diff --git a/de4dot.code/CommandLineParser.cs b/de4dot.code/CommandLineParser.cs index f9e88238..bf105b8d 100644 --- a/de4dot.code/CommandLineParser.cs +++ b/de4dot.code/CommandLineParser.cs @@ -76,6 +76,7 @@ namespace de4dot { static CommandLineParser() { stringDecrypterTypes.add(DecrypterType.None, "none", "Don't decrypt strings"); + stringDecrypterTypes.add(DecrypterType.Default, "default", "Use default string decrypter type (usually static)"); stringDecrypterTypes.add(DecrypterType.Static, "static", "Use static string decrypter if available"); stringDecrypterTypes.add(DecrypterType.Delegate, "delegate", "Use a delegate to call the real string decrypter"); stringDecrypterTypes.add(DecrypterType.Emulate, "emulate", "Call real string decrypter and emulate certain instructions"); diff --git a/de4dot.code/IObfuscatedFile.cs b/de4dot.code/IObfuscatedFile.cs index 5a854c6a..39e728b4 100644 --- a/de4dot.code/IObfuscatedFile.cs +++ b/de4dot.code/IObfuscatedFile.cs @@ -22,13 +22,6 @@ using de4dot.deobfuscators; using Mono.Cecil; namespace de4dot { - public enum DecrypterType { - None, - Static, - Delegate, - Emulate, - } - interface IObfuscatedFile { ModuleDefinition ModuleDefinition { get; } IDeobfuscator Deobfuscator { get; } diff --git a/de4dot.code/ObfuscatedFile.cs b/de4dot.code/ObfuscatedFile.cs index f1c24595..6a355f36 100644 --- a/de4dot.code/ObfuscatedFile.cs +++ b/de4dot.code/ObfuscatedFile.cs @@ -87,7 +87,7 @@ namespace de4dot { public bool KeepObfuscatorTypes { get; set; } public Options() { - StringDecrypterType = DecrypterType.Static; + StringDecrypterType = DecrypterType.Default; StringDecrypterMethods = new List(); } } @@ -159,18 +159,28 @@ namespace de4dot { if (deob == null) throw new ApplicationException("Could not detect obfuscator!"); + if (options.StringDecrypterType == DecrypterType.Default) + options.StringDecrypterType = deob.DefaultDecrypterType; + if (options.StringDecrypterType == DecrypterType.Default) + options.StringDecrypterType = DecrypterType.Static; + deob.Operations = createOperations(); } IOperations createOperations() { var op = new Operations(); - if (options.StringDecrypterType == DecrypterType.None) + switch (options.StringDecrypterType) { + case DecrypterType.None: op.DecryptStrings = OpDecryptString.None; - else if (options.StringDecrypterType == DecrypterType.Static) + break; + case DecrypterType.Static: op.DecryptStrings = OpDecryptString.Static; - else + break; + default: op.DecryptStrings = OpDecryptString.Dynamic; + break; + } op.RenameSymbols = options.RenameSymbols; op.KeepObfuscatorTypes = options.KeepObfuscatorTypes; diff --git a/de4dot.code/deobfuscators/DeobfuscatorBase.cs b/de4dot.code/deobfuscators/DeobfuscatorBase.cs index 5c00e41f..7081e382 100644 --- a/de4dot.code/deobfuscators/DeobfuscatorBase.cs +++ b/de4dot.code/deobfuscators/DeobfuscatorBase.cs @@ -66,6 +66,7 @@ namespace de4dot.deobfuscators { public IOperations Operations { get; set; } public IDeobfuscatedFile DeobfuscatedFile { get; set; } public virtual StringFeatures StringFeatures { get; set; } + public DecrypterType DefaultDecrypterType { get; set; } public abstract string Type { get; } public abstract string Name { get; } @@ -77,6 +78,7 @@ namespace de4dot.deobfuscators { public DeobfuscatorBase(OptionsBase optionsBase) { this.optionsBase = optionsBase; StringFeatures = StringFeatures.AllowAll; + DefaultDecrypterType = DecrypterType.Static; } public virtual void init(ModuleDefinition module, IList memberReferences) { diff --git a/de4dot.code/deobfuscators/Eazfuscator/Deobfuscator.cs b/de4dot.code/deobfuscators/Eazfuscator/Deobfuscator.cs index cd83320c..4eb3e4c2 100644 --- a/de4dot.code/deobfuscators/Eazfuscator/Deobfuscator.cs +++ b/de4dot.code/deobfuscators/Eazfuscator/Deobfuscator.cs @@ -62,6 +62,7 @@ namespace de4dot.deobfuscators.Eazfuscator { public Deobfuscator(Options options) : base(options) { this.options = options; + DefaultDecrypterType = DecrypterType.Emulate; } public override int detect() { diff --git a/de4dot.code/deobfuscators/IDeobfuscator.cs b/de4dot.code/deobfuscators/IDeobfuscator.cs index 0f50da5f..64231b4f 100644 --- a/de4dot.code/deobfuscators/IDeobfuscator.cs +++ b/de4dot.code/deobfuscators/IDeobfuscator.cs @@ -27,6 +27,14 @@ namespace de4dot.deobfuscators { bool RenameResourcesInCode { get; } } + public enum DecrypterType { + Default, + None, + Static, + Delegate, + Emulate, + } + [Flags] enum StringFeatures { AllowNoDecryption, @@ -41,7 +49,8 @@ namespace de4dot.deobfuscators { Func IsValidName { get; } IDeobfuscatorOptions TheOptions { get; } IOperations Operations { get; set; } - StringFeatures StringFeatures { get; set; } + StringFeatures StringFeatures { get; } + DecrypterType DefaultDecrypterType { get; } // This is non-null only in init(), detect() and deobfuscateBegin(). IDeobfuscatedFile DeobfuscatedFile { get; set; }