Remove string decrypter type

This commit is contained in:
de4dot 2012-02-08 18:58:06 +01:00
parent 98c8ea49e9
commit c757139357
3 changed files with 37 additions and 0 deletions

View File

@ -183,6 +183,9 @@ namespace de4dot.code.deobfuscators.CodeVeil {
return stringDecrypter.decrypt((int)args[0]);
});
DeobfuscatedFile.stringDecryptersAdded();
addModuleCctorInitCallToBeRemoved(stringDecrypter.InitMethod);
addCallToBeRemoved(mainType.getInitStringDecrypterMethod(stringDecrypter.InitMethod), stringDecrypter.InitMethod);
addTypeToBeRemoved(stringDecrypter.Type, "String decrypter type");
}
assemblyResolver = new AssemblyResolver(module);

View File

@ -189,5 +189,28 @@ namespace de4dot.code.deobfuscators.CodeVeil {
return null;
}
public MethodDefinition getInitStringDecrypterMethod(MethodDefinition stringDecrypterInitMethod) {
if (stringDecrypterInitMethod == null)
return null;
if (theType == null)
return null;
foreach (var method in theType.Methods) {
if (!method.IsStatic || method.Body == null)
continue;
if (callsMethod(method, stringDecrypterInitMethod))
return method;
}
return null;
}
bool callsMethod(MethodDefinition methodToCheck, MethodDefinition calledMethod) {
foreach (var info in DotNetUtils.getCalledMethods(module, methodToCheck)) {
if (info.Item2 == calledMethod)
return true;
}
return false;
}
}
}

View File

@ -37,6 +37,14 @@ namespace de4dot.code.deobfuscators.CodeVeil {
get { return decrypterType != null; }
}
public TypeDefinition Type {
get { return decrypterType; }
}
public MethodDefinition InitMethod {
get { return initMethod; }
}
public MethodDefinition DecryptMethod {
get { return decrypterMethod; }
}
@ -180,6 +188,9 @@ namespace de4dot.code.deobfuscators.CodeVeil {
throw new ApplicationException("Could not find string decrypter key");
decryptStrings(key);
stringDataField.FieldType = module.TypeSystem.Byte;
stringDataField.InitialValue = new byte[1];
}
static uint[] getKey(MethodDefinition method) {