Update CO resource class detector code
This commit is contained in:
parent
83e3cc0f57
commit
d410d80815
|
@ -48,17 +48,11 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
|
||||||
|
|
||||||
void Find(ISimpleDeobfuscator simpleDeobfuscator) {
|
void Find(ISimpleDeobfuscator simpleDeobfuscator) {
|
||||||
switch (frameworkType) {
|
switch (frameworkType) {
|
||||||
case FrameworkType.Desktop:
|
|
||||||
if (!module.IsClr1x)
|
|
||||||
FindDesktopOrCompactFramework();
|
|
||||||
else
|
|
||||||
FindDesktopOrCompactFrameworkV1();
|
|
||||||
break;
|
|
||||||
|
|
||||||
case FrameworkType.Silverlight:
|
case FrameworkType.Silverlight:
|
||||||
FindSilverlight();
|
FindSilverlight();
|
||||||
break;
|
break;
|
||||||
|
|
||||||
|
case FrameworkType.Desktop:
|
||||||
case FrameworkType.CompactFramework:
|
case FrameworkType.CompactFramework:
|
||||||
if (!module.IsClr1x) {
|
if (!module.IsClr1x) {
|
||||||
if (FindDesktopOrCompactFramework())
|
if (FindDesktopOrCompactFramework())
|
||||||
|
@ -243,11 +237,9 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
|
||||||
return true;
|
return true;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
else {
|
if (constants.Count == 1) {
|
||||||
if (constants.Count == 1) {
|
desEncryptedFlag = (byte)constants[0];
|
||||||
desEncryptedFlag = (byte)constants[0];
|
return true;
|
||||||
return true;
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
break;
|
break;
|
||||||
|
|
||||||
|
@ -302,6 +294,8 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
|
||||||
yield return method;
|
yield return method;
|
||||||
else if (DotNetUtils.IsMethod(method, "System.Byte[]", "(System.Int64,System.IO.Stream)"))
|
else if (DotNetUtils.IsMethod(method, "System.Byte[]", "(System.Int64,System.IO.Stream)"))
|
||||||
yield return method;
|
yield return method;
|
||||||
|
else if (DotNetUtils.IsMethod(method, "System.Byte[]", "(System.Int64,System.IO.Stream,System.UInt32)"))
|
||||||
|
yield return method;
|
||||||
else if (DotNetUtils.IsMethod(method, "System.Byte[]", "(System.Int32,System.IO.Stream)"))
|
else if (DotNetUtils.IsMethod(method, "System.Byte[]", "(System.Int32,System.IO.Stream)"))
|
||||||
yield return method;
|
yield return method;
|
||||||
else if (DotNetUtils.IsMethod(method, "System.Byte[]", "(System.Int16,System.IO.Stream)"))
|
else if (DotNetUtils.IsMethod(method, "System.Byte[]", "(System.Int16,System.IO.Stream)"))
|
||||||
|
|
Loading…
Reference in New Issue
Block a user