diff --git a/de4dot.code/deobfuscators/DeobUtils.cs b/de4dot.code/deobfuscators/DeobUtils.cs index 6e383d6f..8b42712a 100644 --- a/de4dot.code/deobfuscators/DeobUtils.cs +++ b/de4dot.code/deobfuscators/DeobUtils.cs @@ -21,6 +21,7 @@ using System; using System.IO; using System.Security.Cryptography; using Mono.Cecil; +using ICSharpCode.SharpZipLib.Zip.Compression; namespace de4dot.code.deobfuscators { static class DeobUtils { @@ -80,6 +81,14 @@ namespace de4dot.code.deobfuscators { } } + public static byte[] desDecrypt(byte[] data, int start, int len, byte[] key, byte[] iv) { + using (var des = new DESCryptoServiceProvider()) { + using (var transform = des.CreateDecryptor(key, iv)) { + return transform.TransformFinalBlock(data, start, len); + } + } + } + public static string getExtension(ModuleKind kind) { switch (kind) { case ModuleKind.Dll: @@ -92,5 +101,19 @@ namespace de4dot.code.deobfuscators { return ".exe"; } } + + public static byte[] inflate(byte[] data, bool hasHeader) { + var buffer = new byte[0x1000]; + var memStream = new MemoryStream(); + var inflater = new Inflater(hasHeader); + inflater.SetInput(data, 0, data.Length); + while (true) { + int count = inflater.Inflate(buffer, 0, buffer.Length); + if (count == 0) + break; + memStream.Write(buffer, 0, count); + } + return memStream.ToArray(); + } } } diff --git a/de4dot.code/deobfuscators/dotNET_Reactor/v4/NativeImageUnpacker.cs b/de4dot.code/deobfuscators/dotNET_Reactor/v4/NativeImageUnpacker.cs index 1d424bfc..9c0c9841 100644 --- a/de4dot.code/deobfuscators/dotNET_Reactor/v4/NativeImageUnpacker.cs +++ b/de4dot.code/deobfuscators/dotNET_Reactor/v4/NativeImageUnpacker.cs @@ -53,23 +53,12 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 { decrypter.decrypt(encryptedData, 0, encryptedData.Length); byte[] inflatedData; - if (isNet1x) { - var buffer = new byte[0x1000]; - var memStream = new MemoryStream(); - var inflater = new Inflater(); - inflater.SetInput(encryptedData, 0, encryptedData.Length); - while (true) { - int count = inflater.Inflate(buffer, 0, buffer.Length); - if (count == 0) - break; - memStream.Write(buffer, 0, count); - } - inflatedData = memStream.ToArray(); - } + if (isNet1x) + inflatedData = DeobUtils.inflate(encryptedData, false); else { int inflatedSize = BitConverter.ToInt32(encryptedData, 0); inflatedData = new byte[inflatedSize]; - var inflater = new Inflater(); + var inflater = new Inflater(false); inflater.SetInput(encryptedData, 4, encryptedData.Length - 4); int count = inflater.Inflate(inflatedData); if (count != inflatedSize)