monocul.us/de4dot-cex
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Rename

Browse Source
This commit is contained in:
de4dot 2012-03-16 19:13:27 +01:00
parent 996a245ba3
commit d9aec67fcb
3 changed files with 23 additions and 23 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
blocks/DotNetUtils.cs
View File

@ -24,7 +24,7 @@ using Mono.Cecil.Cil;
using Mono.Cecil.Metadata;
namespace de4dot.blocks {
public enum DotNetRuntimeType {
public enum FrameworkType {
Unknown,
Desktop,
Silverlight, // and WindowsPhone, XNA Xbox360
@ -1093,7 +1093,7 @@ namespace de4dot.blocks {
return typeRef;
}
public static DotNetRuntimeType getDotNetRuntimeType(ModuleDefinition module) {
public static FrameworkType getFrameworkType(ModuleDefinition module) {
foreach (var modRef in module.AssemblyReferences) {
if (modRef.Name != "mscorlib")
continue;
@ -1101,17 +1101,17 @@ namespace de4dot.blocks {
continue;
switch (BitConverter.ToString(modRef.PublicKeyToken).Replace("-", "").ToLowerInvariant()) {
case "b77a5c561934e089":
return DotNetRuntimeType.Desktop;
return FrameworkType.Desktop;
case "7cec85d7bea7798e":
return DotNetRuntimeType.Silverlight;
return FrameworkType.Silverlight;
case "969db8053d3322ac":
return DotNetRuntimeType.CompactFramework;
return FrameworkType.CompactFramework;
case "e92a8b81eba7ceb7":
return DotNetRuntimeType.Zune;
return FrameworkType.Zune;
}
}
return DotNetRuntimeType.Unknown;
return FrameworkType.Unknown;
}
public static bool callsMethod(MethodDefinition method, string methodFullName) {

20
de4dot.code/deobfuscators/CryptoObfuscator/ResourceDecrypter.cs
View File

@ -36,28 +36,28 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
byte desEncryptedFlag;
byte deflatedFlag;
byte bitwiseNotEncryptedFlag;
DotNetRuntimeType rtType;
FrameworkType frameworkType;
public ResourceDecrypter(ModuleDefinition module, ISimpleDeobfuscator simpleDeobfuscator) {
this.module = module;
rtType = DotNetUtils.getDotNetRuntimeType(module);
frameworkType = DotNetUtils.getFrameworkType(module);
find(simpleDeobfuscator);
}
void find(ISimpleDeobfuscator simpleDeobfuscator) {
switch (rtType) {
case DotNetRuntimeType.Desktop:
switch (frameworkType) {
case FrameworkType.Desktop:
if (module.Runtime >= TargetRuntime.Net_2_0)
findDesktopOrCompactFramework();
else
findDesktopOrCompactFrameworkV1();
break;
case DotNetRuntimeType.Silverlight:
case FrameworkType.Silverlight:
findSilverlight();
break;
case DotNetRuntimeType.CompactFramework:
case FrameworkType.CompactFramework:
if (module.Runtime >= TargetRuntime.Net_2_0) {
if (findDesktopOrCompactFramework())
break;
@ -204,8 +204,8 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
constants.Add(flagValue);
}
switch (rtType) {
case DotNetRuntimeType.Desktop:
switch (frameworkType) {
case FrameworkType.Desktop:
if (module.Runtime >= TargetRuntime.Net_2_0) {
if (constants.Count == 2) {
desEncryptedFlag = (byte)constants[0];
@ -221,14 +221,14 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
}
break;
case DotNetRuntimeType.Silverlight:
case FrameworkType.Silverlight:
if (constants.Count == 1) {
bitwiseNotEncryptedFlag = (byte)constants[0];
return true;
}
break;
case DotNetRuntimeType.CompactFramework:
case FrameworkType.CompactFramework:
if (constants.Count == 1) {
desEncryptedFlag = (byte)constants[0];
return true;

12
de4dot.code/deobfuscators/CryptoObfuscator/TamperDetection.cs
View File

@ -25,7 +25,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
ModuleDefinition module;
TypeDefinition tamperType;
MethodDefinition tamperMethod;
DotNetRuntimeType rtType;
FrameworkType frameworkType;
public bool Detected {
get { return tamperMethod != null; }
@ -41,7 +41,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
public TamperDetection(ModuleDefinition module) {
this.module = module;
rtType = DotNetUtils.getDotNetRuntimeType(module);
frameworkType = DotNetUtils.getFrameworkType(module);
}
public void find() {
@ -59,14 +59,14 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
var method = info.Item2;
bool result = false;
switch (rtType) {
case DotNetRuntimeType.Desktop:
switch (frameworkType) {
case FrameworkType.Desktop:
result = findDesktop(method);
break;
case DotNetRuntimeType.Silverlight:
case FrameworkType.Silverlight:
result = findSilverlight(method);
break;
case DotNetRuntimeType.CompactFramework:
case FrameworkType.CompactFramework:
result = findCompactFramework(method);
break;
}