monocul.us/de4dot-cex
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Update CO resource class detector code

Browse Source
This commit is contained in:
de4dot 2013-11-06 08:12:40 +01:00
parent 83e3cc0f57
commit d410d80815
1 changed files with 6 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
de4dot.code/deobfuscators/CryptoObfuscator/ResourceDecrypter.cs
View File

@ -48,17 +48,11 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
void Find(ISimpleDeobfuscator simpleDeobfuscator) { void Find(ISimpleDeobfuscator simpleDeobfuscator) {
switch (frameworkType) { switch (frameworkType) {
case FrameworkType.Desktop:
if (!module.IsClr1x)
FindDesktopOrCompactFramework();
else
FindDesktopOrCompactFrameworkV1();
break;
case FrameworkType.Silverlight: case FrameworkType.Silverlight:
FindSilverlight(); FindSilverlight();
break; break;
case FrameworkType.Desktop:
case FrameworkType.CompactFramework: case FrameworkType.CompactFramework:
if (!module.IsClr1x) { if (!module.IsClr1x) {
if (FindDesktopOrCompactFramework()) if (FindDesktopOrCompactFramework())
@ -243,11 +237,9 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
return true; return true;
} }
} }
else { if (constants.Count == 1) {
if (constants.Count == 1) { desEncryptedFlag = (byte)constants[0];
desEncryptedFlag = (byte)constants[0]; return true;
return true;
}
} }
break; break;
@ -302,6 +294,8 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
yield return method; yield return method;
else if (DotNetUtils.IsMethod(method, "System.Byte[]", "(System.Int64,System.IO.Stream)")) else if (DotNetUtils.IsMethod(method, "System.Byte[]", "(System.Int64,System.IO.Stream)"))
yield return method; yield return method;
else if (DotNetUtils.IsMethod(method, "System.Byte[]", "(System.Int64,System.IO.Stream,System.UInt32)"))
yield return method;
else if (DotNetUtils.IsMethod(method, "System.Byte[]", "(System.Int32,System.IO.Stream)")) else if (DotNetUtils.IsMethod(method, "System.Byte[]", "(System.Int32,System.IO.Stream)"))
yield return method; yield return method;
else if (DotNetUtils.IsMethod(method, "System.Byte[]", "(System.Int16,System.IO.Stream)")) else if (DotNetUtils.IsMethod(method, "System.Byte[]", "(System.Int16,System.IO.Stream)"))