diff --git a/de4dot.code/deobfuscators/DeepSea/Deobfuscator.cs b/de4dot.code/deobfuscators/DeepSea/Deobfuscator.cs index 637fbe72..927bd860 100644 --- a/de4dot.code/deobfuscators/DeepSea/Deobfuscator.cs +++ b/de4dot.code/deobfuscators/DeepSea/Deobfuscator.cs @@ -68,6 +68,7 @@ namespace de4dot.code.deobfuscators.DeepSea { class Deobfuscator : DeobfuscatorBase { Options options; + string obfuscatorName = DeobfuscatorInfo.THE_NAME; bool startedDeobfuscating = false; StringDecrypter stringDecrypter; @@ -90,7 +91,7 @@ namespace de4dot.code.deobfuscators.DeepSea { } public override string Name { - get { return TypeLong; } + get { return obfuscatorName; } } protected override bool CanInlineMethods { @@ -129,6 +130,18 @@ namespace de4dot.code.deobfuscators.DeepSea { resourceResolver.find(); assemblyResolver = new AssemblyResolver(module); assemblyResolver.find(); + obfuscatorName = detectVersion(); + } + + string detectVersion() { + switch (stringDecrypter.Version) { + case StringDecrypter.DecrypterVersion.V1_3: + return DeobfuscatorInfo.THE_NAME + " 1.x-3.x"; + case StringDecrypter.DecrypterVersion.V4: + return DeobfuscatorInfo.THE_NAME + " 4.x"; + } + + return DeobfuscatorInfo.THE_NAME; } public override void deobfuscateBegin() { diff --git a/de4dot.code/deobfuscators/DeepSea/StringDecrypter.cs b/de4dot.code/deobfuscators/DeepSea/StringDecrypter.cs index a439c698..1c484e0b 100644 --- a/de4dot.code/deobfuscators/DeepSea/StringDecrypter.cs +++ b/de4dot.code/deobfuscators/DeepSea/StringDecrypter.cs @@ -28,8 +28,16 @@ namespace de4dot.code.deobfuscators.DeepSea { class StringDecrypter { ModuleDefinition module; MethodDefinitionAndDeclaringTypeDict methodToInfo = new MethodDefinitionAndDeclaringTypeDict(); + DecrypterVersion version = DecrypterVersion.Unknown; + + public enum DecrypterVersion { + Unknown, + V1_3, + V4, + } interface IDecrypterInfo { + DecrypterVersion Version { get; } MethodDefinition Method { get; } string decrypt(object[] args); void cleanup(); @@ -97,6 +105,10 @@ namespace de4dot.code.deobfuscators.DeepSea { short[] key; ushort[] encryptedData; + public DecrypterVersion Version { + get { return DecrypterVersion.V4; } + } + public DecrypterInfo4(MethodDefinition cctor, MethodDefinition method) { this.cctor = cctor; this.Method = method; @@ -256,6 +268,11 @@ namespace de4dot.code.deobfuscators.DeepSea { int magic; string[] encryptedStrings; short[] key; + + public DecrypterVersion Version { + get { return DecrypterVersion.V1_3; } + } + public DecrypterInfo3(MethodDefinition cctor, MethodDefinition method) { this.cctor = cctor; this.Method = method; @@ -397,6 +414,10 @@ namespace de4dot.code.deobfuscators.DeepSea { get { return methodToInfo.Count != 0; } } + public DecrypterVersion Version { + get { return version; } + } + public List DecrypterMethods { get { var methods = new List(methodToInfo.Count); @@ -439,6 +460,7 @@ namespace de4dot.code.deobfuscators.DeepSea { if (info == null) continue; methodToInfo.add(method, info); + version = info.Version; } foreach (var method in DotNetUtils.findMethods(type.Methods, "System.String", new string[] { "System.Int32" }, true)) {