Rename
This commit is contained in:
parent
996a245ba3
commit
d9aec67fcb
|
@ -24,7 +24,7 @@ using Mono.Cecil.Cil;
|
|||
using Mono.Cecil.Metadata;
|
||||
|
||||
namespace de4dot.blocks {
|
||||
public enum DotNetRuntimeType {
|
||||
public enum FrameworkType {
|
||||
Unknown,
|
||||
Desktop,
|
||||
Silverlight, // and WindowsPhone, XNA Xbox360
|
||||
|
@ -1093,7 +1093,7 @@ namespace de4dot.blocks {
|
|||
return typeRef;
|
||||
}
|
||||
|
||||
public static DotNetRuntimeType getDotNetRuntimeType(ModuleDefinition module) {
|
||||
public static FrameworkType getFrameworkType(ModuleDefinition module) {
|
||||
foreach (var modRef in module.AssemblyReferences) {
|
||||
if (modRef.Name != "mscorlib")
|
||||
continue;
|
||||
|
@ -1101,17 +1101,17 @@ namespace de4dot.blocks {
|
|||
continue;
|
||||
switch (BitConverter.ToString(modRef.PublicKeyToken).Replace("-", "").ToLowerInvariant()) {
|
||||
case "b77a5c561934e089":
|
||||
return DotNetRuntimeType.Desktop;
|
||||
return FrameworkType.Desktop;
|
||||
case "7cec85d7bea7798e":
|
||||
return DotNetRuntimeType.Silverlight;
|
||||
return FrameworkType.Silverlight;
|
||||
case "969db8053d3322ac":
|
||||
return DotNetRuntimeType.CompactFramework;
|
||||
return FrameworkType.CompactFramework;
|
||||
case "e92a8b81eba7ceb7":
|
||||
return DotNetRuntimeType.Zune;
|
||||
return FrameworkType.Zune;
|
||||
}
|
||||
}
|
||||
|
||||
return DotNetRuntimeType.Unknown;
|
||||
return FrameworkType.Unknown;
|
||||
}
|
||||
|
||||
public static bool callsMethod(MethodDefinition method, string methodFullName) {
|
||||
|
|
|
@ -36,28 +36,28 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
|
|||
byte desEncryptedFlag;
|
||||
byte deflatedFlag;
|
||||
byte bitwiseNotEncryptedFlag;
|
||||
DotNetRuntimeType rtType;
|
||||
FrameworkType frameworkType;
|
||||
|
||||
public ResourceDecrypter(ModuleDefinition module, ISimpleDeobfuscator simpleDeobfuscator) {
|
||||
this.module = module;
|
||||
rtType = DotNetUtils.getDotNetRuntimeType(module);
|
||||
frameworkType = DotNetUtils.getFrameworkType(module);
|
||||
find(simpleDeobfuscator);
|
||||
}
|
||||
|
||||
void find(ISimpleDeobfuscator simpleDeobfuscator) {
|
||||
switch (rtType) {
|
||||
case DotNetRuntimeType.Desktop:
|
||||
switch (frameworkType) {
|
||||
case FrameworkType.Desktop:
|
||||
if (module.Runtime >= TargetRuntime.Net_2_0)
|
||||
findDesktopOrCompactFramework();
|
||||
else
|
||||
findDesktopOrCompactFrameworkV1();
|
||||
break;
|
||||
|
||||
case DotNetRuntimeType.Silverlight:
|
||||
case FrameworkType.Silverlight:
|
||||
findSilverlight();
|
||||
break;
|
||||
|
||||
case DotNetRuntimeType.CompactFramework:
|
||||
case FrameworkType.CompactFramework:
|
||||
if (module.Runtime >= TargetRuntime.Net_2_0) {
|
||||
if (findDesktopOrCompactFramework())
|
||||
break;
|
||||
|
@ -204,8 +204,8 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
|
|||
constants.Add(flagValue);
|
||||
}
|
||||
|
||||
switch (rtType) {
|
||||
case DotNetRuntimeType.Desktop:
|
||||
switch (frameworkType) {
|
||||
case FrameworkType.Desktop:
|
||||
if (module.Runtime >= TargetRuntime.Net_2_0) {
|
||||
if (constants.Count == 2) {
|
||||
desEncryptedFlag = (byte)constants[0];
|
||||
|
@ -221,14 +221,14 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
|
|||
}
|
||||
break;
|
||||
|
||||
case DotNetRuntimeType.Silverlight:
|
||||
case FrameworkType.Silverlight:
|
||||
if (constants.Count == 1) {
|
||||
bitwiseNotEncryptedFlag = (byte)constants[0];
|
||||
return true;
|
||||
}
|
||||
break;
|
||||
|
||||
case DotNetRuntimeType.CompactFramework:
|
||||
case FrameworkType.CompactFramework:
|
||||
if (constants.Count == 1) {
|
||||
desEncryptedFlag = (byte)constants[0];
|
||||
return true;
|
||||
|
|
|
@ -25,7 +25,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
|
|||
ModuleDefinition module;
|
||||
TypeDefinition tamperType;
|
||||
MethodDefinition tamperMethod;
|
||||
DotNetRuntimeType rtType;
|
||||
FrameworkType frameworkType;
|
||||
|
||||
public bool Detected {
|
||||
get { return tamperMethod != null; }
|
||||
|
@ -41,7 +41,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
|
|||
|
||||
public TamperDetection(ModuleDefinition module) {
|
||||
this.module = module;
|
||||
rtType = DotNetUtils.getDotNetRuntimeType(module);
|
||||
frameworkType = DotNetUtils.getFrameworkType(module);
|
||||
}
|
||||
|
||||
public void find() {
|
||||
|
@ -59,14 +59,14 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
|
|||
var method = info.Item2;
|
||||
|
||||
bool result = false;
|
||||
switch (rtType) {
|
||||
case DotNetRuntimeType.Desktop:
|
||||
switch (frameworkType) {
|
||||
case FrameworkType.Desktop:
|
||||
result = findDesktop(method);
|
||||
break;
|
||||
case DotNetRuntimeType.Silverlight:
|
||||
case FrameworkType.Silverlight:
|
||||
result = findSilverlight(method);
|
||||
break;
|
||||
case DotNetRuntimeType.CompactFramework:
|
||||
case FrameworkType.CompactFramework:
|
||||
result = findCompactFramework(method);
|
||||
break;
|
||||
}
|
||||
|
|
Loading…
Reference in New Issue
Block a user