diff --git a/de4dot.code/deobfuscators/CryptoObfuscator/Deobfuscator.cs b/de4dot.code/deobfuscators/CryptoObfuscator/Deobfuscator.cs index f38330e9..1cb146eb 100644 --- a/de4dot.code/deobfuscators/CryptoObfuscator/Deobfuscator.cs +++ b/de4dot.code/deobfuscators/CryptoObfuscator/Deobfuscator.cs @@ -221,7 +221,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator { DeobfuscatedFile.StringDecryptersAdded(); } - methodsDecrypter.Decrypt(resourceDecrypter); + methodsDecrypter.Decrypt(resourceDecrypter, DeobfuscatedFile); if (methodsDecrypter.Detected) { if (!assemblyResolver.Detected) diff --git a/de4dot.code/deobfuscators/CryptoObfuscator/MethodsDecrypter.cs b/de4dot.code/deobfuscators/CryptoObfuscator/MethodsDecrypter.cs index ceb3c994..18f32d0a 100644 --- a/de4dot.code/deobfuscators/CryptoObfuscator/MethodsDecrypter.cs +++ b/de4dot.code/deobfuscators/CryptoObfuscator/MethodsDecrypter.cs @@ -112,7 +112,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator { return null; } - public void Decrypt(ResourceDecrypter resourceDecrypter) { + public void Decrypt(ResourceDecrypter resourceDecrypter, ISimpleDeobfuscator simpleDeobfuscator) { if (decryptMethod == null) return; @@ -129,13 +129,13 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator { uint codeOffset = reader.ReadUInt32(); var origOffset = reader.Position; reader.Position = codeOffset; - Decrypt(reader, delegateTypeToken); + Decrypt(reader, delegateTypeToken, simpleDeobfuscator); reader.Position = origOffset; } Logger.Instance.DeIndent(); } - void Decrypt(IBinaryReader reader, int delegateTypeToken) { + void Decrypt(IBinaryReader reader, int delegateTypeToken, ISimpleDeobfuscator simpleDeobfuscator) { var delegateType = module.ResolveToken(delegateTypeToken) as TypeDef; if (delegateType == null) throw new ApplicationException("Couldn't find delegate type"); @@ -162,6 +162,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator { encMethod.Body.Variables.Count, encMethod.Body.ExceptionHandlers.Count); delegateTypes.Add(delegateType); + simpleDeobfuscator.MethodModified(encMethod); } bool GetTokens(TypeDef delegateType, out int delegateToken, out int encMethodToken, out int encDeclaringTypeToken) { diff --git a/de4dot.code/deobfuscators/Spices_Net/Deobfuscator.cs b/de4dot.code/deobfuscators/Spices_Net/Deobfuscator.cs index 775e3c20..c00124d5 100644 --- a/de4dot.code/deobfuscators/Spices_Net/Deobfuscator.cs +++ b/de4dot.code/deobfuscators/Spices_Net/Deobfuscator.cs @@ -154,7 +154,7 @@ namespace de4dot.code.deobfuscators.Spices_Net { public override void DeobfuscateBegin() { base.DeobfuscateBegin(); - methodCallInliner.Initialize(); + methodCallInliner.Initialize(DeobfuscatedFile); if (options.RestoreResourceNames) { resourceNamesRestorer = new ResourceNamesRestorer(module); diff --git a/de4dot.code/deobfuscators/Spices_Net/SpicesMethodCallInliner.cs b/de4dot.code/deobfuscators/Spices_Net/SpicesMethodCallInliner.cs index 471ab57b..863f093c 100644 --- a/de4dot.code/deobfuscators/Spices_Net/SpicesMethodCallInliner.cs +++ b/de4dot.code/deobfuscators/Spices_Net/SpicesMethodCallInliner.cs @@ -52,12 +52,12 @@ namespace de4dot.code.deobfuscators.Spices_Net { return CheckCanInline(method); } - public void Initialize() { + public void Initialize(ISimpleDeobfuscator simpleDeobfuscator) { InitializeMethodsTypes(); - RestoreMethodBodies(); + RestoreMethodBodies(simpleDeobfuscator); } - void RestoreMethodBodies() { + void RestoreMethodBodies(ISimpleDeobfuscator simpleDeobfuscator) { var methodToOrigMethods = new MethodDefAndDeclaringTypeDict>(); foreach (var t in module.Types) { var types = new List(AllTypesHelper.Types(new List { t })); @@ -95,6 +95,7 @@ namespace de4dot.code.deobfuscators.Spices_Net { calledMethod.MDToken.ToInt32()); DotNetUtils.CopyBodyFromTo(calledMethod, method); classMethods.Add(calledMethod, method); + simpleDeobfuscator.MethodModified(method); } }