Remove string decrypter type
This commit is contained in:
parent
98c8ea49e9
commit
c757139357
|
@ -183,6 +183,9 @@ namespace de4dot.code.deobfuscators.CodeVeil {
|
|||
return stringDecrypter.decrypt((int)args[0]);
|
||||
});
|
||||
DeobfuscatedFile.stringDecryptersAdded();
|
||||
addModuleCctorInitCallToBeRemoved(stringDecrypter.InitMethod);
|
||||
addCallToBeRemoved(mainType.getInitStringDecrypterMethod(stringDecrypter.InitMethod), stringDecrypter.InitMethod);
|
||||
addTypeToBeRemoved(stringDecrypter.Type, "String decrypter type");
|
||||
}
|
||||
|
||||
assemblyResolver = new AssemblyResolver(module);
|
||||
|
|
|
@ -189,5 +189,28 @@ namespace de4dot.code.deobfuscators.CodeVeil {
|
|||
|
||||
return null;
|
||||
}
|
||||
|
||||
public MethodDefinition getInitStringDecrypterMethod(MethodDefinition stringDecrypterInitMethod) {
|
||||
if (stringDecrypterInitMethod == null)
|
||||
return null;
|
||||
if (theType == null)
|
||||
return null;
|
||||
|
||||
foreach (var method in theType.Methods) {
|
||||
if (!method.IsStatic || method.Body == null)
|
||||
continue;
|
||||
if (callsMethod(method, stringDecrypterInitMethod))
|
||||
return method;
|
||||
}
|
||||
return null;
|
||||
}
|
||||
|
||||
bool callsMethod(MethodDefinition methodToCheck, MethodDefinition calledMethod) {
|
||||
foreach (var info in DotNetUtils.getCalledMethods(module, methodToCheck)) {
|
||||
if (info.Item2 == calledMethod)
|
||||
return true;
|
||||
}
|
||||
return false;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
|
@ -37,6 +37,14 @@ namespace de4dot.code.deobfuscators.CodeVeil {
|
|||
get { return decrypterType != null; }
|
||||
}
|
||||
|
||||
public TypeDefinition Type {
|
||||
get { return decrypterType; }
|
||||
}
|
||||
|
||||
public MethodDefinition InitMethod {
|
||||
get { return initMethod; }
|
||||
}
|
||||
|
||||
public MethodDefinition DecryptMethod {
|
||||
get { return decrypterMethod; }
|
||||
}
|
||||
|
@ -180,6 +188,9 @@ namespace de4dot.code.deobfuscators.CodeVeil {
|
|||
throw new ApplicationException("Could not find string decrypter key");
|
||||
|
||||
decryptStrings(key);
|
||||
|
||||
stringDataField.FieldType = module.TypeSystem.Byte;
|
||||
stringDataField.InitialValue = new byte[1];
|
||||
}
|
||||
|
||||
static uint[] getKey(MethodDefinition method) {
|
||||
|
|
Loading…
Reference in New Issue
Block a user