monocul.us/de4dot-cex
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add desDecrypt(). Move deflate() to DeobUtils.

Browse Source
This commit is contained in:
de4dot 2012-01-02 22:35:02 +01:00
parent d61e2b6d72
commit e79ee9832d
2 changed files with 26 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
de4dot.code/deobfuscators/DeobUtils.cs
View File

@ -21,6 +21,7 @@ using System;
using System.IO;
using System.Security.Cryptography;
using Mono.Cecil;
using ICSharpCode.SharpZipLib.Zip.Compression;
namespace de4dot.code.deobfuscators {
static class DeobUtils {
@ -80,6 +81,14 @@ namespace de4dot.code.deobfuscators {
}
}
public static byte[] desDecrypt(byte[] data, int start, int len, byte[] key, byte[] iv) {
using (var des = new DESCryptoServiceProvider()) {
using (var transform = des.CreateDecryptor(key, iv)) {
return transform.TransformFinalBlock(data, start, len);
}
}
}
public static string getExtension(ModuleKind kind) {
switch (kind) {
case ModuleKind.Dll:
@ -92,5 +101,19 @@ namespace de4dot.code.deobfuscators {
return ".exe";
}
}
public static byte[] inflate(byte[] data, bool hasHeader) {
var buffer = new byte[0x1000];
var memStream = new MemoryStream();
var inflater = new Inflater(hasHeader);
inflater.SetInput(data, 0, data.Length);
while (true) {
int count = inflater.Inflate(buffer, 0, buffer.Length);
if (count == 0)
break;
memStream.Write(buffer, 0, count);
}
return memStream.ToArray();
}
}
}

17
de4dot.code/deobfuscators/dotNET_Reactor/v4/NativeImageUnpacker.cs
View File

@ -53,23 +53,12 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 {
decrypter.decrypt(encryptedData, 0, encryptedData.Length);
byte[] inflatedData;
if (isNet1x) {
var buffer = new byte[0x1000];
var memStream = new MemoryStream();
var inflater = new Inflater();
inflater.SetInput(encryptedData, 0, encryptedData.Length);
while (true) {
int count = inflater.Inflate(buffer, 0, buffer.Length);
if (count == 0)
break;
memStream.Write(buffer, 0, count);
}
inflatedData = memStream.ToArray();
}
if (isNet1x)
inflatedData = DeobUtils.inflate(encryptedData, false);
else {
int inflatedSize = BitConverter.ToInt32(encryptedData, 0);
inflatedData = new byte[inflatedSize];
var inflater = new Inflater();
var inflater = new Inflater(false);
inflater.SetInput(encryptedData, 4, encryptedData.Length - 4);
int count = inflater.Inflate(inflatedData);
if (count != inflatedSize)