diff --git a/blocks/DotNetUtils.cs b/blocks/DotNetUtils.cs index 81251bba..b8efc36f 100644 --- a/blocks/DotNetUtils.cs +++ b/blocks/DotNetUtils.cs @@ -24,7 +24,7 @@ using Mono.Cecil.Cil; using Mono.Cecil.Metadata; namespace de4dot.blocks { - public enum DotNetRuntimeType { + public enum FrameworkType { Unknown, Desktop, Silverlight, // and WindowsPhone, XNA Xbox360 @@ -1093,7 +1093,7 @@ namespace de4dot.blocks { return typeRef; } - public static DotNetRuntimeType getDotNetRuntimeType(ModuleDefinition module) { + public static FrameworkType getFrameworkType(ModuleDefinition module) { foreach (var modRef in module.AssemblyReferences) { if (modRef.Name != "mscorlib") continue; @@ -1101,17 +1101,17 @@ namespace de4dot.blocks { continue; switch (BitConverter.ToString(modRef.PublicKeyToken).Replace("-", "").ToLowerInvariant()) { case "b77a5c561934e089": - return DotNetRuntimeType.Desktop; + return FrameworkType.Desktop; case "7cec85d7bea7798e": - return DotNetRuntimeType.Silverlight; + return FrameworkType.Silverlight; case "969db8053d3322ac": - return DotNetRuntimeType.CompactFramework; + return FrameworkType.CompactFramework; case "e92a8b81eba7ceb7": - return DotNetRuntimeType.Zune; + return FrameworkType.Zune; } } - return DotNetRuntimeType.Unknown; + return FrameworkType.Unknown; } public static bool callsMethod(MethodDefinition method, string methodFullName) { diff --git a/de4dot.code/deobfuscators/CryptoObfuscator/ResourceDecrypter.cs b/de4dot.code/deobfuscators/CryptoObfuscator/ResourceDecrypter.cs index d692b62b..28e427cc 100644 --- a/de4dot.code/deobfuscators/CryptoObfuscator/ResourceDecrypter.cs +++ b/de4dot.code/deobfuscators/CryptoObfuscator/ResourceDecrypter.cs @@ -36,28 +36,28 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator { byte desEncryptedFlag; byte deflatedFlag; byte bitwiseNotEncryptedFlag; - DotNetRuntimeType rtType; + FrameworkType frameworkType; public ResourceDecrypter(ModuleDefinition module, ISimpleDeobfuscator simpleDeobfuscator) { this.module = module; - rtType = DotNetUtils.getDotNetRuntimeType(module); + frameworkType = DotNetUtils.getFrameworkType(module); find(simpleDeobfuscator); } void find(ISimpleDeobfuscator simpleDeobfuscator) { - switch (rtType) { - case DotNetRuntimeType.Desktop: + switch (frameworkType) { + case FrameworkType.Desktop: if (module.Runtime >= TargetRuntime.Net_2_0) findDesktopOrCompactFramework(); else findDesktopOrCompactFrameworkV1(); break; - case DotNetRuntimeType.Silverlight: + case FrameworkType.Silverlight: findSilverlight(); break; - case DotNetRuntimeType.CompactFramework: + case FrameworkType.CompactFramework: if (module.Runtime >= TargetRuntime.Net_2_0) { if (findDesktopOrCompactFramework()) break; @@ -204,8 +204,8 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator { constants.Add(flagValue); } - switch (rtType) { - case DotNetRuntimeType.Desktop: + switch (frameworkType) { + case FrameworkType.Desktop: if (module.Runtime >= TargetRuntime.Net_2_0) { if (constants.Count == 2) { desEncryptedFlag = (byte)constants[0]; @@ -221,14 +221,14 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator { } break; - case DotNetRuntimeType.Silverlight: + case FrameworkType.Silverlight: if (constants.Count == 1) { bitwiseNotEncryptedFlag = (byte)constants[0]; return true; } break; - case DotNetRuntimeType.CompactFramework: + case FrameworkType.CompactFramework: if (constants.Count == 1) { desEncryptedFlag = (byte)constants[0]; return true; diff --git a/de4dot.code/deobfuscators/CryptoObfuscator/TamperDetection.cs b/de4dot.code/deobfuscators/CryptoObfuscator/TamperDetection.cs index 34879e12..8fa351ad 100644 --- a/de4dot.code/deobfuscators/CryptoObfuscator/TamperDetection.cs +++ b/de4dot.code/deobfuscators/CryptoObfuscator/TamperDetection.cs @@ -25,7 +25,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator { ModuleDefinition module; TypeDefinition tamperType; MethodDefinition tamperMethod; - DotNetRuntimeType rtType; + FrameworkType frameworkType; public bool Detected { get { return tamperMethod != null; } @@ -41,7 +41,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator { public TamperDetection(ModuleDefinition module) { this.module = module; - rtType = DotNetUtils.getDotNetRuntimeType(module); + frameworkType = DotNetUtils.getFrameworkType(module); } public void find() { @@ -59,14 +59,14 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator { var method = info.Item2; bool result = false; - switch (rtType) { - case DotNetRuntimeType.Desktop: + switch (frameworkType) { + case FrameworkType.Desktop: result = findDesktop(method); break; - case DotNetRuntimeType.Silverlight: + case FrameworkType.Silverlight: result = findSilverlight(method); break; - case DotNetRuntimeType.CompactFramework: + case FrameworkType.CompactFramework: result = findCompactFramework(method); break; }