diff --git a/de4dot.code/deobfuscators/dotNET_Reactor/v4/AssemblyResolver.cs b/de4dot.code/deobfuscators/dotNET_Reactor/v4/AssemblyResolver.cs index 08f3ba8b..8a4ce825 100644 --- a/de4dot.code/deobfuscators/dotNET_Reactor/v4/AssemblyResolver.cs +++ b/de4dot.code/deobfuscators/dotNET_Reactor/v4/AssemblyResolver.cs @@ -87,7 +87,6 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 { var resolverLocals = new string[] { "System.Byte[]", "System.Reflection.Assembly", - "System.Security.Cryptography.MD5", "System.String", "System.IO.BinaryReader", "System.IO.Stream", diff --git a/de4dot.code/deobfuscators/dotNET_Reactor/v4/Deobfuscator.cs b/de4dot.code/deobfuscators/dotNET_Reactor/v4/Deobfuscator.cs index 360c0e9d..b0f2fd22 100644 --- a/de4dot.code/deobfuscators/dotNET_Reactor/v4/Deobfuscator.cs +++ b/de4dot.code/deobfuscators/dotNET_Reactor/v4/Deobfuscator.cs @@ -32,7 +32,7 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 { public class DeobfuscatorInfo : DeobfuscatorInfoBase { public const string THE_NAME = ".NET Reactor"; public const string THE_TYPE = "dr4"; - const string DEFAULT_REGEX = DeobfuscatorBase.DEFAULT_VALID_NAME_REGEX; + const string DEFAULT_REGEX = @"!^[A-Za-z0-9]{2,3}$&" + DeobfuscatorBase.DEFAULT_VALID_NAME_REGEX; BoolOption decryptMethods; BoolOption decryptBools; BoolOption restoreTypes; @@ -366,16 +366,23 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 { return DeobfuscatorInfo.THE_NAME + " 4.0 - 4.4"; int numIntPtrSizeCompares = CountCompareSystemIntPtrSize(methodsDecrypter.Method); + bool hasSymmetricAlgorithm = new LocalTypes(methodsDecrypter.Method).Exists("System.Security.Cryptography.SymmetricAlgorithm"); if (module.IsClr40) { switch (numIntPtrSizeCompares) { case 9: return DeobfuscatorInfo.THE_NAME + " 4.5"; - case 10:return DeobfuscatorInfo.THE_NAME + " 4.6"; + case 10: + if (!hasSymmetricAlgorithm) + return DeobfuscatorInfo.THE_NAME + " 4.6"; + return DeobfuscatorInfo.THE_NAME + " 4.7"; } } else { switch (numIntPtrSizeCompares) { case 8: return DeobfuscatorInfo.THE_NAME + " 4.5"; - case 9: return DeobfuscatorInfo.THE_NAME + " 4.6"; + case 9: + if (!hasSymmetricAlgorithm) + return DeobfuscatorInfo.THE_NAME + " 4.6"; + return DeobfuscatorInfo.THE_NAME + " 4.7"; } } diff --git a/de4dot.code/deobfuscators/dotNET_Reactor/v4/EncryptedResource.cs b/de4dot.code/deobfuscators/dotNET_Reactor/v4/EncryptedResource.cs index c9f59963..9660c66e 100644 --- a/de4dot.code/deobfuscators/dotNET_Reactor/v4/EncryptedResource.cs +++ b/de4dot.code/deobfuscators/dotNET_Reactor/v4/EncryptedResource.cs @@ -91,7 +91,8 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 { if (!localTypes.All(requiredTypes)) return false; if (!localTypes.Exists("System.Security.Cryptography.RijndaelManaged") && - !localTypes.Exists("System.Security.Cryptography.AesManaged")) + !localTypes.Exists("System.Security.Cryptography.AesManaged") && + !localTypes.Exists("System.Security.Cryptography.SymmetricAlgorithm")) return false; if (checkResource && FindMethodsDecrypterResource(method) == null)