monocul.us/de4dot-cex
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Use the IModuleWriterListener interface

Browse Source
This commit is contained in:
de4dot 2012-11-04 19:40:36 +01:00
parent f4ce67d836
commit d5838aa6c2
7 changed files with 26 additions and 30 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
de4dot.code/AssemblyModule.cs
View File

@ -21,6 +21,7 @@ using System;
using System.IO;
using System.Collections.Generic;
using dot10.DotNet;
using dot10.DotNet.Writer;
using de4dot.blocks;
namespace de4dot.code {
@ -43,22 +44,20 @@ namespace de4dot.code {
ModuleDefMD setModule(ModuleDefMD newModule) {
module = newModule;
TheAssemblyResolver.Instance.addModule(module);
module.EnableTypeDefFindCache = true;
module.Location = filename;
return module;
}
public void save(string newFilename, bool updateMaxStack, IWriterListener writerListener) {
//TODO: var writerParams = new WriterParameters() {
//TODO: UpdateMaxStack = updateMaxStack,
//TODO: WriterListener = writerListener,
//TODO: };
//TODO: module.Write(newFilename, writerParams);
module.Write(newFilename);
public void save(string newFilename, bool updateMaxStack, IModuleWriterListener writerListener) {
var writerOptions = new ModuleWriterOptions(module, writerListener);
if (!updateMaxStack)
writerOptions.MetaDataOptions.Flags |= MetaDataFlags.KeepOldMaxStack;
module.Write(newFilename, writerOptions);
}
public ModuleDefMD reload(byte[] newModuleData, DumpedMethods dumpedMethods) {
//TODO: AssemblyResolver.Instance.removeModule(module);
//TODO: DotNetUtils.typeCaches.invalidate(module);
TheAssemblyResolver.Instance.removeModule(module);
//TODO: Use dumped methods
return setModule(ModuleDefMD.Load(newModuleData));
}

4
de4dot.code/AssemblyResolver.cs
View File

@ -23,6 +23,10 @@ namespace de4dot.code {
public class TheAssemblyResolver : dot10.DotNet.AssemblyResolver {
public static readonly TheAssemblyResolver Instance = new TheAssemblyResolver();
public TheAssemblyResolver() {
EnableTypeDefCache = true;
}
public void addSearchDirectory(string dir) {
if (!PostSearchPaths.Contains(dir))
PostSearchPaths.Add(dir);

3
de4dot.code/ObfuscatedFile.cs
View File

@ -24,6 +24,7 @@ using System.IO;
using System.Text;
using dot10.DotNet;
using dot10.DotNet.Emit;
using dot10.DotNet.Writer;
using dot10.PE;
using de4dot.code.deobfuscators;
using de4dot.blocks;
@ -305,7 +306,7 @@ namespace de4dot.code {
public void save() {
Log.n("Saving {0}", options.NewFilename);
assemblyModule.save(options.NewFilename, options.ControlFlowDeobfuscation, deob as IWriterListener);
assemblyModule.save(options.NewFilename, options.ControlFlowDeobfuscation, deob as IModuleWriterListener);
}
IList<MethodDef> getAllMethods() {

17
de4dot.code/deobfuscators/DeobfuscatorBase.cs
View File

@ -21,24 +21,13 @@ using System;
using System.Collections.Generic;
using dot10.DotNet;
using dot10.DotNet.Emit;
using dot10.DotNet.Writer;
using dot10.PE;
using de4dot.blocks;
using de4dot.blocks.cflow;
namespace de4dot.code {
//TODO: I added this iface to Cecil but now you must add something similar to dot10
interface IWriterListener {
// Called before adding resources, and after adding types, methods, etc.
void OnBeforeAddingResources(MetadataBuilder builder);
}
//TODO: REMOVE
internal class MetadataBuilder {
//TODO: Dummy class. Don't use
}
}
namespace de4dot.code.deobfuscators {
abstract class DeobfuscatorBase : IDeobfuscator, IWriterListener {
abstract class DeobfuscatorBase : IDeobfuscator, IModuleWriterListener {
public const string DEFAULT_VALID_NAME_REGEX = @"^[a-zA-Z_<{$][a-zA-Z_0-9<>{}$.`-]*$";
class RemoveInfo<T> {
@ -712,7 +701,7 @@ namespace de4dot.code.deobfuscators {
return name != null && checkValidName(name);
}
public virtual void OnBeforeAddingResources(MetadataBuilder builder) {
public virtual void OnWriterEvent(ModuleWriter writer, ModuleWriterEvent evt) {
}
protected void findAndRemoveInlinedMethods() {

7
de4dot.code/deobfuscators/dotNET_Reactor/v4/Deobfuscator.cs
View File

@ -23,6 +23,7 @@ using System.IO;
using System.Text.RegularExpressions;
using dot10.DotNet;
using dot10.DotNet.Emit;
using dot10.DotNet.Writer;
using Mono.MyStuff;
using de4dot.blocks;
using de4dot.PE;
@ -606,10 +607,12 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 {
return list;
}
public override void OnBeforeAddingResources(MetadataBuilder builder) {
public override void OnWriterEvent(ModuleWriter writer, ModuleWriterEvent evt) {
if (evt != ModuleWriterEvent.EndWriteChunks)
return;
if (!options.DecryptMethods)
return;
methodsDecrypter.encryptNativeMethods(builder);
methodsDecrypter.encryptNativeMethods(writer);
}
}
}

6
de4dot.code/deobfuscators/dotNET_Reactor/v4/MethodsDecrypter.cs
View File

@ -296,7 +296,7 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 {
tokenToNativeMethod = null;
}
public void encryptNativeMethods(MetadataBuilder builder) {
public void encryptNativeMethods(ModuleWriter moduleWriter) {
if (methodToNativeMethod.Count == 0)
return;
@ -309,7 +309,7 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 {
writer.Write(methodToNativeMethod.Count);
int index = 0;
var codeWriter = builder.CodeWriter;
var codeWriter = moduleWriter.CodeWriter;
foreach (var pair in methodToNativeMethod) {
var method = pair.Key;
if (method.DeclaringType == null)
@ -318,7 +318,7 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 {
continue; // method.DeclaringType was removed
var code = pair.Value;
uint codeRva = builder.GetMethodBodyRva((int)method.MDToken.RID - 1);
uint codeRva = moduleWriter.GetMethodBodyRva(method);
if ((codeWriter.ReadByteAtRva(codeRva) & 3) == 2)
codeRva++;
else

2
dot10

@ -1 +1 @@
Subproject commit 52243399c3c96e4bbf8801582fbc18034d2acc52
Subproject commit 9c166daff7f705cda7c4cea5de70b23030b7c54a