monocul.us/de4dot-cex
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Clear deobfuscated state for each restored method

Browse Source
This commit is contained in:
de4dot 2013-09-28 19:51:25 +02:00
parent 01dbcd0632
commit e70e226916
4 changed files with 10 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
de4dot.code/deobfuscators/CryptoObfuscator/Deobfuscator.cs
View File

@ -221,7 +221,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
DeobfuscatedFile.StringDecryptersAdded();
}
methodsDecrypter.Decrypt(resourceDecrypter);
methodsDecrypter.Decrypt(resourceDecrypter, DeobfuscatedFile);
if (methodsDecrypter.Detected) {
if (!assemblyResolver.Detected)

7
de4dot.code/deobfuscators/CryptoObfuscator/MethodsDecrypter.cs
View File

@ -112,7 +112,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
return null;
}
public void Decrypt(ResourceDecrypter resourceDecrypter) {
public void Decrypt(ResourceDecrypter resourceDecrypter, ISimpleDeobfuscator simpleDeobfuscator) {
if (decryptMethod == null)
return;
@ -129,13 +129,13 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
uint codeOffset = reader.ReadUInt32();
var origOffset = reader.Position;
reader.Position = codeOffset;
Decrypt(reader, delegateTypeToken);
Decrypt(reader, delegateTypeToken, simpleDeobfuscator);
reader.Position = origOffset;
}
Logger.Instance.DeIndent();
}
void Decrypt(IBinaryReader reader, int delegateTypeToken) {
void Decrypt(IBinaryReader reader, int delegateTypeToken, ISimpleDeobfuscator simpleDeobfuscator) {
var delegateType = module.ResolveToken(delegateTypeToken) as TypeDef;
if (delegateType == null)
throw new ApplicationException("Couldn't find delegate type");
@ -162,6 +162,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
encMethod.Body.Variables.Count,
encMethod.Body.ExceptionHandlers.Count);
delegateTypes.Add(delegateType);
simpleDeobfuscator.MethodModified(encMethod);
}
bool GetTokens(TypeDef delegateType, out int delegateToken, out int encMethodToken, out int encDeclaringTypeToken) {

2
de4dot.code/deobfuscators/Spices_Net/Deobfuscator.cs
View File

@ -154,7 +154,7 @@ namespace de4dot.code.deobfuscators.Spices_Net {
public override void DeobfuscateBegin() {
base.DeobfuscateBegin();
methodCallInliner.Initialize();
methodCallInliner.Initialize(DeobfuscatedFile);
if (options.RestoreResourceNames) {
resourceNamesRestorer = new ResourceNamesRestorer(module);

7
de4dot.code/deobfuscators/Spices_Net/SpicesMethodCallInliner.cs
View File

@ -52,12 +52,12 @@ namespace de4dot.code.deobfuscators.Spices_Net {
return CheckCanInline(method);
}
public void Initialize() {
public void Initialize(ISimpleDeobfuscator simpleDeobfuscator) {
InitializeMethodsTypes();
RestoreMethodBodies();
RestoreMethodBodies(simpleDeobfuscator);
}
void RestoreMethodBodies() {
void RestoreMethodBodies(ISimpleDeobfuscator simpleDeobfuscator) {
var methodToOrigMethods = new MethodDefAndDeclaringTypeDict<List<MethodDef>>();
foreach (var t in module.Types) {
var types = new List<TypeDef>(AllTypesHelper.Types(new List<TypeDef> { t }));
@ -95,6 +95,7 @@ namespace de4dot.code.deobfuscators.Spices_Net {
calledMethod.MDToken.ToInt32());
DotNetUtils.CopyBodyFromTo(calledMethod, method);
classMethods.Add(calledMethod, method);
simpleDeobfuscator.MethodModified(method);
}
}