diff --git a/de4dot.code/deobfuscators/CodeFort/AssemblyDecrypter.cs b/de4dot.code/deobfuscators/CodeFort/AssemblyDecrypter.cs index bd6fd3d2..7818be97 100644 --- a/de4dot.code/deobfuscators/CodeFort/AssemblyDecrypter.cs +++ b/de4dot.code/deobfuscators/CodeFort/AssemblyDecrypter.cs @@ -59,8 +59,12 @@ namespace de4dot.code.deobfuscators.CodeFort { get { return assemblyEncryptedResource != null; } } + public bool MainAssemblyHasAssemblyResolver { + get { return embedInitMethod != null; } + } + public bool Detected { - get { return EncryptedDetected || embedInitMethod != null; ; } + get { return EncryptedDetected || MainAssemblyHasAssemblyResolver; } } public TypeDefinition Type { diff --git a/de4dot.code/deobfuscators/CodeFort/Deobfuscator.cs b/de4dot.code/deobfuscators/CodeFort/Deobfuscator.cs index d47dc518..2a033d61 100644 --- a/de4dot.code/deobfuscators/CodeFort/Deobfuscator.cs +++ b/de4dot.code/deobfuscators/CodeFort/Deobfuscator.cs @@ -29,9 +29,11 @@ namespace de4dot.code.deobfuscators.CodeFort { public const string THE_NAME = "CodeFort"; public const string THE_TYPE = "cf"; const string DEFAULT_REGEX = @"!^[_<>{}$.`-]$&" + DeobfuscatorBase.DEFAULT_VALID_NAME_REGEX; + BoolOption dumpEmbeddedAssemblies; public DeobfuscatorInfo() : base(DEFAULT_REGEX) { + dumpEmbeddedAssemblies = new BoolOption(null, makeArgName("embedded"), "Dump embedded assemblies", true); } public override string Name { @@ -45,11 +47,13 @@ namespace de4dot.code.deobfuscators.CodeFort { public override IDeobfuscator createDeobfuscator() { return new Deobfuscator(new Deobfuscator.Options { ValidNameRegex = validNameRegex.get(), + DumpEmbeddedAssemblies = dumpEmbeddedAssemblies.get(), }); } protected override IEnumerable