diff --git a/de4dot.code/de4dot.code.csproj b/de4dot.code/de4dot.code.csproj
index 14d45c3f..b46a8e31 100644
--- a/de4dot.code/de4dot.code.csproj
+++ b/de4dot.code/de4dot.code.csproj
@@ -177,16 +177,16 @@
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
diff --git a/de4dot.code/deobfuscators/Eazfuscator_NET/AssemblyResolver.cs b/de4dot.code/deobfuscators/Eazfuscator_NET/AssemblyResolver.cs
index 0f436fce..f32f0be2 100644
--- a/de4dot.code/deobfuscators/Eazfuscator_NET/AssemblyResolver.cs
+++ b/de4dot.code/deobfuscators/Eazfuscator_NET/AssemblyResolver.cs
@@ -28,7 +28,7 @@ using de4dot.blocks;
namespace de4dot.code.deobfuscators.Eazfuscator_NET {
class AssemblyResolver {
- ModuleDefinition module;
+ ModuleDefMD module;
DecrypterType decrypterType;
TypeDef resolverType;
MethodDef initMethod;
@@ -76,7 +76,7 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
get { return resolverType != null; }
}
- public AssemblyResolver(ModuleDefinition module, DecrypterType decrypterType) {
+ public AssemblyResolver(ModuleDefMD module, DecrypterType decrypterType) {
this.module = module;
this.frameworkType = DotNetUtils.getFrameworkType(module);
this.decrypterType = decrypterType;
@@ -356,9 +356,9 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
static void initializeNameAndExtension(AssemblyInfo info) {
try {
- var mod = ModuleDefinition.ReadModule(new MemoryStream(info.Data));
+ var mod = ModuleDefMD.Load(info.Data);
info.AssemblyFullName = mod.Assembly.FullName;
- info.SimpleName = mod.Assembly.Name.Name;
+ info.SimpleName = mod.Assembly.Name.String;
info.Extension = DeobUtils.getExtension(mod.Kind);
return;
}
diff --git a/de4dot.code/deobfuscators/Eazfuscator_NET/CodeCompilerMethodCallRestorer.cs b/de4dot.code/deobfuscators/Eazfuscator_NET/CodeCompilerMethodCallRestorer.cs
index 1e35e07f..7dc9e406 100644
--- a/de4dot.code/deobfuscators/Eazfuscator_NET/CodeCompilerMethodCallRestorer.cs
+++ b/de4dot.code/deobfuscators/Eazfuscator_NET/CodeCompilerMethodCallRestorer.cs
@@ -21,45 +21,45 @@ using dot10.DotNet;
namespace de4dot.code.deobfuscators.Eazfuscator_NET {
class CodeCompilerMethodCallRestorer : MethodCallRestorerBase {
- TypeReference CodeDomProvider {
+ ITypeDefOrRef CodeDomProvider {
get {
- return builder.type("System.CodeDom.Compiler", "CodeDomProvider", "System");
+ return builder.type("System.CodeDom.Compiler", "CodeDomProvider", "System").ToTypeDefOrRef();
}
}
- TypeReference ICodeCompiler {
+ ITypeDefOrRef ICodeCompiler {
get {
- return builder.type("System.CodeDom.Compiler", "ICodeCompiler", "System");
+ return builder.type("System.CodeDom.Compiler", "ICodeCompiler", "System").ToTypeDefOrRef();
}
}
- TypeReference CompilerResults {
+ TypeSig CompilerResults {
get {
return builder.type("System.CodeDom.Compiler", "CompilerResults", "System");
}
}
- TypeReference CompilerParameters {
+ TypeSig CompilerParameters {
get {
return builder.type("System.CodeDom.Compiler", "CompilerParameters", "System");
}
}
- TypeReference CodeCompileUnit {
+ TypeSig CodeCompileUnit {
get {
return builder.type("System.CodeDom", "CodeCompileUnit", "System");
}
}
- TypeReference CodeCompileUnitArray {
+ TypeSig CodeCompileUnitArray {
get { return builder.array(CodeCompileUnit); }
}
- TypeReference StringArray {
+ TypeSig StringArray {
get { return builder.array(builder.String); }
}
- public CodeCompilerMethodCallRestorer(ModuleDefinition module)
+ public CodeCompilerMethodCallRestorer(ModuleDefMD module)
: base(module) {
}
diff --git a/de4dot.code/deobfuscators/Eazfuscator_NET/DecrypterType.cs b/de4dot.code/deobfuscators/Eazfuscator_NET/DecrypterType.cs
index 9302219c..b05a931f 100644
--- a/de4dot.code/deobfuscators/Eazfuscator_NET/DecrypterType.cs
+++ b/de4dot.code/deobfuscators/Eazfuscator_NET/DecrypterType.cs
@@ -26,7 +26,7 @@ using de4dot.blocks;
namespace de4dot.code.deobfuscators.Eazfuscator_NET {
class DecrypterType {
- ModuleDefinition module;
+ ModuleDefMD module;
ISimpleDeobfuscator simpleDeobfuscator;
TypeDef type;
MethodDef int64Method;
@@ -50,7 +50,7 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
get { return type != null; }
}
- public DecrypterType(ModuleDefinition module, ISimpleDeobfuscator simpleDeobfuscator) {
+ public DecrypterType(ModuleDefMD module, ISimpleDeobfuscator simpleDeobfuscator) {
this.module = module;
this.simpleDeobfuscator = simpleDeobfuscator;
}
@@ -338,9 +338,9 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
var bytes = new List();
if (module.Assembly != null) {
- if (module.Assembly.Name.PublicKeyToken != null)
- bytes.AddRange(module.Assembly.Name.PublicKeyToken);
- bytes.AddRange(Encoding.Unicode.GetBytes(module.Assembly.Name.Name));
+ if (!PublicKeyBase.IsNullOrEmpty2(module.Assembly.PublicKey))
+ bytes.AddRange(module.Assembly.PublicKeyToken.Data);
+ bytes.AddRange(Encoding.Unicode.GetBytes(module.Assembly.Name.String));
}
int cm1 = constMethod1();
bytes.Add((byte)(type.MDToken.ToInt32() >> 24));
diff --git a/de4dot.code/deobfuscators/Eazfuscator_NET/EfConstantsReader.cs b/de4dot.code/deobfuscators/Eazfuscator_NET/EfConstantsReader.cs
index fcd09ef8..952535f6 100644
--- a/de4dot.code/deobfuscators/Eazfuscator_NET/EfConstantsReader.cs
+++ b/de4dot.code/deobfuscators/Eazfuscator_NET/EfConstantsReader.cs
@@ -18,7 +18,6 @@
*/
using dot10.DotNet;
-using Mono.Cecil.Metadata;
using de4dot.blocks;
namespace de4dot.code.deobfuscators.Eazfuscator_NET {
@@ -38,10 +37,10 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
if (!getInt32(ref index, out value))
break;
var stloc = instructions[index];
- if (!DotNetUtils.isStloc(stloc))
+ if (!stloc.IsStloc())
break;
- var local = DotNetUtils.getLocalVar(locals, stloc);
- if (local == null || local.VariableType.EType != ElementType.I4)
+ var local = stloc.GetLocal(locals);
+ if (local == null || local.Type.GetElementType() != ElementType.I4)
break;
localsValuesInt32[local] = value;
index++;
diff --git a/de4dot.code/deobfuscators/Eazfuscator_NET/ResourceMethodsRestorer.cs b/de4dot.code/deobfuscators/Eazfuscator_NET/ResourceMethodsRestorer.cs
index 70be4e2b..81808c06 100644
--- a/de4dot.code/deobfuscators/Eazfuscator_NET/ResourceMethodsRestorer.cs
+++ b/de4dot.code/deobfuscators/Eazfuscator_NET/ResourceMethodsRestorer.cs
@@ -33,7 +33,7 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
get { return getManifestResourceStreamTypeResource; }
}
- public ResourceMethodsRestorer(ModuleDefinition module)
+ public ResourceMethodsRestorer(ModuleDefMD module)
: base(module) {
}
@@ -45,7 +45,7 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
continue;
if (DotNetUtils.getField(type, "System.Reflection.Assembly") == null)
continue;
- if (DotNetUtils.getMethod(type, ".cctor") == null)
+ if (type.FindStaticConstructor() == null)
continue;
var getStream2 = getTheOnlyMethod(type, "System.IO.Stream", "(System.Reflection.Assembly,System.Type,System.String)");
diff --git a/de4dot.code/deobfuscators/Eazfuscator_NET/ResourceResolver.cs b/de4dot.code/deobfuscators/Eazfuscator_NET/ResourceResolver.cs
index f4415287..812b9614 100644
--- a/de4dot.code/deobfuscators/Eazfuscator_NET/ResourceResolver.cs
+++ b/de4dot.code/deobfuscators/Eazfuscator_NET/ResourceResolver.cs
@@ -26,7 +26,7 @@ using de4dot.blocks;
namespace de4dot.code.deobfuscators.Eazfuscator_NET {
class ResourceResolver {
- ModuleDefinition module;
+ ModuleDefMD module;
AssemblyResolver assemblyResolver;
TypeDef resolverType;
MethodDef initMethod;
@@ -45,7 +45,7 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
get { return resolverType != null; }
}
- public ResourceResolver(ModuleDefinition module, AssemblyResolver assemblyResolver) {
+ public ResourceResolver(ModuleDefMD module, AssemblyResolver assemblyResolver) {
this.module = module;
this.assemblyResolver = assemblyResolver;
}
diff --git a/de4dot.code/deobfuscators/Eazfuscator_NET/StringDecrypter.cs b/de4dot.code/deobfuscators/Eazfuscator_NET/StringDecrypter.cs
index ca6c0423..6b646683 100644
--- a/de4dot.code/deobfuscators/Eazfuscator_NET/StringDecrypter.cs
+++ b/de4dot.code/deobfuscators/Eazfuscator_NET/StringDecrypter.cs
@@ -23,12 +23,11 @@ using System.IO;
using System.Text;
using dot10.DotNet;
using dot10.DotNet.Emit;
-using Mono.Cecil.Metadata;
using de4dot.blocks;
namespace de4dot.code.deobfuscators.Eazfuscator_NET {
class StringDecrypter {
- ModuleDefinition module;
+ ModuleDefMD module;
TypeDef stringType;
MethodDef stringMethod;
TypeDef dataDecrypterType;
@@ -102,7 +101,7 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
get { return stringType != null; }
}
- public StringDecrypter(ModuleDefinition module, DecrypterType decrypterType) {
+ public StringDecrypter(ModuleDefMD module, DecrypterType decrypterType) {
this.module = module;
this.decrypterType = decrypterType;
}
@@ -110,7 +109,7 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
static bool checkIfV32OrLater(TypeDef type) {
int numInts = 0;
foreach (var field in type.Fields) {
- if (field.FieldType.EType == ElementType.I4)
+ if (field.FieldSig.GetFieldType().GetElementType() == ElementType.I4)
numInts++;
}
return numInts >= 2;
@@ -161,7 +160,7 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
};
static StreamHelperType findStreamHelperType(TypeDef type) {
foreach (var field in type.Fields) {
- var nested = field.FieldType as TypeDef;
+ var nested = field.FieldSig.GetFieldType().TryGetTypeDef();
if (nested == null)
continue;
if (nested.DeclaringType != type)
@@ -197,7 +196,7 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
foreach (var instr in method.Body.Instructions) {
if (instr.OpCode != OpCodes.Callvirt)
continue;
- var calledMethod = instr.Operand as MethodReference;
+ var calledMethod = instr.Operand as IMethod;
if (calledMethod != null && calledMethod.FullName == "System.IO.Stream System.Reflection.Assembly::GetManifestResourceStream(System.String)")
return true;
}
@@ -248,7 +247,7 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
if (!findInts(out initializedAll))
return false;
- var cctor = DotNetUtils.getMethod(stringType, ".cctor");
+ var cctor = stringType.FindStaticConstructor();
if (!initializedAll && cctor != null) {
simpleDeobfuscator.deobfuscate(cctor);
if (!findIntsCctor(cctor))
@@ -292,10 +291,10 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
}
class FlagsInfo {
- public VariableDefinition Local { get; set; }
+ public Local Local { get; set; }
public uint Value { get; set; }
public int Offset { get; set; }
- public FlagsInfo(VariableDefinition local, uint value, int offset) {
+ public FlagsInfo(Local local, uint value, int offset) {
Local = local;
Value = value;
Offset = offset;
@@ -307,7 +306,7 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
if (flags == null)
return false;
- flags.Sort((a, b) => Utils.compareInt32(a.Offset, b.Offset));
+ flags.Sort((a, b) => a.Offset.CompareTo(b.Offset));
rldFlag = flags[0].Value;
bytesFlag = flags[1].Value;
@@ -344,13 +343,13 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
return null;
}
- static int getFlagsOffset(MethodDef method, int index, VariableDefinition local) {
+ static int getFlagsOffset(MethodDef method, int index, Local local) {
var instrs = method.Body.Instructions;
for (; index < instrs.Count; index++) {
var ldloc = instrs[index];
- if (!DotNetUtils.isLdloc(ldloc))
+ if (!ldloc.IsLdloc())
continue;
- if (DotNetUtils.getLocalVar(method.Body.Variables, ldloc) != local)
+ if (ldloc.GetLocal(method.Body.LocalList) != local)
continue;
return index;
@@ -358,7 +357,7 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
return -1;
}
- static VariableDefinition getFlagsLocal(MethodDef method, int index) {
+ static Local getFlagsLocal(MethodDef method, int index) {
var instrs = method.Body.Instructions;
if (index + 5 >= instrs.Count)
return null;
@@ -373,9 +372,9 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
if (instrs[index++].OpCode.Code != Code.Ceq)
return null;
var stloc = instrs[index++];
- if (!DotNetUtils.isStloc(stloc))
+ if (!stloc.IsStloc())
return null;
- return DotNetUtils.getLocalVar(method.Body.Variables, stloc);
+ return stloc.GetLocal(method.Body.LocalList);
}
void initialize() {
@@ -415,10 +414,10 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
var bytes = reader.ReadBytes(flags & 0x1FFFFFFF);
decrypt1(bytes, tmpKey);
- var pkt = module.Assembly.Name.PublicKeyToken;
- if (usePublicKeyToken && pkt != null && pkt.Length != 0) {
+ var pkt = PublicKeyBase.ToPublicKeyToken(module.Assembly.PublicKey);
+ if (usePublicKeyToken && !PublicKeyBase.IsNullOrEmpty2(pkt)) {
for (int i = 0; i < bytes.Length; i++)
- bytes[i] ^= (byte)((pkt[i & 7] >> 5) + (pkt[i & 7] << 3));
+ bytes[i] ^= (byte)((pkt.Data[i & 7] >> 5) + (pkt.Data[i & 7] << 3));
}
if ((flags & rldFlag) != 0)
@@ -605,9 +604,9 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
int tmp;
if (!stringMethodConsts.getNextInt32(ref i, out tmp))
continue;
- if ((instrs[i - 1].OpCode.Code == Code.Xor && DotNetUtils.isStloc(instrs[i])) ||
- (instrs[i].OpCode.Code == Code.Xor && DotNetUtils.isStloc(instrs[i + 1])) ||
- DotNetUtils.isLdloc(instrs[i])) {
+ if ((instrs[i - 1].OpCode.Code == Code.Xor && instrs[i].IsStloc()) ||
+ (instrs[i].OpCode.Code == Code.Xor && instrs[i + 1].IsStloc()) ||
+ instrs[i].IsLdloc()) {
i2 ^= tmp;
returnValue = true;
}
@@ -637,10 +636,10 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
var instr = instrs[i + 2];
if (instr.OpCode.Code == Code.Ldsfld) {
var loadField = instr.Operand as FieldDef;
- if (loadField == null || loadField.FieldType.EType != ElementType.I4)
+ if (loadField == null || loadField.FieldType.GetElementType() != ElementType.I4)
continue;
}
- else if (DotNetUtils.isLdcI4(instr)) {
+ else if (instr.IsLdcI4()) {
initializedAll = true;
}
else
@@ -674,7 +673,7 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
int tmp4;
if (!constantsReader.getNextInt32(ref index, out tmp4))
break;
- if (index < instrs.Count && DotNetUtils.isLdloc(instrs[index]))
+ if (index < instrs.Count && instrs[index].IsLdloc())
tmp3 = tmp4;
}
@@ -715,7 +714,7 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
continue;
var ldci4 = instrs[i + 1];
- if (!DotNetUtils.isLdcI4(ldci4))
+ if (!ldci4.IsLdcI4())
continue;
int index = i + 1;
@@ -755,7 +754,7 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
if (instrs[index++].OpCode.Code != Code.Xor)
continue;
- if (!DotNetUtils.isLdloc(instrs[index++]))
+ if (!instrs[index++].IsLdloc())
continue;
if (instrs[index++].OpCode.Code != Code.Xor)
@@ -811,9 +810,9 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
if (index <= 0)
continue;
var ldci4 = stringMethod.Body.Instructions[index - 1];
- if (!DotNetUtils.isLdcI4(ldci4))
+ if (!ldci4.IsLdcI4())
continue;
- if (DotNetUtils.getLdcI4Value(ldci4) != 4)
+ if (ldci4.GetLdcI4Value() != 4)
continue;
if (!stringMethodConsts.getNextInt32(ref index, out i5))
return false;
@@ -848,7 +847,7 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
if (!findCallvirt(method, ref index))
return false;
- var calledMethod = method.Body.Instructions[index].Operand as MethodReference;
+ var calledMethod = method.Body.Instructions[index].Operand as IMethod;
if (calledMethod == null)
continue;
if (calledMethod.ToString() != methodFullName)
diff --git a/de4dot.code/deobfuscators/Eazfuscator_NET/VersionDetector.cs b/de4dot.code/deobfuscators/Eazfuscator_NET/VersionDetector.cs
index 576413e7..878aaf37 100644
--- a/de4dot.code/deobfuscators/Eazfuscator_NET/VersionDetector.cs
+++ b/de4dot.code/deobfuscators/Eazfuscator_NET/VersionDetector.cs
@@ -27,7 +27,7 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
StringDecrypter stringDecrypter;
FrameworkType frameworkType;
- public VersionDetector(ModuleDefinition module, StringDecrypter stringDecrypter) {
+ public VersionDetector(ModuleDefMD module, StringDecrypter stringDecrypter) {
this.stringDecrypter = stringDecrypter;
this.frameworkType = DotNetUtils.getFrameworkType(module);
}
@@ -52,7 +52,6 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
return null;
bool hasConstantM2 = DeobUtils.hasInteger(decryptStringMethod, -2);
- var frameworkType = DotNetUtils.getFrameworkType(decryptStringType.Module);
/////////////////////////////////////////////////////////////////
/////////////////////////////////////////////////////////////////
@@ -77,11 +76,11 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
if (otherMethods.Count == 0 &&
decryptStringType.NestedTypes.Count == 0 &&
!hasConstantM2 &&
- !decryptStringMethod.NoInlining &&
+ !decryptStringMethod.IsNoInlining &&
decryptStringMethod.IsPublic &&
decryptStringMethod.IsSynchronized &&
- decryptStringMethod.Body.MaxStackSize >= 35 &&
- decryptStringMethod.Body.MaxStackSize <= 50 &&
+ decryptStringMethod.Body.MaxStack >= 35 &&
+ decryptStringMethod.Body.MaxStack <= 50 &&
decryptStringMethod.Body.ExceptionHandlers.Count == 0 &&
new LocalTypes(decryptStringMethod).exactly(locals11) &&
checkTypeFields(fields11)) {
@@ -113,11 +112,11 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
if (otherMethods.Count == 0 &&
decryptStringType.NestedTypes.Count == 0 &&
!hasConstantM2 &&
- !decryptStringMethod.NoInlining &&
+ !decryptStringMethod.IsNoInlining &&
decryptStringMethod.IsPublic &&
decryptStringMethod.IsSynchronized &&
- decryptStringMethod.Body.MaxStackSize >= 35 &&
- decryptStringMethod.Body.MaxStackSize <= 50 &&
+ decryptStringMethod.Body.MaxStack >= 35 &&
+ decryptStringMethod.Body.MaxStack <= 50 &&
decryptStringMethod.Body.ExceptionHandlers.Count == 0 &&
new LocalTypes(decryptStringMethod).exactly(locals13) &&
checkTypeFields(fields13)) {
@@ -149,11 +148,11 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
if (otherMethods.Count == 0 &&
decryptStringType.NestedTypes.Count == 0 &&
!hasConstantM2 &&
- !decryptStringMethod.NoInlining &&
+ !decryptStringMethod.IsNoInlining &&
decryptStringMethod.IsPublic &&
decryptStringMethod.IsSynchronized &&
- decryptStringMethod.Body.MaxStackSize >= 150 &&
- decryptStringMethod.Body.MaxStackSize <= 200 &&
+ decryptStringMethod.Body.MaxStack >= 150 &&
+ decryptStringMethod.Body.MaxStack <= 200 &&
decryptStringMethod.Body.ExceptionHandlers.Count == 0 &&
new LocalTypes(decryptStringMethod).exactly(locals14) &&
checkTypeFields(fields14)) {
@@ -186,11 +185,11 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
if (otherMethods.Count == 0 &&
decryptStringType.NestedTypes.Count == 0 &&
!hasConstantM2 &&
- !decryptStringMethod.NoInlining &&
+ !decryptStringMethod.IsNoInlining &&
decryptStringMethod.IsPublic &&
decryptStringMethod.IsSynchronized &&
- decryptStringMethod.Body.MaxStackSize >= 1 &&
- decryptStringMethod.Body.MaxStackSize <= 8 &&
+ decryptStringMethod.Body.MaxStack >= 1 &&
+ decryptStringMethod.Body.MaxStack <= 8 &&
decryptStringMethod.Body.ExceptionHandlers.Count == 0 &&
new LocalTypes(decryptStringMethod).exactly(locals24) &&
checkTypeFields(fields24)) {
@@ -224,11 +223,11 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
if (otherMethods.Count == 0 &&
decryptStringType.NestedTypes.Count == 0 &&
!hasConstantM2 &&
- !decryptStringMethod.NoInlining &&
+ !decryptStringMethod.IsNoInlining &&
decryptStringMethod.IsPublic &&
!decryptStringMethod.IsSynchronized &&
- decryptStringMethod.Body.MaxStackSize >= 1 &&
- decryptStringMethod.Body.MaxStackSize <= 8 &&
+ decryptStringMethod.Body.MaxStack >= 1 &&
+ decryptStringMethod.Body.MaxStack <= 8 &&
decryptStringMethod.Body.ExceptionHandlers.Count == 1 &&
new LocalTypes(decryptStringMethod).exactly(locals26) &&
checkTypeFields(fields26)) {
@@ -262,11 +261,11 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
if (otherMethods.Count == 0 &&
decryptStringType.NestedTypes.Count == 0 &&
!hasConstantM2 &&
- decryptStringMethod.NoInlining &&
+ decryptStringMethod.IsNoInlining &&
decryptStringMethod.IsPublic &&
!decryptStringMethod.IsSynchronized &&
- decryptStringMethod.Body.MaxStackSize >= 1 &&
- decryptStringMethod.Body.MaxStackSize <= 8 &&
+ decryptStringMethod.Body.MaxStack >= 1 &&
+ decryptStringMethod.Body.MaxStack <= 8 &&
decryptStringMethod.Body.ExceptionHandlers.Count == 1 &&
new LocalTypes(decryptStringMethod).exactly(locals27) &&
checkTypeFields(fields27)) {
@@ -301,11 +300,11 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
if (otherMethods.Count == 0 &&
decryptStringType.NestedTypes.Count == 0 &&
!hasConstantM2 &&
- decryptStringMethod.NoInlining &&
+ decryptStringMethod.IsNoInlining &&
decryptStringMethod.IsAssembly &&
!decryptStringMethod.IsSynchronized &&
- decryptStringMethod.Body.MaxStackSize >= 1 &&
- decryptStringMethod.Body.MaxStackSize <= 8 &&
+ decryptStringMethod.Body.MaxStack >= 1 &&
+ decryptStringMethod.Body.MaxStack <= 8 &&
decryptStringMethod.Body.ExceptionHandlers.Count == 1 &&
new LocalTypes(decryptStringMethod).exactly(locals28) &&
checkTypeFields(fields28)) {
@@ -344,11 +343,11 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
if (otherMethods.Count == 0 &&
decryptStringType.NestedTypes.Count == 0 &&
!hasConstantM2 &&
- decryptStringMethod.NoInlining &&
+ decryptStringMethod.IsNoInlining &&
decryptStringMethod.IsAssembly &&
!decryptStringMethod.IsSynchronized &&
- decryptStringMethod.Body.MaxStackSize >= 1 &&
- decryptStringMethod.Body.MaxStackSize <= 8 &&
+ decryptStringMethod.Body.MaxStack >= 1 &&
+ decryptStringMethod.Body.MaxStack <= 8 &&
(decryptStringMethod.Body.ExceptionHandlers.Count == 1 || decryptStringMethod.Body.ExceptionHandlers.Count == 2) &&
new LocalTypes(decryptStringMethod).exactly(locals29) &&
checkTypeFields(fields29)) {
@@ -394,11 +393,11 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
otherMethods[0].IsStatic &&
new LocalTypes(otherMethods[0]).exactly(olocals30) &&
!hasConstantM2 &&
- decryptStringMethod.NoInlining &&
+ decryptStringMethod.IsNoInlining &&
decryptStringMethod.IsAssembly &&
!decryptStringMethod.IsSynchronized &&
- decryptStringMethod.Body.MaxStackSize >= 1 &&
- decryptStringMethod.Body.MaxStackSize <= 8 &&
+ decryptStringMethod.Body.MaxStack >= 1 &&
+ decryptStringMethod.Body.MaxStack <= 8 &&
(decryptStringMethod.Body.ExceptionHandlers.Count == 1 || decryptStringMethod.Body.ExceptionHandlers.Count == 2) &&
new LocalTypes(decryptStringMethod).exactly(locals30) &&
checkTypeFields(fields30)) {
@@ -444,11 +443,11 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
otherMethods[0].IsStatic &&
new LocalTypes(otherMethods[0]).exactly(olocals31) &&
hasConstantM2 &&
- decryptStringMethod.NoInlining &&
+ decryptStringMethod.IsNoInlining &&
decryptStringMethod.IsAssembly &&
!decryptStringMethod.IsSynchronized &&
- decryptStringMethod.Body.MaxStackSize >= 1 &&
- decryptStringMethod.Body.MaxStackSize <= 8 &&
+ decryptStringMethod.Body.MaxStack >= 1 &&
+ decryptStringMethod.Body.MaxStack <= 8 &&
(decryptStringMethod.Body.ExceptionHandlers.Count == 1 || decryptStringMethod.Body.ExceptionHandlers.Count == 2) &&
new LocalTypes(decryptStringMethod).exactly(locals31) &&
checkTypeFields(fields31)) {
@@ -496,11 +495,11 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
otherMethods[0].IsStatic &&
new LocalTypes(otherMethods[0]).exactly(olocals32) &&
hasConstantM2 &&
- decryptStringMethod.NoInlining &&
+ decryptStringMethod.IsNoInlining &&
decryptStringMethod.IsAssembly &&
!decryptStringMethod.IsSynchronized &&
- decryptStringMethod.Body.MaxStackSize >= 1 &&
- decryptStringMethod.Body.MaxStackSize <= 8 &&
+ decryptStringMethod.Body.MaxStack >= 1 &&
+ decryptStringMethod.Body.MaxStack <= 8 &&
(decryptStringMethod.Body.ExceptionHandlers.Count == 1 || decryptStringMethod.Body.ExceptionHandlers.Count == 2) &&
new LocalTypes(decryptStringMethod).exactly(locals32) &&
checkTypeFields(fields32)) {
@@ -551,11 +550,11 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
otherMethods[0].IsStatic &&
new LocalTypes(otherMethods[0]).exactly(olocals33) &&
hasConstantM2 &&
- decryptStringMethod.NoInlining &&
+ decryptStringMethod.IsNoInlining &&
decryptStringMethod.IsAssembly &&
!decryptStringMethod.IsSynchronized &&
- decryptStringMethod.Body.MaxStackSize >= 1 &&
- decryptStringMethod.Body.MaxStackSize <= 8 &&
+ decryptStringMethod.Body.MaxStack >= 1 &&
+ decryptStringMethod.Body.MaxStack <= 8 &&
(decryptStringMethod.Body.ExceptionHandlers.Count == 1 || decryptStringMethod.Body.ExceptionHandlers.Count == 2) &&
new LocalTypes(decryptStringMethod).exactly(locals33) &&
checkTypeFields(fields33)) {
@@ -606,11 +605,11 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
otherMethods[0].IsPrivate &&
otherMethods[0].IsStatic &&
new LocalTypes(otherMethods[0]).exactly(olocals33) &&
- decryptStringMethod.NoInlining &&
+ decryptStringMethod.IsNoInlining &&
decryptStringMethod.IsAssembly &&
!decryptStringMethod.IsSynchronized &&
- decryptStringMethod.Body.MaxStackSize >= 1 &&
- decryptStringMethod.Body.MaxStackSize <= 8 &&
+ decryptStringMethod.Body.MaxStack >= 1 &&
+ decryptStringMethod.Body.MaxStack <= 8 &&
(decryptStringMethod.Body.ExceptionHandlers.Count == 1 || decryptStringMethod.Body.ExceptionHandlers.Count == 2) &&
new LocalTypes(decryptStringMethod).exactly(locals33) &&
checkTypeFields(fields33)) {
@@ -656,11 +655,11 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
otherMethods[0].IsPrivate &&
otherMethods[0].IsStatic &&
new LocalTypes(otherMethods[0]).exactly(olocals33_149) &&
- decryptStringMethod.NoInlining &&
+ decryptStringMethod.IsNoInlining &&
decryptStringMethod.IsAssembly &&
!decryptStringMethod.IsSynchronized &&
- decryptStringMethod.Body.MaxStackSize >= 1 &&
- decryptStringMethod.Body.MaxStackSize <= 8 &&
+ decryptStringMethod.Body.MaxStack >= 1 &&
+ decryptStringMethod.Body.MaxStack <= 8 &&
(decryptStringMethod.Body.ExceptionHandlers.Count == 1 || decryptStringMethod.Body.ExceptionHandlers.Count == 2) &&
new LocalTypes(decryptStringMethod).exactly(locals33_149) &&
checkTypeFields(fields33_149)) {
@@ -684,7 +683,7 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
if (fieldIndex >= type.Fields.Count)
return null;
- var nestedType = type.Fields[fieldIndex].FieldType as TypeDef;
+ var nestedType = type.Fields[fieldIndex].FieldType.TryGetTypeDef();
if (nestedType == null || type.NestedTypes.IndexOf(nestedType) < 0)
return null;
diff --git a/de4dot.cui/Program.cs b/de4dot.cui/Program.cs
index 952af0ea..11a04d8f 100644
--- a/de4dot.cui/Program.cs
+++ b/de4dot.cui/Program.cs
@@ -48,8 +48,8 @@ namespace de4dot.cui {
new de4dot.code.deobfuscators.Dotfuscator.DeobfuscatorInfo(),
new de4dot.code.deobfuscators.dotNET_Reactor.v3.DeobfuscatorInfo(),
new de4dot.code.deobfuscators.dotNET_Reactor.v4.DeobfuscatorInfo(),
-#if PORT
new de4dot.code.deobfuscators.Eazfuscator_NET.DeobfuscatorInfo(),
+#if PORT
new de4dot.code.deobfuscators.Goliath_NET.DeobfuscatorInfo(),
new de4dot.code.deobfuscators.ILProtector.DeobfuscatorInfo(),
new de4dot.code.deobfuscators.MaxtoCode.DeobfuscatorInfo(),