monocul.us/de4dot-cex
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Print DS version

Browse Source
This commit is contained in:
de4dot 2012-01-24 00:41:09 +01:00
parent da0cf08b33
commit d59fa86515
2 changed files with 36 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
de4dot.code/deobfuscators/DeepSea/Deobfuscator.cs
View File

@ -68,6 +68,7 @@ namespace de4dot.code.deobfuscators.DeepSea {
class Deobfuscator : DeobfuscatorBase {
Options options;
string obfuscatorName = DeobfuscatorInfo.THE_NAME;
bool startedDeobfuscating = false;
StringDecrypter stringDecrypter;
@ -90,7 +91,7 @@ namespace de4dot.code.deobfuscators.DeepSea {
}
public override string Name {
get { return TypeLong; }
get { return obfuscatorName; }
}
protected override bool CanInlineMethods {
@ -129,6 +130,18 @@ namespace de4dot.code.deobfuscators.DeepSea {
resourceResolver.find();
assemblyResolver = new AssemblyResolver(module);
assemblyResolver.find();
obfuscatorName = detectVersion();
}
string detectVersion() {
switch (stringDecrypter.Version) {
case StringDecrypter.DecrypterVersion.V1_3:
return DeobfuscatorInfo.THE_NAME + " 1.x-3.x";
case StringDecrypter.DecrypterVersion.V4:
return DeobfuscatorInfo.THE_NAME + " 4.x";
}
return DeobfuscatorInfo.THE_NAME;
}
public override void deobfuscateBegin() {

22
de4dot.code/deobfuscators/DeepSea/StringDecrypter.cs
View File

@ -28,8 +28,16 @@ namespace de4dot.code.deobfuscators.DeepSea {
class StringDecrypter {
ModuleDefinition module;
MethodDefinitionAndDeclaringTypeDict<IDecrypterInfo> methodToInfo = new MethodDefinitionAndDeclaringTypeDict<IDecrypterInfo>();
DecrypterVersion version = DecrypterVersion.Unknown;
public enum DecrypterVersion {
Unknown,
V1_3,
V4,
}
interface IDecrypterInfo {
DecrypterVersion Version { get; }
MethodDefinition Method { get; }
string decrypt(object[] args);
void cleanup();
@ -97,6 +105,10 @@ namespace de4dot.code.deobfuscators.DeepSea {
short[] key;
ushort[] encryptedData;
public DecrypterVersion Version {
get { return DecrypterVersion.V4; }
}
public DecrypterInfo4(MethodDefinition cctor, MethodDefinition method) {
this.cctor = cctor;
this.Method = method;
@ -256,6 +268,11 @@ namespace de4dot.code.deobfuscators.DeepSea {
int magic;
string[] encryptedStrings;
short[] key;
public DecrypterVersion Version {
get { return DecrypterVersion.V1_3; }
}
public DecrypterInfo3(MethodDefinition cctor, MethodDefinition method) {
this.cctor = cctor;
this.Method = method;
@ -397,6 +414,10 @@ namespace de4dot.code.deobfuscators.DeepSea {
get { return methodToInfo.Count != 0; }
}
public DecrypterVersion Version {
get { return version; }
}
public List<MethodDefinition> DecrypterMethods {
get {
var methods = new List<MethodDefinition>(methodToInfo.Count);
@ -439,6 +460,7 @@ namespace de4dot.code.deobfuscators.DeepSea {
if (info == null)
continue;
methodToInfo.add(method, info);
version = info.Version;
}
foreach (var method in DotNetUtils.findMethods(type.Methods, "System.String", new string[] { "System.Int32" }, true)) {