monocul.us/de4dot-cex
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add property to tell whether to execute it or not

Browse Source
This commit is contained in:
de4dot 2012-05-03 05:34:12 +02:00
parent c61161be1d
commit e221fc7f52
5 changed files with 34 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
blocks/cflow/BlockDeobfuscator.cs
View File

@ -25,6 +25,8 @@ namespace de4dot.blocks.cflow {
protected List<Block> allBlocks;
protected Blocks blocks;
public bool ExecuteOnNoChange { get; set; }
public virtual void deobfuscateBegin(Blocks blocks) {
this.blocks = blocks;
}

44
blocks/cflow/BlocksCflowDeobfuscator.cs
View File

@ -26,8 +26,7 @@ namespace de4dot.blocks.cflow {
Blocks blocks;
List<Block> allBlocks = new List<Block>();
List<IBlocksDeobfuscator> userBlocksDeobfuscators = new List<IBlocksDeobfuscator>();
List<IBlocksDeobfuscator> callAlways = new List<IBlocksDeobfuscator>();
List<IBlocksDeobfuscator> callNoChange = new List<IBlocksDeobfuscator>();
List<IBlocksDeobfuscator> ourBlocksDeobfuscators = new List<IBlocksDeobfuscator>();
public BlocksCflowDeobfuscator() {
init();
@ -39,12 +38,12 @@ namespace de4dot.blocks.cflow {
}
void init() {
callAlways.Add(new BlockCflowDeobfuscator());
callAlways.Add(new SwitchCflowDeobfuscator());
callAlways.Add(new DeadStoreRemover());
callAlways.Add(new DeadCodeRemover());
callNoChange.Add(new ConstantsFolder());
callNoChange.Add(new StLdlocFixer());
ourBlocksDeobfuscators.Add(new BlockCflowDeobfuscator { ExecuteOnNoChange = false });
ourBlocksDeobfuscators.Add(new SwitchCflowDeobfuscator { ExecuteOnNoChange = false });
ourBlocksDeobfuscators.Add(new DeadStoreRemover { ExecuteOnNoChange = false });
ourBlocksDeobfuscators.Add(new DeadCodeRemover { ExecuteOnNoChange = false });
ourBlocksDeobfuscators.Add(new ConstantsFolder { ExecuteOnNoChange = true });
ourBlocksDeobfuscators.Add(new StLdlocFixer { ExecuteOnNoChange = true });
}
public void add(IEnumerable<IBlocksDeobfuscator> blocksDeobfuscators) {
@ -66,8 +65,7 @@ namespace de4dot.blocks.cflow {
int iterations = -1;
deobfuscateBegin(userBlocksDeobfuscators);
deobfuscateBegin(callAlways);
deobfuscateBegin(callNoChange);
deobfuscateBegin(ourBlocksDeobfuscators);
do {
iterations++;
@ -81,13 +79,9 @@ namespace de4dot.blocks.cflow {
changed |= fixDotfuscatorLoop();
changed |= deobfuscate(userBlocksDeobfuscators, allBlocks);
changed |= deobfuscate(callAlways, allBlocks);
foreach (var bd in callNoChange) {
if (changed)
break;
changed |= bd.deobfuscate(allBlocks);
}
changed |= deobfuscate(ourBlocksDeobfuscators, allBlocks);
changed |= deobfuscateNoChange(changed, userBlocksDeobfuscators, allBlocks);
changed |= deobfuscateNoChange(changed, ourBlocksDeobfuscators, allBlocks);
} while (changed);
}
@ -98,8 +92,22 @@ namespace de4dot.blocks.cflow {
bool deobfuscate(IEnumerable<IBlocksDeobfuscator> bds, List<Block> allBlocks) {
bool changed = false;
foreach (var bd in bds)
foreach (var bd in bds) {
if (bd.ExecuteOnNoChange)
continue;
changed |= bd.deobfuscate(allBlocks);
}
return changed;
}
bool deobfuscateNoChange(bool changed, IEnumerable<IBlocksDeobfuscator> bds, List<Block> allBlocks) {
foreach (var bd in bds) {
if (changed)
break;
if (!bd.ExecuteOnNoChange)
continue;
changed |= bd.deobfuscate(allBlocks);
}
return changed;
}

2
blocks/cflow/DeadStoreRemover.cs
View File

@ -39,6 +39,8 @@ namespace de4dot.blocks.cflow {
Write = 2,
}
public bool ExecuteOnNoChange { get; set; }
public void deobfuscateBegin(Blocks blocks) {
this.blocks = blocks;
}

2
blocks/cflow/IBlocksDeobfuscator.cs
View File

@ -21,6 +21,8 @@ using System.Collections.Generic;
namespace de4dot.blocks.cflow {
public interface IBlocksDeobfuscator {
bool ExecuteOnNoChange { get; }
void deobfuscateBegin(Blocks blocks);
// Returns true if something was updated

2
blocks/cflow/MethodCallInlinerBase.cs
View File

@ -30,6 +30,8 @@ namespace de4dot.blocks.cflow {
protected Block block;
int iteration;
public bool ExecuteOnNoChange { get; set; }
public void deobfuscateBegin(Blocks blocks) {
this.blocks = blocks;
iteration = 0;