Print DS version
This commit is contained in:
parent
da0cf08b33
commit
d59fa86515
|
@ -68,6 +68,7 @@ namespace de4dot.code.deobfuscators.DeepSea {
|
||||||
|
|
||||||
class Deobfuscator : DeobfuscatorBase {
|
class Deobfuscator : DeobfuscatorBase {
|
||||||
Options options;
|
Options options;
|
||||||
|
string obfuscatorName = DeobfuscatorInfo.THE_NAME;
|
||||||
bool startedDeobfuscating = false;
|
bool startedDeobfuscating = false;
|
||||||
|
|
||||||
StringDecrypter stringDecrypter;
|
StringDecrypter stringDecrypter;
|
||||||
|
@ -90,7 +91,7 @@ namespace de4dot.code.deobfuscators.DeepSea {
|
||||||
}
|
}
|
||||||
|
|
||||||
public override string Name {
|
public override string Name {
|
||||||
get { return TypeLong; }
|
get { return obfuscatorName; }
|
||||||
}
|
}
|
||||||
|
|
||||||
protected override bool CanInlineMethods {
|
protected override bool CanInlineMethods {
|
||||||
|
@ -129,6 +130,18 @@ namespace de4dot.code.deobfuscators.DeepSea {
|
||||||
resourceResolver.find();
|
resourceResolver.find();
|
||||||
assemblyResolver = new AssemblyResolver(module);
|
assemblyResolver = new AssemblyResolver(module);
|
||||||
assemblyResolver.find();
|
assemblyResolver.find();
|
||||||
|
obfuscatorName = detectVersion();
|
||||||
|
}
|
||||||
|
|
||||||
|
string detectVersion() {
|
||||||
|
switch (stringDecrypter.Version) {
|
||||||
|
case StringDecrypter.DecrypterVersion.V1_3:
|
||||||
|
return DeobfuscatorInfo.THE_NAME + " 1.x-3.x";
|
||||||
|
case StringDecrypter.DecrypterVersion.V4:
|
||||||
|
return DeobfuscatorInfo.THE_NAME + " 4.x";
|
||||||
|
}
|
||||||
|
|
||||||
|
return DeobfuscatorInfo.THE_NAME;
|
||||||
}
|
}
|
||||||
|
|
||||||
public override void deobfuscateBegin() {
|
public override void deobfuscateBegin() {
|
||||||
|
|
|
@ -28,8 +28,16 @@ namespace de4dot.code.deobfuscators.DeepSea {
|
||||||
class StringDecrypter {
|
class StringDecrypter {
|
||||||
ModuleDefinition module;
|
ModuleDefinition module;
|
||||||
MethodDefinitionAndDeclaringTypeDict<IDecrypterInfo> methodToInfo = new MethodDefinitionAndDeclaringTypeDict<IDecrypterInfo>();
|
MethodDefinitionAndDeclaringTypeDict<IDecrypterInfo> methodToInfo = new MethodDefinitionAndDeclaringTypeDict<IDecrypterInfo>();
|
||||||
|
DecrypterVersion version = DecrypterVersion.Unknown;
|
||||||
|
|
||||||
|
public enum DecrypterVersion {
|
||||||
|
Unknown,
|
||||||
|
V1_3,
|
||||||
|
V4,
|
||||||
|
}
|
||||||
|
|
||||||
interface IDecrypterInfo {
|
interface IDecrypterInfo {
|
||||||
|
DecrypterVersion Version { get; }
|
||||||
MethodDefinition Method { get; }
|
MethodDefinition Method { get; }
|
||||||
string decrypt(object[] args);
|
string decrypt(object[] args);
|
||||||
void cleanup();
|
void cleanup();
|
||||||
|
@ -97,6 +105,10 @@ namespace de4dot.code.deobfuscators.DeepSea {
|
||||||
short[] key;
|
short[] key;
|
||||||
ushort[] encryptedData;
|
ushort[] encryptedData;
|
||||||
|
|
||||||
|
public DecrypterVersion Version {
|
||||||
|
get { return DecrypterVersion.V4; }
|
||||||
|
}
|
||||||
|
|
||||||
public DecrypterInfo4(MethodDefinition cctor, MethodDefinition method) {
|
public DecrypterInfo4(MethodDefinition cctor, MethodDefinition method) {
|
||||||
this.cctor = cctor;
|
this.cctor = cctor;
|
||||||
this.Method = method;
|
this.Method = method;
|
||||||
|
@ -256,6 +268,11 @@ namespace de4dot.code.deobfuscators.DeepSea {
|
||||||
int magic;
|
int magic;
|
||||||
string[] encryptedStrings;
|
string[] encryptedStrings;
|
||||||
short[] key;
|
short[] key;
|
||||||
|
|
||||||
|
public DecrypterVersion Version {
|
||||||
|
get { return DecrypterVersion.V1_3; }
|
||||||
|
}
|
||||||
|
|
||||||
public DecrypterInfo3(MethodDefinition cctor, MethodDefinition method) {
|
public DecrypterInfo3(MethodDefinition cctor, MethodDefinition method) {
|
||||||
this.cctor = cctor;
|
this.cctor = cctor;
|
||||||
this.Method = method;
|
this.Method = method;
|
||||||
|
@ -397,6 +414,10 @@ namespace de4dot.code.deobfuscators.DeepSea {
|
||||||
get { return methodToInfo.Count != 0; }
|
get { return methodToInfo.Count != 0; }
|
||||||
}
|
}
|
||||||
|
|
||||||
|
public DecrypterVersion Version {
|
||||||
|
get { return version; }
|
||||||
|
}
|
||||||
|
|
||||||
public List<MethodDefinition> DecrypterMethods {
|
public List<MethodDefinition> DecrypterMethods {
|
||||||
get {
|
get {
|
||||||
var methods = new List<MethodDefinition>(methodToInfo.Count);
|
var methods = new List<MethodDefinition>(methodToInfo.Count);
|
||||||
|
@ -439,6 +460,7 @@ namespace de4dot.code.deobfuscators.DeepSea {
|
||||||
if (info == null)
|
if (info == null)
|
||||||
continue;
|
continue;
|
||||||
methodToInfo.add(method, info);
|
methodToInfo.add(method, info);
|
||||||
|
version = info.Version;
|
||||||
}
|
}
|
||||||
|
|
||||||
foreach (var method in DotNetUtils.findMethods(type.Methods, "System.String", new string[] { "System.Int32" }, true)) {
|
foreach (var method in DotNetUtils.findMethods(type.Methods, "System.String", new string[] { "System.Int32" }, true)) {
|
||||||
|
|
Loading…
Reference in New Issue
Block a user