Support .NET Reactor 4.7
This commit is contained in:
parent
689635cf69
commit
eb284bf4bf
|
@ -87,7 +87,6 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 {
|
||||||
var resolverLocals = new string[] {
|
var resolverLocals = new string[] {
|
||||||
"System.Byte[]",
|
"System.Byte[]",
|
||||||
"System.Reflection.Assembly",
|
"System.Reflection.Assembly",
|
||||||
"System.Security.Cryptography.MD5",
|
|
||||||
"System.String",
|
"System.String",
|
||||||
"System.IO.BinaryReader",
|
"System.IO.BinaryReader",
|
||||||
"System.IO.Stream",
|
"System.IO.Stream",
|
||||||
|
|
|
@ -32,7 +32,7 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 {
|
||||||
public class DeobfuscatorInfo : DeobfuscatorInfoBase {
|
public class DeobfuscatorInfo : DeobfuscatorInfoBase {
|
||||||
public const string THE_NAME = ".NET Reactor";
|
public const string THE_NAME = ".NET Reactor";
|
||||||
public const string THE_TYPE = "dr4";
|
public const string THE_TYPE = "dr4";
|
||||||
const string DEFAULT_REGEX = DeobfuscatorBase.DEFAULT_VALID_NAME_REGEX;
|
const string DEFAULT_REGEX = @"!^[A-Za-z0-9]{2,3}$&" + DeobfuscatorBase.DEFAULT_VALID_NAME_REGEX;
|
||||||
BoolOption decryptMethods;
|
BoolOption decryptMethods;
|
||||||
BoolOption decryptBools;
|
BoolOption decryptBools;
|
||||||
BoolOption restoreTypes;
|
BoolOption restoreTypes;
|
||||||
|
@ -366,16 +366,23 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 {
|
||||||
return DeobfuscatorInfo.THE_NAME + " 4.0 - 4.4";
|
return DeobfuscatorInfo.THE_NAME + " 4.0 - 4.4";
|
||||||
|
|
||||||
int numIntPtrSizeCompares = CountCompareSystemIntPtrSize(methodsDecrypter.Method);
|
int numIntPtrSizeCompares = CountCompareSystemIntPtrSize(methodsDecrypter.Method);
|
||||||
|
bool hasSymmetricAlgorithm = new LocalTypes(methodsDecrypter.Method).Exists("System.Security.Cryptography.SymmetricAlgorithm");
|
||||||
if (module.IsClr40) {
|
if (module.IsClr40) {
|
||||||
switch (numIntPtrSizeCompares) {
|
switch (numIntPtrSizeCompares) {
|
||||||
case 9: return DeobfuscatorInfo.THE_NAME + " 4.5";
|
case 9: return DeobfuscatorInfo.THE_NAME + " 4.5";
|
||||||
case 10:return DeobfuscatorInfo.THE_NAME + " 4.6";
|
case 10:
|
||||||
|
if (!hasSymmetricAlgorithm)
|
||||||
|
return DeobfuscatorInfo.THE_NAME + " 4.6";
|
||||||
|
return DeobfuscatorInfo.THE_NAME + " 4.7";
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
else {
|
else {
|
||||||
switch (numIntPtrSizeCompares) {
|
switch (numIntPtrSizeCompares) {
|
||||||
case 8: return DeobfuscatorInfo.THE_NAME + " 4.5";
|
case 8: return DeobfuscatorInfo.THE_NAME + " 4.5";
|
||||||
case 9: return DeobfuscatorInfo.THE_NAME + " 4.6";
|
case 9:
|
||||||
|
if (!hasSymmetricAlgorithm)
|
||||||
|
return DeobfuscatorInfo.THE_NAME + " 4.6";
|
||||||
|
return DeobfuscatorInfo.THE_NAME + " 4.7";
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
@ -91,7 +91,8 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 {
|
||||||
if (!localTypes.All(requiredTypes))
|
if (!localTypes.All(requiredTypes))
|
||||||
return false;
|
return false;
|
||||||
if (!localTypes.Exists("System.Security.Cryptography.RijndaelManaged") &&
|
if (!localTypes.Exists("System.Security.Cryptography.RijndaelManaged") &&
|
||||||
!localTypes.Exists("System.Security.Cryptography.AesManaged"))
|
!localTypes.Exists("System.Security.Cryptography.AesManaged") &&
|
||||||
|
!localTypes.Exists("System.Security.Cryptography.SymmetricAlgorithm"))
|
||||||
return false;
|
return false;
|
||||||
|
|
||||||
if (checkResource && FindMethodsDecrypterResource(method) == null)
|
if (checkResource && FindMethodsDecrypterResource(method) == null)
|
||||||
|
|
Loading…
Reference in New Issue
Block a user