monocul.us/de4dot-cex
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Rename

Browse Source
This commit is contained in:
de4dot 2012-03-16 19:13:27 +01:00
parent 996a245ba3
commit d9aec67fcb
3 changed files with 23 additions and 23 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
blocks/DotNetUtils.cs
View File

@ -24,7 +24,7 @@ using Mono.Cecil.Cil;
using Mono.Cecil.Metadata; using Mono.Cecil.Metadata;
namespace de4dot.blocks { namespace de4dot.blocks {
public enum DotNetRuntimeType { public enum FrameworkType {
Unknown, Unknown,
Desktop, Desktop,
Silverlight, // and WindowsPhone, XNA Xbox360 Silverlight, // and WindowsPhone, XNA Xbox360
@ -1093,7 +1093,7 @@ namespace de4dot.blocks {
return typeRef; return typeRef;
} }
public static DotNetRuntimeType getDotNetRuntimeType(ModuleDefinition module) { public static FrameworkType getFrameworkType(ModuleDefinition module) {
foreach (var modRef in module.AssemblyReferences) { foreach (var modRef in module.AssemblyReferences) {
if (modRef.Name != "mscorlib") if (modRef.Name != "mscorlib")
continue; continue;
@ -1101,17 +1101,17 @@ namespace de4dot.blocks {
continue; continue;
switch (BitConverter.ToString(modRef.PublicKeyToken).Replace("-", "").ToLowerInvariant()) { switch (BitConverter.ToString(modRef.PublicKeyToken).Replace("-", "").ToLowerInvariant()) {
case "b77a5c561934e089": case "b77a5c561934e089":
return DotNetRuntimeType.Desktop; return FrameworkType.Desktop;
case "7cec85d7bea7798e": case "7cec85d7bea7798e":
return DotNetRuntimeType.Silverlight; return FrameworkType.Silverlight;
case "969db8053d3322ac": case "969db8053d3322ac":
return DotNetRuntimeType.CompactFramework; return FrameworkType.CompactFramework;
case "e92a8b81eba7ceb7": case "e92a8b81eba7ceb7":
return DotNetRuntimeType.Zune; return FrameworkType.Zune;
} }
} }
return DotNetRuntimeType.Unknown; return FrameworkType.Unknown;
} }
public static bool callsMethod(MethodDefinition method, string methodFullName) { public static bool callsMethod(MethodDefinition method, string methodFullName) {

20
de4dot.code/deobfuscators/CryptoObfuscator/ResourceDecrypter.cs
View File

@ -36,28 +36,28 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
byte desEncryptedFlag; byte desEncryptedFlag;
byte deflatedFlag; byte deflatedFlag;
byte bitwiseNotEncryptedFlag; byte bitwiseNotEncryptedFlag;
DotNetRuntimeType rtType; FrameworkType frameworkType;
public ResourceDecrypter(ModuleDefinition module, ISimpleDeobfuscator simpleDeobfuscator) { public ResourceDecrypter(ModuleDefinition module, ISimpleDeobfuscator simpleDeobfuscator) {
this.module = module; this.module = module;
rtType = DotNetUtils.getDotNetRuntimeType(module); frameworkType = DotNetUtils.getFrameworkType(module);
find(simpleDeobfuscator); find(simpleDeobfuscator);
} }
void find(ISimpleDeobfuscator simpleDeobfuscator) { void find(ISimpleDeobfuscator simpleDeobfuscator) {
switch (rtType) { switch (frameworkType) {
case DotNetRuntimeType.Desktop: case FrameworkType.Desktop:
if (module.Runtime >= TargetRuntime.Net_2_0) if (module.Runtime >= TargetRuntime.Net_2_0)
findDesktopOrCompactFramework(); findDesktopOrCompactFramework();
else else
findDesktopOrCompactFrameworkV1(); findDesktopOrCompactFrameworkV1();
break; break;
case DotNetRuntimeType.Silverlight: case FrameworkType.Silverlight:
findSilverlight(); findSilverlight();
break; break;
case DotNetRuntimeType.CompactFramework: case FrameworkType.CompactFramework:
if (module.Runtime >= TargetRuntime.Net_2_0) { if (module.Runtime >= TargetRuntime.Net_2_0) {
if (findDesktopOrCompactFramework()) if (findDesktopOrCompactFramework())
break; break;
@ -204,8 +204,8 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
constants.Add(flagValue); constants.Add(flagValue);
} }
switch (rtType) { switch (frameworkType) {
case DotNetRuntimeType.Desktop: case FrameworkType.Desktop:
if (module.Runtime >= TargetRuntime.Net_2_0) { if (module.Runtime >= TargetRuntime.Net_2_0) {
if (constants.Count == 2) { if (constants.Count == 2) {
desEncryptedFlag = (byte)constants[0]; desEncryptedFlag = (byte)constants[0];
@ -221,14 +221,14 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
} }
break; break;
case DotNetRuntimeType.Silverlight: case FrameworkType.Silverlight:
if (constants.Count == 1) { if (constants.Count == 1) {
bitwiseNotEncryptedFlag = (byte)constants[0]; bitwiseNotEncryptedFlag = (byte)constants[0];
return true; return true;
} }
break; break;
case DotNetRuntimeType.CompactFramework: case FrameworkType.CompactFramework:
if (constants.Count == 1) { if (constants.Count == 1) {
desEncryptedFlag = (byte)constants[0]; desEncryptedFlag = (byte)constants[0];
return true; return true;

12
de4dot.code/deobfuscators/CryptoObfuscator/TamperDetection.cs
View File

@ -25,7 +25,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
ModuleDefinition module; ModuleDefinition module;
TypeDefinition tamperType; TypeDefinition tamperType;
MethodDefinition tamperMethod; MethodDefinition tamperMethod;
DotNetRuntimeType rtType; FrameworkType frameworkType;
public bool Detected { public bool Detected {
get { return tamperMethod != null; } get { return tamperMethod != null; }
@ -41,7 +41,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
public TamperDetection(ModuleDefinition module) { public TamperDetection(ModuleDefinition module) {
this.module = module; this.module = module;
rtType = DotNetUtils.getDotNetRuntimeType(module); frameworkType = DotNetUtils.getFrameworkType(module);
} }
public void find() { public void find() {
@ -59,14 +59,14 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
var method = info.Item2; var method = info.Item2;
bool result = false; bool result = false;
switch (rtType) { switch (frameworkType) {
case DotNetRuntimeType.Desktop: case FrameworkType.Desktop:
result = findDesktop(method); result = findDesktop(method);
break; break;
case DotNetRuntimeType.Silverlight: case FrameworkType.Silverlight:
result = findSilverlight(method); result = findSilverlight(method);
break; break;
case DotNetRuntimeType.CompactFramework: case FrameworkType.CompactFramework:
result = findCompactFramework(method); result = findCompactFramework(method);
break; break;
} }