monocul.us/de4dot-cex
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Clear deobfuscated state for each restored method

Browse Source
This commit is contained in:
de4dot 2013-09-28 19:51:25 +02:00
parent 01dbcd0632
commit e70e226916
4 changed files with 10 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
de4dot.code/deobfuscators/CryptoObfuscator/Deobfuscator.cs
View File

@ -221,7 +221,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
DeobfuscatedFile.StringDecryptersAdded(); DeobfuscatedFile.StringDecryptersAdded();
} }
methodsDecrypter.Decrypt(resourceDecrypter); methodsDecrypter.Decrypt(resourceDecrypter, DeobfuscatedFile);
if (methodsDecrypter.Detected) { if (methodsDecrypter.Detected) {
if (!assemblyResolver.Detected) if (!assemblyResolver.Detected)

7
de4dot.code/deobfuscators/CryptoObfuscator/MethodsDecrypter.cs
View File

@ -112,7 +112,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
return null; return null;
} }
public void Decrypt(ResourceDecrypter resourceDecrypter) { public void Decrypt(ResourceDecrypter resourceDecrypter, ISimpleDeobfuscator simpleDeobfuscator) {
if (decryptMethod == null) if (decryptMethod == null)
return; return;
@ -129,13 +129,13 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
uint codeOffset = reader.ReadUInt32(); uint codeOffset = reader.ReadUInt32();
var origOffset = reader.Position; var origOffset = reader.Position;
reader.Position = codeOffset; reader.Position = codeOffset;
Decrypt(reader, delegateTypeToken); Decrypt(reader, delegateTypeToken, simpleDeobfuscator);
reader.Position = origOffset; reader.Position = origOffset;
} }
Logger.Instance.DeIndent(); Logger.Instance.DeIndent();
} }
void Decrypt(IBinaryReader reader, int delegateTypeToken) { void Decrypt(IBinaryReader reader, int delegateTypeToken, ISimpleDeobfuscator simpleDeobfuscator) {
var delegateType = module.ResolveToken(delegateTypeToken) as TypeDef; var delegateType = module.ResolveToken(delegateTypeToken) as TypeDef;
if (delegateType == null) if (delegateType == null)
throw new ApplicationException("Couldn't find delegate type"); throw new ApplicationException("Couldn't find delegate type");
@ -162,6 +162,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
encMethod.Body.Variables.Count, encMethod.Body.Variables.Count,
encMethod.Body.ExceptionHandlers.Count); encMethod.Body.ExceptionHandlers.Count);
delegateTypes.Add(delegateType); delegateTypes.Add(delegateType);
simpleDeobfuscator.MethodModified(encMethod);
} }
bool GetTokens(TypeDef delegateType, out int delegateToken, out int encMethodToken, out int encDeclaringTypeToken) { bool GetTokens(TypeDef delegateType, out int delegateToken, out int encMethodToken, out int encDeclaringTypeToken) {

2
de4dot.code/deobfuscators/Spices_Net/Deobfuscator.cs
View File

@ -154,7 +154,7 @@ namespace de4dot.code.deobfuscators.Spices_Net {
public override void DeobfuscateBegin() { public override void DeobfuscateBegin() {
base.DeobfuscateBegin(); base.DeobfuscateBegin();
methodCallInliner.Initialize(); methodCallInliner.Initialize(DeobfuscatedFile);
if (options.RestoreResourceNames) { if (options.RestoreResourceNames) {
resourceNamesRestorer = new ResourceNamesRestorer(module); resourceNamesRestorer = new ResourceNamesRestorer(module);

7
de4dot.code/deobfuscators/Spices_Net/SpicesMethodCallInliner.cs
View File

@ -52,12 +52,12 @@ namespace de4dot.code.deobfuscators.Spices_Net {
return CheckCanInline(method); return CheckCanInline(method);
} }
public void Initialize() { public void Initialize(ISimpleDeobfuscator simpleDeobfuscator) {
InitializeMethodsTypes(); InitializeMethodsTypes();
RestoreMethodBodies(); RestoreMethodBodies(simpleDeobfuscator);
} }
void RestoreMethodBodies() { void RestoreMethodBodies(ISimpleDeobfuscator simpleDeobfuscator) {
var methodToOrigMethods = new MethodDefAndDeclaringTypeDict<List<MethodDef>>(); var methodToOrigMethods = new MethodDefAndDeclaringTypeDict<List<MethodDef>>();
foreach (var t in module.Types) { foreach (var t in module.Types) {
var types = new List<TypeDef>(AllTypesHelper.Types(new List<TypeDef> { t })); var types = new List<TypeDef>(AllTypesHelper.Types(new List<TypeDef> { t }));
@ -95,6 +95,7 @@ namespace de4dot.code.deobfuscators.Spices_Net {
calledMethod.MDToken.ToInt32()); calledMethod.MDToken.ToInt32());
DotNetUtils.CopyBodyFromTo(calledMethod, method); DotNetUtils.CopyBodyFromTo(calledMethod, method);
classMethods.Add(calledMethod, method); classMethods.Add(calledMethod, method);
simpleDeobfuscator.MethodModified(method);
} }
} }