monocul.us/de4dot-cex
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add an option to disable dumping embedded assemblies

Browse Source
This commit is contained in:
de4dot 2012-06-01 12:01:45 +02:00
parent 58b62ff914
commit cd2851baf4
2 changed files with 12 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
de4dot.code/deobfuscators/CodeFort/AssemblyDecrypter.cs
View File

@ -59,8 +59,12 @@ namespace de4dot.code.deobfuscators.CodeFort {
get { return assemblyEncryptedResource != null; }
}
public bool MainAssemblyHasAssemblyResolver {
get { return embedInitMethod != null; }
}
public bool Detected {
get { return EncryptedDetected || embedInitMethod != null; ; }
get { return EncryptedDetected || MainAssemblyHasAssemblyResolver; }
}
public TypeDefinition Type {

7
de4dot.code/deobfuscators/CodeFort/Deobfuscator.cs
View File

@ -29,9 +29,11 @@ namespace de4dot.code.deobfuscators.CodeFort {
public const string THE_NAME = "CodeFort";
public const string THE_TYPE = "cf";
const string DEFAULT_REGEX = @"!^[_<>{}$.`-]$&" + DeobfuscatorBase.DEFAULT_VALID_NAME_REGEX;
BoolOption dumpEmbeddedAssemblies;
public DeobfuscatorInfo()
: base(DEFAULT_REGEX) {
dumpEmbeddedAssemblies = new BoolOption(null, makeArgName("embedded"), "Dump embedded assemblies", true);
}
public override string Name {
@ -45,11 +47,13 @@ namespace de4dot.code.deobfuscators.CodeFort {
public override IDeobfuscator createDeobfuscator() {
return new Deobfuscator(new Deobfuscator.Options {
ValidNameRegex = validNameRegex.get(),
DumpEmbeddedAssemblies = dumpEmbeddedAssemblies.get(),
});
}
protected override IEnumerable<Option> getOptionsInternal() {
return new List<Option>() {
dumpEmbeddedAssemblies,
};
}
}
@ -61,6 +65,7 @@ namespace de4dot.code.deobfuscators.CodeFort {
AssemblyDecrypter assemblyDecrypter;
internal class Options : OptionsBase {
public bool DumpEmbeddedAssemblies { get; set; }
}
public override string Type {
@ -140,6 +145,8 @@ namespace de4dot.code.deobfuscators.CodeFort {
}
void dumpEmbeddedAssemblies() {
if (assemblyDecrypter.MainAssemblyHasAssemblyResolver && !options.DumpEmbeddedAssemblies)
return;
foreach (var info in assemblyDecrypter.getAssemblyInfos(DeobfuscatedFile, this)) {
DeobfuscatedFile.createAssemblyFile(info.data, info.asmSimpleName, info.extension);
addResourceToBeRemoved(info.resource, string.Format("Embedded assembly: {0}", info.asmFullName));