocalTypes(decryptStringMethod).exactly(locals29) &&
checkTypeFields(fields29)) {
@ -394,11 +393,11 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
otherMethods[0].IsStatic &&
new LocalTypes(otherMethods[0]).exactly(olocals30) &&
!hasConstantM2 &&
decryptStringMethod.NoInlining &&
decryptStringMethod.IsNoInlining &&
decryptStringMethod.IsAssembly &&
!decryptStringMethod.IsSynchronized &&
decryptStringMethod.Body.MaxStackSize >= 1 &&
decryptStringMethod.Body.MaxStackSize <= 8 &&
decryptStringMethod.Body.MaxStack >= 1 &&
decryptStringMethod.Body.MaxStack <= 8 &&
(decryptStringMethod.Body.ExceptionHandlers.Count == 1 || decryptStringMethod.Body.ExceptionHandlers.Count == 2) &&
new LocalTypes(decryptStringMethod).exactly(locals30) &&
checkTypeFields(fields30)) {
@ -444,11 +443,11 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
otherMethods[0].IsStatic &&
new LocalTypes(otherMethods[0]).exactly(olocals31) &&
hasConstantM2 &&
decryptStringMethod.NoInlining &&
decryptStringMethod.IsNoInlining &&
decryptStringMethod.IsAssembly &&
!decryptStringMethod.IsSynchronized &&
decryptStringMethod.Body.MaxStackSize >= 1 &&
decryptStringMethod.Body.MaxStackSize <= 8 &&
decryptStringMethod.Body.MaxStack >= 1 &&
decryptStringMethod.Body.MaxStack <= 8 &&
(decryptStringMethod.Body.ExceptionHandlers.Count == 1 || decryptStringMethod.Body.ExceptionHandlers.Count == 2) &&
new LocalTypes(decryptStringMethod).exactly(locals31) &&
checkTypeFields(fields31)) {
@ -496,11 +495,11 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
otherMethods[0].IsStatic &&
new LocalTypes(otherMethods[0]).exactly(olocals32) &&
hasConstantM2 &&
decryptStringMethod.NoInlining &&
decryptStringMethod.IsNoInlining &&
decryptStringMethod.IsAssembly &&
!decryptStringMethod.IsSynchronized &&
decryptStringMethod.Body.MaxStackSize >= 1 &&
decryptStringMethod.Body.MaxStackSize <= 8 &&
decryptStringMethod.Body.MaxStack >= 1 &&
decryptStringMethod.Body.MaxStack <= 8 &&
(decryptStringMethod.Body.ExceptionHandlers.Count == 1 || decryptStringMethod.Body.ExceptionHandlers.Count == 2) &&
new LocalTypes(decryptStringMethod).exactly(locals32) &&
checkTypeFields(fields32)) {
@ -551,11 +550,11 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
otherMethods[0].IsStatic &&
new LocalTypes(otherMethods[0]).exactly(olocals33) &&
hasConstantM2 &&
decryptStringMethod.NoInlining &&
decryptStringMethod.IsNoInlining &&
decryptStringMethod.IsAssembly &&
!decryptStringMethod.IsSynchronized &&
decryptStringMethod.Body.MaxStackSize >= 1 &&
decryptStringMethod.Body.MaxStackSize <= 8 &&
decryptStringMethod.Body.MaxStack >= 1 &&
decryptStringMethod.Body.MaxStack <= 8 &&
(decryptStringMethod.Body.ExceptionHandlers.Count == 1 || decryptStringMethod.Body.ExceptionHandlers.Count == 2) &&
new LocalTypes(decryptStringMethod).exactly(locals33) &&
checkTypeFields(fields33)) {
@ -606,11 +605,11 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
otherMethods[0].IsPrivate &&
otherMethods[0].IsStatic &&
new LocalTypes(otherMethods[0]).exactly(olocals33) &&
decryptStringMethod.NoInlining &&
decryptStringMethod.IsNoInlining &&
decryptStringMethod.IsAssembly &&
!decryptStringMethod.IsSynchronized &&
decryptStringMethod.Body.MaxStackSize >= 1 &&
decryptStringMethod.Body.MaxStackSize <= 8 &&
decryptStringMethod.Body.MaxStack >= 1 &&
decryptStringMethod.Body.MaxStack <= 8 &&
(decryptStringMethod.Body.ExceptionHandlers.Count == 1 || decryptStringMethod.Body.ExceptionHandlers.Count == 2) &&
new LocalTypes(decryptStringMethod).exactly(locals33) &&
checkTypeFields(fields33)) {
@ -656,11 +655,11 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
otherMethods[0].IsPrivate &&
otherMethods[0].IsStatic &&
new LocalTypes(otherMethods[0]).exactly(olocals33_149) &&
decryptStringMethod.NoInlining &&
decryptStringMethod.IsNoInlining &&
decryptStringMethod.IsAssembly &&
!decryptStringMethod.IsSynchronized &&
decryptStringMethod.Body.MaxStackSize >= 1 &&
decryptStringMethod.Body.MaxStackSize <= 8 &&
decryptStringMethod.Body.MaxStack >= 1 &&
decryptStringMethod.Body.MaxStack <= 8 &&
(decryptStringMethod.Body.ExceptionHandlers.Count == 1 || decryptStringMethod.Body.ExceptionHandlers.Count == 2) &&
new LocalTypes(decryptStringMethod).exactly(locals33_149) &&
checkTypeFields(fields33_149)) {
@ -684,7 +683,7 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
if (fieldIndex >= type.Fields.Count)
return null;
var nestedType = type.Fields[fieldIndex].FieldType as TypeDef;
var nestedType = type.Fields[fieldIndex].FieldType.TryGetTypeDef();
if (nestedType == null || type.NestedTypes.IndexOf(nestedType) < 0)
return null;

2
de4dot.cui/Program.cs
View File

@ -48,8 +48,8 @@ namespace de4dot.cui {
new de4dot.code.deobfuscators.Dotfuscator.DeobfuscatorInfo(),
new de4dot.code.deobfuscators.dotNET_Reactor.v3.DeobfuscatorInfo(),
new de4dot.code.deobfuscators.dotNET_Reactor.v4.DeobfuscatorInfo(),
#if PORT
new de4dot.code.deobfuscators.Eazfuscator_NET.DeobfuscatorInfo(),
#if PORT
new de4dot.code.deobfuscators.Goliath_NET.DeobfuscatorInfo(),
new de4dot.code.deobfuscators.ILProtector.DeobfuscatorInfo(),
new de4dot.code.deobfuscators.MaxtoCode.DeobfuscatorInfo(),