From e6ab87e5ed1fadd614e30744119c3e65ad2680bf Mon Sep 17 00:00:00 2001 From: de4dot Date: Thu, 1 Nov 2012 09:33:02 +0100 Subject: [PATCH] Port de4dot.mdecrypt to dot10 --- de4dot.mdecrypt/DecryptMethodsInfo.cs | 1 - de4dot.mdecrypt/DynamicMethodsDecrypter.cs | 25 +++++++++++----------- de4dot.mdecrypt/de4dot.mdecrypt.csproj | 6 +++--- 3 files changed, 15 insertions(+), 17 deletions(-) diff --git a/de4dot.mdecrypt/DecryptMethodsInfo.cs b/de4dot.mdecrypt/DecryptMethodsInfo.cs index 72cce7f8..45f9d468 100644 --- a/de4dot.mdecrypt/DecryptMethodsInfo.cs +++ b/de4dot.mdecrypt/DecryptMethodsInfo.cs @@ -19,7 +19,6 @@ using System; using System.Collections.Generic; -using Mono.MyStuff; namespace de4dot.mdecrypt { [Serializable] diff --git a/de4dot.mdecrypt/DynamicMethodsDecrypter.cs b/de4dot.mdecrypt/DynamicMethodsDecrypter.cs index 4c24861e..f92e11e4 100644 --- a/de4dot.mdecrypt/DynamicMethodsDecrypter.cs +++ b/de4dot.mdecrypt/DynamicMethodsDecrypter.cs @@ -22,8 +22,7 @@ using System.IO; using System.Runtime.CompilerServices; using System.Runtime.InteropServices; using System.Reflection; -using Mono.MyStuff; -using Mono.Cecil; +using dot10.DotNet; using de4dot.blocks; using de4dot.PE; @@ -70,7 +69,7 @@ namespace de4dot.mdecrypt { class DecryptContext { public DumpedMethod dm; - public MethodDefinition method; + public MethodDef method; } FuncPtrInfo ourCompileMethodInfo = new FuncPtrInfo(); @@ -93,8 +92,8 @@ namespace de4dot.mdecrypt { de4dot.PE.MetadataType methodDefTable; IntPtr methodDefTablePtr; - ModuleDefinition monoModule; - MethodDefinition moduleCctor; + ModuleDefMD dot10Module; + MethodDef moduleCctor; uint moduleCctorCodeRva; IntPtr moduleToDecryptScope; @@ -175,16 +174,16 @@ namespace de4dot.mdecrypt { } unsafe void initializeMonoCecilMethods() { - monoModule = ModuleDefinition.ReadModule(moduleToDecrypt.FullyQualifiedName); - moduleCctor = DotNetUtils.getModuleTypeCctor(monoModule); + dot10Module = ModuleDefMD.Load(moduleToDecrypt.FullyQualifiedName); + moduleCctor = DotNetUtils.getModuleTypeCctor(dot10Module); if (moduleCctor == null) moduleCctorCodeRva = 0; else { - byte* p = (byte*)hInstModule + moduleCctor.RVA; + byte* p = (byte*)hInstModule + (uint)moduleCctor.RVA; if ((*p & 3) == 2) moduleCctorCodeRva = (uint)moduleCctor.RVA + 1; else - moduleCctorCodeRva = (uint)(moduleCctor.RVA + (p[1] >> 4) * 4); + moduleCctorCodeRva = (uint)((uint)moduleCctor.RVA + (p[1] >> 4) * 4); } } @@ -442,11 +441,11 @@ namespace de4dot.mdecrypt { } string returnNameOfMethod() { - return ctx.method.Name; + return ctx.method.Name.String; } int returnMethodToken() { - return ctx.method.MetadataToken.ToInt32(); + return ctx.method.MDToken.ToInt32(); } public DumpedMethods decryptMethods() { @@ -476,11 +475,11 @@ namespace de4dot.mdecrypt { ctx.dm = new DumpedMethod(); ctx.dm.token = token; - ctx.method = monoModule.LookupToken((int)token) as MethodDefinition; + ctx.method = dot10Module.ResolveToken(token) as MethodDef; if (ctx.method == null) throw new ApplicationException(string.Format("Could not find method {0:X8}", token)); - byte* mh = (byte*)hInstModule + ctx.method.RVA; + byte* mh = (byte*)hInstModule + (uint)ctx.method.RVA; byte* code; if (mh == (byte*)hInstModule) { ctx.dm.mhMaxStack = 0; diff --git a/de4dot.mdecrypt/de4dot.mdecrypt.csproj b/de4dot.mdecrypt/de4dot.mdecrypt.csproj index 7fa1d592..fbaf34a2 100644 --- a/de4dot.mdecrypt/de4dot.mdecrypt.csproj +++ b/de4dot.mdecrypt/de4dot.mdecrypt.csproj @@ -46,9 +46,9 @@ {045B96F2-AF80-4C4C-8D27-E38635AC705E} blocks - - {D68133BD-1E63-496E-9EDE-4FBDBF77B486} - Mono.Cecil + + {FDFC1237-143F-4919-8318-4926901F4639} + dot10