monocul.us/de4dot-cex
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Don't remove string decrypter type if there's still code calling it

Browse Source
This commit is contained in:
de4dot 2012-02-19 00:50:08 +01:00
parent e18ff9aea1
commit d7afc66c6d
2 changed files with 27 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
de4dot.code/deobfuscators/Skater_NET/Deobfuscator.cs
View File

@ -111,7 +111,7 @@ namespace de4dot.code.deobfuscators.Skater_NET {
}
public override void deobfuscateEnd() {
if (Operations.DecryptStrings != OpDecryptString.None)
if (Operations.DecryptStrings != OpDecryptString.None && stringDecrypter.CanRemoveType)
addTypeToBeRemoved(stringDecrypter.Type, "String decrypter type");
base.deobfuscateEnd();

36
de4dot.code/deobfuscators/Skater_NET/StringDecrypter.cs
View File

@ -35,11 +35,16 @@ namespace de4dot.code.deobfuscators.Skater_NET {
byte[] key;
byte[] iv;
FieldDefinitionAndDeclaringTypeDict<string> fieldToDecryptedString = new FieldDefinitionAndDeclaringTypeDict<string>();
bool canRemoveType;
public bool Detected {
get { return decrypterType != null; }
}
public bool CanRemoveType {
get { return canRemoveType; }
}
public TypeDefinition Type {
get { return decrypterType; }
}
@ -58,6 +63,7 @@ namespace de4dot.code.deobfuscators.Skater_NET {
continue;
if (checkType(type)) {
canRemoveType = true;
decrypterType = type;
decrypterCctor = cctor;
return;
@ -221,17 +227,27 @@ namespace de4dot.code.deobfuscators.Skater_NET {
var instrs = block.Instructions;
for (int i = 0; i < instrs.Count; i++) {
var instr = instrs[i];
if (instr.OpCode.Code != Code.Ldsfld)
continue;
var field = instr.Operand as FieldReference;
if (field == null)
continue;
var decrypted = fieldToDecryptedString.find(field);
if (decrypted == null)
continue;
instrs[i] = new Instr(Instruction.Create(OpCodes.Ldstr, decrypted));
Log.v("Decrypted string: {0}", Utils.toCsharpString(decrypted));
if (instr.OpCode.Code == Code.Call || instr.OpCode.Code == Code.Callvirt) {
if (blocks.Method.DeclaringType == decrypterType)
continue;
var calledMethod = instr.Operand as MethodReference;
if (calledMethod != null && calledMethod.DeclaringType == decrypterType)
canRemoveType = false;
}
else if (instr.OpCode.Code == Code.Ldsfld) {
if (instr.OpCode.Code != Code.Ldsfld)
continue;
var field = instr.Operand as FieldReference;
if (field == null)
continue;
var decrypted = fieldToDecryptedString.find(field);
if (decrypted == null)
continue;
instrs[i] = new Instr(Instruction.Create(OpCodes.Ldstr, decrypted));
Log.v("Decrypted string: {0}", Utils.toCsharpString(decrypted));
}
}
}
}