monocul.us/de4dot-cex
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge branch 'master' into confuser

Browse Source
This commit is contained in:
de4dot 2013-11-19 17:44:49 +01:00
commit ef69e7a44a
43 changed files with 166 additions and 215 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
AssemblyData/Properties/AssemblyInfo.cs
View File

@ -29,5 +29,5 @@ using System.Runtime.InteropServices;
[assembly: AssemblyTrademark("")] [assembly: AssemblyTrademark("")]
[assembly: AssemblyCulture("")] [assembly: AssemblyCulture("")]
[assembly: ComVisible(false)] [assembly: ComVisible(false)]
[assembly: AssemblyVersion("2.0.3.3405")] [assembly: AssemblyVersion("3.0.2.3405")]
[assembly: AssemblyFileVersion("2.0.3.3405")] [assembly: AssemblyFileVersion("3.0.2.3405")]

4
AssemblyServer-CLR20-x64/Properties/AssemblyInfo.cs
View File

@ -29,5 +29,5 @@ using System.Runtime.InteropServices;
[assembly: AssemblyTrademark("")] [assembly: AssemblyTrademark("")]
[assembly: AssemblyCulture("")] [assembly: AssemblyCulture("")]
[assembly: ComVisible(false)] [assembly: ComVisible(false)]
[assembly: AssemblyVersion("2.0.3.3405")] [assembly: AssemblyVersion("3.0.2.3405")]
[assembly: AssemblyFileVersion("2.0.3.3405")] [assembly: AssemblyFileVersion("3.0.2.3405")]

4
AssemblyServer-CLR20/Properties/AssemblyInfo.cs
View File

@ -29,5 +29,5 @@ using System.Runtime.InteropServices;
[assembly: AssemblyTrademark("")] [assembly: AssemblyTrademark("")]
[assembly: AssemblyCulture("")] [assembly: AssemblyCulture("")]
[assembly: ComVisible(false)] [assembly: ComVisible(false)]
[assembly: AssemblyVersion("2.0.3.3405")] [assembly: AssemblyVersion("3.0.2.3405")]
[assembly: AssemblyFileVersion("2.0.3.3405")] [assembly: AssemblyFileVersion("3.0.2.3405")]

4
AssemblyServer-CLR40-x64/Properties/AssemblyInfo.cs
View File

@ -29,5 +29,5 @@ using System.Runtime.InteropServices;
[assembly: AssemblyTrademark("")] [assembly: AssemblyTrademark("")]
[assembly: AssemblyCulture("")] [assembly: AssemblyCulture("")]
[assembly: ComVisible(false)] [assembly: ComVisible(false)]
[assembly: AssemblyVersion("2.0.3.3405")] [assembly: AssemblyVersion("3.0.2.3405")]
[assembly: AssemblyFileVersion("2.0.3.3405")] [assembly: AssemblyFileVersion("3.0.2.3405")]

4
AssemblyServer-CLR40/Properties/AssemblyInfo.cs
View File

@ -29,5 +29,5 @@ using System.Runtime.InteropServices;
[assembly: AssemblyTrademark("")] [assembly: AssemblyTrademark("")]
[assembly: AssemblyCulture("")] [assembly: AssemblyCulture("")]
[assembly: ComVisible(false)] [assembly: ComVisible(false)]
[assembly: AssemblyVersion("2.0.3.3405")] [assembly: AssemblyVersion("3.0.2.3405")]
[assembly: AssemblyFileVersion("2.0.3.3405")] [assembly: AssemblyFileVersion("3.0.2.3405")]

4
AssemblyServer-x64/Properties/AssemblyInfo.cs
View File

@ -29,5 +29,5 @@ using System.Runtime.InteropServices;
[assembly: AssemblyTrademark("")] [assembly: AssemblyTrademark("")]
[assembly: AssemblyCulture("")] [assembly: AssemblyCulture("")]
[assembly: ComVisible(false)] [assembly: ComVisible(false)]
[assembly: AssemblyVersion("2.0.3.3405")] [assembly: AssemblyVersion("3.0.2.3405")]
[assembly: AssemblyFileVersion("2.0.3.3405")] [assembly: AssemblyFileVersion("3.0.2.3405")]

4
AssemblyServer/Properties/AssemblyInfo.cs
View File

@ -29,5 +29,5 @@ using System.Runtime.InteropServices;
[assembly: AssemblyTrademark("")] [assembly: AssemblyTrademark("")]
[assembly: AssemblyCulture("")] [assembly: AssemblyCulture("")]
[assembly: ComVisible(false)] [assembly: ComVisible(false)]
[assembly: AssemblyVersion("2.0.3.3405")] [assembly: AssemblyVersion("3.0.2.3405")]
[assembly: AssemblyFileVersion("2.0.3.3405")] [assembly: AssemblyFileVersion("3.0.2.3405")]

89
README.md
View File

@ -26,7 +26,6 @@ Here's a pseudo random list of the things it will do depending on what obfuscato
* Fixes some peverify errors. Many of the obfuscators are buggy and create unverifiable code by mistake. * Fixes some peverify errors. Many of the obfuscators are buggy and create unverifiable code by mistake.
* Restore the types of method parameters and fields * Restore the types of method parameters and fields
Supported obfuscators/packers Supported obfuscators/packers
============================= =============================
@ -52,6 +51,13 @@ Supported obfuscators/packers
Some of the above obfuscators are rarely used (eg. Goliath.NET), so they have had much less testing. Help me out by reporting bugs or problems you find. Some of the above obfuscators are rarely used (eg. Goliath.NET), so they have had much less testing. Help me out by reporting bugs or problems you find.
Warning
=======
Sometimes the obfuscated assembly and all its dependencies are loaded into memory for execution. Use a safe sandbox environment if you suspect the assembly or assemblies to be malware.
Even if the current version of de4dot doesn't load a certain assembly into memory for execution, a future version might.
How to use de4dot How to use de4dot
================= =================
@ -166,13 +172,13 @@ The default regexes should be enough, except possibly the one that is used when
Eg., currently the following is the default regex used when Dotfuscator is detected Eg., currently the following is the default regex used when Dotfuscator is detected
!^[a-z][a-z0-9]{0,2}$&!^A_[0-9]+$&^[a-zA-Z_<{$][a-zA-Z_0-9<>{}$.`-]*$ !^[a-z][a-z0-9]{0,2}$&!^A_[0-9]+$&^[\u2E80-\u9FFFa-zA-Z_<{$][\u2E80-\u9FFFa-zA-Z_0-9<>{}$.`-]*$
As you can see, it's not just one regex, it's more than one. Each is separated by `&` and each regex can be negated by using `!` in front of it. To show it more clearly, these regexes are used: As you can see, it's not just one regex, it's more than one. Each one is separated by `&` and each regex can be negated by using `!` in front of it. To show it more clearly, these regexes are used:
(negated) ^[a-z][a-z0-9]{0,2}$ (negated) ^[a-z][a-z0-9]{0,2}$
(negated) ^A_[0-9]+$ (negated) ^A_[0-9]+$
^[a-zA-Z_<{$][a-zA-Z_0-9<>{}$.`-]*$ ^[\u2E80-\u9FFFa-zA-Z_<{$][\u2E80-\u9FFFa-zA-Z_0-9<>{}$.`-]*$
To change the regex(es), you must know the short type name of the obfuscator (see help screen). Eg. it's `sa` if it's SmartAssembly, and `un` if it's an unsupported/unknown obfuscator. The option to use is `--TYPE-name` (eg. `--sa-name` for SmartAssembly and `--un-name` for unknown/unsupported obfuscators): To change the regex(es), you must know the short type name of the obfuscator (see help screen). Eg. it's `sa` if it's SmartAssembly, and `un` if it's an unsupported/unknown obfuscator. The option to use is `--TYPE-name` (eg. `--sa-name` for SmartAssembly and `--un-name` for unknown/unsupported obfuscators):
@ -182,78 +188,3 @@ Other options
------------- -------------
Start `de4dot` without any arguments and it will show all options. Start `de4dot` without any arguments and it will show all options.
Tiny FAQ
========
Is this a cracker only tool?
----------------------------
Of course. Not. Here's some legitimate uses of this software:
* Malware analysis
Many malware try to protect against analysis. They think obfuscating the code makes it hard. Mistake no. 1 was to use .NET.
* Speed up a program / use less memory
Unless only symbol renaming was used, the obfuscated assembly is usually slower and requires more memory at runtime compared to the original assembly. By unpacking and deobfuscating it, the program's memory usage and speed will be almost identical to the original program.
* Make the assembly compatible with mono
Most obfuscators don't support mono, even if the original assembly does. By unpacking and deobfuscating it, mono support will be restored.
* You lost your source code and only have the obfuscated .NET assemblies
By unpacking and deobfuscating your assemblies, you can then use any .NET decompiler (eg. the open source ILSpy) to get back your source code.
* Obfuscator created unverifiable code but code must be verifiable
Some of the obfuscators are buggy and create unverifiable code due to bugs in the software. Some of these errors are fixed by de4dot.
I've "protected" my app with some obfuscator but I just found out about de4dot. Is .NET obfuscation useless?
------------------------------------------------------------------------------------------------------------
Yes. It's simply way too easy to restore most of these "protections".
What do you think of these obfuscators? They're good, right?
------------------------------------------------------------
:D
Speaking from experience with a lot of obfuscators, I can say that their protection is really weak. You see the same weak "protection" in pretty much every obfuscator. Copying ideas from other obfuscators seems to be their best skill.
99% of the people working for these companies have absolutely no experience in reverse engineering. If you have no experience in what is a good or a bad protection, it's very unlikely that you're able to write a good protection.
To show you an example, most obfuscators can encrypt all the strings in your assemblies. What they fail to tell you is that it's child's play to decrypt the strings. Here's an example from SecureTeam's Agile.NET (aka CliSecure). de4dot's Agile.NET string decrypter code is only 85 lines long, and that includes the GPLv3 comment at the top of the file and the code that detects the string decrypter in the assembly!
The actual string decrypter code is 4 lines long, and it's a simple XOR loop! When Agile.NET (aka CliSecure) encrypts your strings, it replaces the original strings with an XOR'd copy, and adds a call to their string decrypter. This decrypter merely XOR's every character and returns the decrypted string. Here's the string decrypter code de4dot uses:
:::C#
public string decrypt(string es) {
char[] buf = new char[es.Length];
for (int i = 0; i < es.Length; i++)
buf[i] = (char)(es[i] ^ stringDecrypterKey[i % stringDecrypterKey.Length]);
return new string(buf);
}
Your code might look like this:
:::C#
string myString = "Hello World";
and the obfuscator (eg. Agile.NET / CliSecure) will replace that with something similar to this:
:::C#
string myString = DecryptClass.decrypt("AoF41Fk5422");
Yes, Agile.NET's string encryption feature really is this bad! I bet you that none of their customers knows about this. And SecureTeam sure wants to keep it that way. :)
Even though most of the other obfuscators' string encryption feature isn't as bad as Agile.NET's string encryption, they still have one thing in common: it's very easy to decrypt the strings again.
I must use .NET so what's the best protection?
----------------------------------------------
If you don't count "don't distribute it" as a solution, the best obfuscator feature is symbol renaming. It's impossible to restore the symbols unless they're part of the assembly. All of the other "protections" are 100% reversible.

4
Test.Rename.Dll/Properties/AssemblyInfo.cs
View File

@ -29,5 +29,5 @@ using System.Runtime.InteropServices;
[assembly: AssemblyTrademark("")] [assembly: AssemblyTrademark("")]
[assembly: AssemblyCulture("")] [assembly: AssemblyCulture("")]
[assembly: ComVisible(false)] [assembly: ComVisible(false)]
[assembly: AssemblyVersion("2.0.3.3405")] [assembly: AssemblyVersion("3.0.2.3405")]
[assembly: AssemblyFileVersion("2.0.3.3405")] [assembly: AssemblyFileVersion("3.0.2.3405")]

4
Test.Rename/Properties/AssemblyInfo.cs
View File

@ -29,5 +29,5 @@ using System.Runtime.InteropServices;
[assembly: AssemblyTrademark("")] [assembly: AssemblyTrademark("")]
[assembly: AssemblyCulture("")] [assembly: AssemblyCulture("")]
[assembly: ComVisible(false)] [assembly: ComVisible(false)]
[assembly: AssemblyVersion("2.0.3.3405")] [assembly: AssemblyVersion("3.0.2.3405")]
[assembly: AssemblyFileVersion("2.0.3.3405")] [assembly: AssemblyFileVersion("3.0.2.3405")]

4
de4dot-x64/Properties/AssemblyInfo.cs
View File

@ -29,5 +29,5 @@ using System.Runtime.InteropServices;
[assembly: AssemblyTrademark("")] [assembly: AssemblyTrademark("")]
[assembly: AssemblyCulture("")] [assembly: AssemblyCulture("")]
[assembly: ComVisible(false)] [assembly: ComVisible(false)]
[assembly: AssemblyVersion("2.0.3.3405")] [assembly: AssemblyVersion("3.0.2.3405")]
[assembly: AssemblyFileVersion("2.0.3.3405")] [assembly: AssemblyFileVersion("3.0.2.3405")]

4
de4dot.blocks/Properties/AssemblyInfo.cs
View File

@ -29,5 +29,5 @@ using System.Runtime.InteropServices;
[assembly: AssemblyTrademark("")] [assembly: AssemblyTrademark("")]
[assembly: AssemblyCulture("")] [assembly: AssemblyCulture("")]
[assembly: ComVisible(false)] [assembly: ComVisible(false)]
[assembly: AssemblyVersion("2.0.3.3405")] [assembly: AssemblyVersion("3.0.2.3405")]
[assembly: AssemblyFileVersion("2.0.3.3405")] [assembly: AssemblyFileVersion("3.0.2.3405")]

4
de4dot.code/NameRegexes.cs
View File

@ -55,6 +55,10 @@ namespace de4dot.code {
public bool DefaultValue { get; set; } public bool DefaultValue { get; set; }
public const char regexSeparatorChar = '&'; public const char regexSeparatorChar = '&';
public IList<NameRegex> Regexes {
get { return regexes; }
}
public NameRegexes() public NameRegexes()
: this("") { : this("") {
} }

12
de4dot.code/Option.cs
View File

@ -91,7 +91,7 @@ namespace de4dot.code {
return true; return true;
} }
public bool get() { public bool Get() {
return val; return val;
} }
} }
@ -118,7 +118,7 @@ namespace de4dot.code {
return true; return true;
} }
public int get() { public int Get() {
return val; return val;
} }
} }
@ -141,7 +141,7 @@ namespace de4dot.code {
return true; return true;
} }
public string get() { public string Get() {
return val; return val;
} }
} }
@ -172,7 +172,7 @@ namespace de4dot.code {
return true; return true;
} }
public NameRegexes get() { public NameRegexes Get() {
return val; return val;
} }
} }
@ -201,7 +201,7 @@ namespace de4dot.code {
return true; return true;
} }
public Regex get() { public Regex Get() {
return val; return val;
} }
} }
@ -231,7 +231,7 @@ namespace de4dot.code {
return true; return true;
} }
public bool get() { public bool Get() {
return triggered; return triggered;
} }
} }

4
de4dot.code/Properties/AssemblyInfo.cs
View File

@ -29,5 +29,5 @@ using System.Runtime.InteropServices;
[assembly: AssemblyTrademark("")] [assembly: AssemblyTrademark("")]
[assembly: AssemblyCulture("")] [assembly: AssemblyCulture("")]
[assembly: ComVisible(false)] [assembly: ComVisible(false)]
[assembly: AssemblyVersion("2.0.3.3405")] [assembly: AssemblyVersion("3.0.2.3405")]
[assembly: AssemblyFileVersion("2.0.3.3405")] [assembly: AssemblyFileVersion("3.0.2.3405")]

14
de4dot.code/deobfuscators/Agile_NET/Deobfuscator.cs
View File

@ -28,7 +28,7 @@ namespace de4dot.code.deobfuscators.Agile_NET {
public class DeobfuscatorInfo : DeobfuscatorInfoBase { public class DeobfuscatorInfo : DeobfuscatorInfoBase {
public const string THE_NAME = "Agile.NET"; public const string THE_NAME = "Agile.NET";
public const string THE_TYPE = "an"; public const string THE_TYPE = "an";
const string DEFAULT_REGEX = @"[a-zA-Z_0-9>}$]$"; const string DEFAULT_REGEX = DeobfuscatorBase.DEFAULT_ASIAN_VALID_NAME_REGEX;
BoolOption decryptMethods; BoolOption decryptMethods;
BoolOption decryptResources; BoolOption decryptResources;
BoolOption removeStackFrameHelper; BoolOption removeStackFrameHelper;
@ -54,12 +54,12 @@ namespace de4dot.code.deobfuscators.Agile_NET {
public override IDeobfuscator CreateDeobfuscator() { public override IDeobfuscator CreateDeobfuscator() {
return new Deobfuscator(new Deobfuscator.Options { return new Deobfuscator(new Deobfuscator.Options {
ValidNameRegex = validNameRegex.get(), ValidNameRegex = validNameRegex.Get(),
DecryptMethods = decryptMethods.get(), DecryptMethods = decryptMethods.Get(),
DecryptResources = decryptResources.get(), DecryptResources = decryptResources.Get(),
RemoveStackFrameHelper = removeStackFrameHelper.get(), RemoveStackFrameHelper = removeStackFrameHelper.Get(),
RestoreVmCode = restoreVmCode.get(), RestoreVmCode = restoreVmCode.Get(),
SetInitLocals = setInitLocals.get(), SetInitLocals = setInitLocals.Get(),
}); });
} }

17
de4dot.code/deobfuscators/Babel_NET/Deobfuscator.cs
View File

@ -27,6 +27,7 @@ namespace de4dot.code.deobfuscators.Babel_NET {
public class DeobfuscatorInfo : DeobfuscatorInfoBase { public class DeobfuscatorInfo : DeobfuscatorInfoBase {
public const string THE_NAME = "Babel .NET"; public const string THE_NAME = "Babel .NET";
public const string THE_TYPE = "bl"; public const string THE_TYPE = "bl";
const string DEFAULT_REGEX = DeobfuscatorBase.DEFAULT_ASIAN_VALID_NAME_REGEX;
BoolOption inlineMethods; BoolOption inlineMethods;
BoolOption removeInlinedMethods; BoolOption removeInlinedMethods;
BoolOption decryptMethods; BoolOption decryptMethods;
@ -35,7 +36,7 @@ namespace de4dot.code.deobfuscators.Babel_NET {
BoolOption dumpEmbeddedAssemblies; BoolOption dumpEmbeddedAssemblies;
public DeobfuscatorInfo() public DeobfuscatorInfo()
: base() { : base(DEFAULT_REGEX) {
inlineMethods = new BoolOption(null, MakeArgName("inline"), "Inline short methods", true); inlineMethods = new BoolOption(null, MakeArgName("inline"), "Inline short methods", true);
removeInlinedMethods = new BoolOption(null, MakeArgName("remove-inlined"), "Remove inlined methods", true); removeInlinedMethods = new BoolOption(null, MakeArgName("remove-inlined"), "Remove inlined methods", true);
decryptMethods = new BoolOption(null, MakeArgName("methods"), "Decrypt methods", true); decryptMethods = new BoolOption(null, MakeArgName("methods"), "Decrypt methods", true);
@ -54,13 +55,13 @@ namespace de4dot.code.deobfuscators.Babel_NET {
public override IDeobfuscator CreateDeobfuscator() { public override IDeobfuscator CreateDeobfuscator() {
return new Deobfuscator(new Deobfuscator.Options { return new Deobfuscator(new Deobfuscator.Options {
ValidNameRegex = validNameRegex.get(), ValidNameRegex = validNameRegex.Get(),
InlineMethods = inlineMethods.get(), InlineMethods = inlineMethods.Get(),
RemoveInlinedMethods = removeInlinedMethods.get(), RemoveInlinedMethods = removeInlinedMethods.Get(),
DecryptMethods = decryptMethods.get(), DecryptMethods = decryptMethods.Get(),
DecryptResources = decryptResources.get(), DecryptResources = decryptResources.Get(),
DecryptConstants = decryptConstants.get(), DecryptConstants = decryptConstants.Get(),
DumpEmbeddedAssemblies = dumpEmbeddedAssemblies.get(), DumpEmbeddedAssemblies = dumpEmbeddedAssemblies.Get(),
}); });
} }

6
de4dot.code/deobfuscators/CodeFort/Deobfuscator.cs
View File

@ -26,7 +26,7 @@ namespace de4dot.code.deobfuscators.CodeFort {
public class DeobfuscatorInfo : DeobfuscatorInfoBase { public class DeobfuscatorInfo : DeobfuscatorInfoBase {
public const string THE_NAME = "CodeFort"; public const string THE_NAME = "CodeFort";
public const string THE_TYPE = "cf"; public const string THE_TYPE = "cf";
const string DEFAULT_REGEX = @"!^[a-zA-Z]{1,3}$&!^[_<>{}$.`-]$&" + DeobfuscatorBase.DEFAULT_VALID_NAME_REGEX; const string DEFAULT_REGEX = @"!^[a-zA-Z]{1,3}$&!^[_<>{}$.`-]$&" + DeobfuscatorBase.DEFAULT_ASIAN_VALID_NAME_REGEX;
BoolOption dumpEmbeddedAssemblies; BoolOption dumpEmbeddedAssemblies;
public DeobfuscatorInfo() public DeobfuscatorInfo()
@ -44,8 +44,8 @@ namespace de4dot.code.deobfuscators.CodeFort {
public override IDeobfuscator CreateDeobfuscator() { public override IDeobfuscator CreateDeobfuscator() {
return new Deobfuscator(new Deobfuscator.Options { return new Deobfuscator(new Deobfuscator.Options {
ValidNameRegex = validNameRegex.get(), ValidNameRegex = validNameRegex.Get(),
DumpEmbeddedAssemblies = dumpEmbeddedAssemblies.get(), DumpEmbeddedAssemblies = dumpEmbeddedAssemblies.Get(),
}); });
} }

4
de4dot.code/deobfuscators/CodeVeil/Deobfuscator.cs
View File

@ -26,7 +26,7 @@ namespace de4dot.code.deobfuscators.CodeVeil {
public class DeobfuscatorInfo : DeobfuscatorInfoBase { public class DeobfuscatorInfo : DeobfuscatorInfoBase {
public const string THE_NAME = "CodeVeil"; public const string THE_NAME = "CodeVeil";
public const string THE_TYPE = "cv"; public const string THE_TYPE = "cv";
const string DEFAULT_REGEX = @"!^[A-Za-z]{1,2}$&" + DeobfuscatorBase.DEFAULT_VALID_NAME_REGEX; const string DEFAULT_REGEX = @"!^[A-Za-z]{1,2}$&" + DeobfuscatorBase.DEFAULT_ASIAN_VALID_NAME_REGEX;
public DeobfuscatorInfo() public DeobfuscatorInfo()
: base(DEFAULT_REGEX) { : base(DEFAULT_REGEX) {
@ -42,7 +42,7 @@ namespace de4dot.code.deobfuscators.CodeVeil {
public override IDeobfuscator CreateDeobfuscator() { public override IDeobfuscator CreateDeobfuscator() {
return new Deobfuscator(new Deobfuscator.Options { return new Deobfuscator(new Deobfuscator.Options {
ValidNameRegex = validNameRegex.get(), ValidNameRegex = validNameRegex.Get(),
}); });
} }

8
de4dot.code/deobfuscators/CodeWall/Deobfuscator.cs
View File

@ -26,7 +26,7 @@ namespace de4dot.code.deobfuscators.CodeWall {
public class DeobfuscatorInfo : DeobfuscatorInfoBase { public class DeobfuscatorInfo : DeobfuscatorInfoBase {
public const string THE_NAME = "CodeWall"; public const string THE_NAME = "CodeWall";
public const string THE_TYPE = "cw"; public const string THE_TYPE = "cw";
const string DEFAULT_REGEX = @"!^[0-9A-F]{32}$&!^[_<>{}$.`-]$&" + DeobfuscatorBase.DEFAULT_VALID_NAME_REGEX; const string DEFAULT_REGEX = @"!^[0-9A-F]{32}$&!^[_<>{}$.`-]$&" + DeobfuscatorBase.DEFAULT_ASIAN_VALID_NAME_REGEX;
BoolOption dumpEmbeddedAssemblies; BoolOption dumpEmbeddedAssemblies;
BoolOption decryptMainAsm; BoolOption decryptMainAsm;
@ -46,9 +46,9 @@ namespace de4dot.code.deobfuscators.CodeWall {
public override IDeobfuscator CreateDeobfuscator() { public override IDeobfuscator CreateDeobfuscator() {
return new Deobfuscator(new Deobfuscator.Options { return new Deobfuscator(new Deobfuscator.Options {
ValidNameRegex = validNameRegex.get(), ValidNameRegex = validNameRegex.Get(),
DumpEmbeddedAssemblies = dumpEmbeddedAssemblies.get(), DumpEmbeddedAssemblies = dumpEmbeddedAssemblies.Get(),
DecryptMainAsm = decryptMainAsm.get(), DecryptMainAsm = decryptMainAsm.Get(),
}); });
} }

12
de4dot.code/deobfuscators/CryptoObfuscator/Deobfuscator.cs
View File

@ -28,7 +28,7 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
public class DeobfuscatorInfo : DeobfuscatorInfoBase { public class DeobfuscatorInfo : DeobfuscatorInfoBase {
public const string THE_NAME = "Crypto Obfuscator"; public const string THE_NAME = "Crypto Obfuscator";
public const string THE_TYPE = "co"; public const string THE_TYPE = "co";
const string DEFAULT_REGEX = @"!^(get_|set_|add_|remove_)?[A-Z]{1,3}(?:`\d+)?$&!^(get_|set_|add_|remove_)?c[0-9a-f]{32}(?:`\d+)?$&" + DeobfuscatorBase.DEFAULT_VALID_NAME_REGEX; const string DEFAULT_REGEX = @"!^(get_|set_|add_|remove_)?[A-Z]{1,3}(?:`\d+)?$&!^(get_|set_|add_|remove_)?c[0-9a-f]{32}(?:`\d+)?$&" + DeobfuscatorBase.DEFAULT_ASIAN_VALID_NAME_REGEX;
BoolOption removeTamperProtection; BoolOption removeTamperProtection;
BoolOption decryptConstants; BoolOption decryptConstants;
BoolOption inlineMethods; BoolOption inlineMethods;
@ -52,11 +52,11 @@ namespace de4dot.code.deobfuscators.CryptoObfuscator {
public override IDeobfuscator CreateDeobfuscator() { public override IDeobfuscator CreateDeobfuscator() {
return new Deobfuscator(new Deobfuscator.Options { return new Deobfuscator(new Deobfuscator.Options {
ValidNameRegex = validNameRegex.get(), ValidNameRegex = validNameRegex.Get(),
RemoveTamperProtection = removeTamperProtection.get(), RemoveTamperProtection = removeTamperProtection.Get(),
DecryptConstants = decryptConstants.get(), DecryptConstants = decryptConstants.Get(),
InlineMethods = inlineMethods.get(), InlineMethods = inlineMethods.Get(),
FixLdnull = fixLdnull.get(), FixLdnull = fixLdnull.Get(),
}); });
} }

19
de4dot.code/deobfuscators/DeepSea/Deobfuscator.cs
View File

@ -26,6 +26,7 @@ namespace de4dot.code.deobfuscators.DeepSea {
public class DeobfuscatorInfo : DeobfuscatorInfoBase { public class DeobfuscatorInfo : DeobfuscatorInfoBase {
public const string THE_NAME = "DeepSea"; public const string THE_NAME = "DeepSea";
public const string THE_TYPE = "ds"; public const string THE_TYPE = "ds";
const string DEFAULT_REGEX = DeobfuscatorBase.DEFAULT_ASIAN_VALID_NAME_REGEX;
BoolOption inlineMethods; BoolOption inlineMethods;
BoolOption removeInlinedMethods; BoolOption removeInlinedMethods;
BoolOption decryptResources; BoolOption decryptResources;
@ -35,7 +36,7 @@ namespace de4dot.code.deobfuscators.DeepSea {
BoolOption castDeobfuscation; BoolOption castDeobfuscation;
public DeobfuscatorInfo() public DeobfuscatorInfo()
: base() { : base(DEFAULT_REGEX) {
inlineMethods = new BoolOption(null, MakeArgName("inline"), "Inline short methods", true); inlineMethods = new BoolOption(null, MakeArgName("inline"), "Inline short methods", true);
removeInlinedMethods = new BoolOption(null, MakeArgName("remove-inlined"), "Remove inlined methods", true); removeInlinedMethods = new BoolOption(null, MakeArgName("remove-inlined"), "Remove inlined methods", true);
decryptResources = new BoolOption(null, MakeArgName("rsrc"), "Decrypt resources", true); decryptResources = new BoolOption(null, MakeArgName("rsrc"), "Decrypt resources", true);
@ -55,14 +56,14 @@ namespace de4dot.code.deobfuscators.DeepSea {
public override IDeobfuscator CreateDeobfuscator() { public override IDeobfuscator CreateDeobfuscator() {
return new Deobfuscator(new Deobfuscator.Options { return new Deobfuscator(new Deobfuscator.Options {
ValidNameRegex = validNameRegex.get(), ValidNameRegex = validNameRegex.Get(),
InlineMethods = inlineMethods.get(), InlineMethods = inlineMethods.Get(),
RemoveInlinedMethods = removeInlinedMethods.get(), RemoveInlinedMethods = removeInlinedMethods.Get(),
DecryptResources = decryptResources.get(), DecryptResources = decryptResources.Get(),
DumpEmbeddedAssemblies = dumpEmbeddedAssemblies.get(), DumpEmbeddedAssemblies = dumpEmbeddedAssemblies.Get(),
RestoreFields = restoreFields.get(), RestoreFields = restoreFields.Get(),
RenameResourceKeys = renameResourceKeys.get(), RenameResourceKeys = renameResourceKeys.Get(),
CastDeobfuscation = castDeobfuscation.get(), CastDeobfuscation = castDeobfuscation.Get(),
}); });
} }

1
de4dot.code/deobfuscators/DeobfuscatorBase.cs
View File

@ -29,6 +29,7 @@ using de4dot.blocks.cflow;
namespace de4dot.code.deobfuscators { namespace de4dot.code.deobfuscators {
abstract class DeobfuscatorBase : IDeobfuscator, IModuleWriterListener { abstract class DeobfuscatorBase : IDeobfuscator, IModuleWriterListener {
public const string DEFAULT_VALID_NAME_REGEX = @"^[a-zA-Z_<{$][a-zA-Z_0-9<>{}$.`-]*$"; public const string DEFAULT_VALID_NAME_REGEX = @"^[a-zA-Z_<{$][a-zA-Z_0-9<>{}$.`-]*$";
public const string DEFAULT_ASIAN_VALID_NAME_REGEX = @"^[\u2E80-\u9FFFa-zA-Z_<{$][\u2E80-\u9FFFa-zA-Z_0-9<>{}$.`-]*$";
class RemoveInfo<T> { class RemoveInfo<T> {
public T obj; public T obj;

4
de4dot.code/deobfuscators/DeobfuscatorInfoBase.cs
View File

@ -23,10 +23,6 @@ namespace de4dot.code.deobfuscators {
public abstract class DeobfuscatorInfoBase : IDeobfuscatorInfo { public abstract class DeobfuscatorInfoBase : IDeobfuscatorInfo {
protected NameRegexOption validNameRegex; protected NameRegexOption validNameRegex;
public DeobfuscatorInfoBase()
: this(null) {
}
public DeobfuscatorInfoBase(string nameRegex) { public DeobfuscatorInfoBase(string nameRegex) {
validNameRegex = new NameRegexOption(null, MakeArgName("name"), "Valid name regex pattern", nameRegex ?? DeobfuscatorBase.DEFAULT_VALID_NAME_REGEX); validNameRegex = new NameRegexOption(null, MakeArgName("name"), "Valid name regex pattern", nameRegex ?? DeobfuscatorBase.DEFAULT_VALID_NAME_REGEX);
} }

4
de4dot.code/deobfuscators/Dotfuscator/Deobfuscator.cs
View File

@ -25,7 +25,7 @@ namespace de4dot.code.deobfuscators.Dotfuscator {
public class DeobfuscatorInfo : DeobfuscatorInfoBase { public class DeobfuscatorInfo : DeobfuscatorInfoBase {
public const string THE_NAME = "Dotfuscator"; public const string THE_NAME = "Dotfuscator";
public const string THE_TYPE = "df"; public const string THE_TYPE = "df";
const string DEFAULT_REGEX = @"!^[a-z][a-z0-9]{0,2}$&!^A_[0-9]+$&" + DeobfuscatorBase.DEFAULT_VALID_NAME_REGEX; const string DEFAULT_REGEX = @"!^[a-z][a-z0-9]{0,2}$&!^A_[0-9]+$&" + DeobfuscatorBase.DEFAULT_ASIAN_VALID_NAME_REGEX;
public DeobfuscatorInfo() public DeobfuscatorInfo()
: base(DEFAULT_REGEX) { : base(DEFAULT_REGEX) {
} }
@ -41,7 +41,7 @@ namespace de4dot.code.deobfuscators.Dotfuscator {
public override IDeobfuscator CreateDeobfuscator() { public override IDeobfuscator CreateDeobfuscator() {
return new Deobfuscator(new Deobfuscator.Options { return new Deobfuscator(new Deobfuscator.Options {
RenameResourcesInCode = false, RenameResourcesInCode = false,
ValidNameRegex = validNameRegex.get(), ValidNameRegex = validNameRegex.Get(),
}); });
} }
} }

4
de4dot.code/deobfuscators/Eazfuscator_NET/Deobfuscator.cs
View File

@ -28,7 +28,7 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
public class DeobfuscatorInfo : DeobfuscatorInfoBase { public class DeobfuscatorInfo : DeobfuscatorInfoBase {
public const string THE_NAME = "Eazfuscator.NET"; public const string THE_NAME = "Eazfuscator.NET";
public const string THE_TYPE = "ef"; public const string THE_TYPE = "ef";
const string DEFAULT_REGEX = @"!^#=&!^dje_.+_ejd$&" + DeobfuscatorBase.DEFAULT_VALID_NAME_REGEX; const string DEFAULT_REGEX = @"!^#=&!^dje_.+_ejd$&" + DeobfuscatorBase.DEFAULT_ASIAN_VALID_NAME_REGEX;
public DeobfuscatorInfo() public DeobfuscatorInfo()
: base(DEFAULT_REGEX) { : base(DEFAULT_REGEX) {
} }
@ -43,7 +43,7 @@ namespace de4dot.code.deobfuscators.Eazfuscator_NET {
public override IDeobfuscator CreateDeobfuscator() { public override IDeobfuscator CreateDeobfuscator() {
return new Deobfuscator(new Deobfuscator.Options { return new Deobfuscator(new Deobfuscator.Options {
ValidNameRegex = validNameRegex.get(), ValidNameRegex = validNameRegex.Get(),
}); });
} }
} }

16
de4dot.code/deobfuscators/Goliath_NET/Deobfuscator.cs
View File

@ -25,7 +25,7 @@ namespace de4dot.code.deobfuscators.Goliath_NET {
public class DeobfuscatorInfo : DeobfuscatorInfoBase { public class DeobfuscatorInfo : DeobfuscatorInfoBase {
public const string THE_NAME = "Goliath.NET"; public const string THE_NAME = "Goliath.NET";
public const string THE_TYPE = "go"; public const string THE_TYPE = "go";
const string DEFAULT_REGEX = @"!^[A-Za-z]{1,2}(?:`\d+)?$&" + DeobfuscatorBase.DEFAULT_VALID_NAME_REGEX; const string DEFAULT_REGEX = @"!^[A-Za-z]{1,2}(?:`\d+)?$&" + DeobfuscatorBase.DEFAULT_ASIAN_VALID_NAME_REGEX;
BoolOption inlineMethods; BoolOption inlineMethods;
BoolOption removeInlinedMethods; BoolOption removeInlinedMethods;
BoolOption restoreLocals; BoolOption restoreLocals;
@ -54,13 +54,13 @@ namespace de4dot.code.deobfuscators.Goliath_NET {
public override IDeobfuscator CreateDeobfuscator() { public override IDeobfuscator CreateDeobfuscator() {
return new Deobfuscator(new Deobfuscator.Options { return new Deobfuscator(new Deobfuscator.Options {
RenameResourcesInCode = false, RenameResourcesInCode = false,
ValidNameRegex = validNameRegex.get(), ValidNameRegex = validNameRegex.Get(),
InlineMethods = inlineMethods.get(), InlineMethods = inlineMethods.Get(),
RemoveInlinedMethods = removeInlinedMethods.get(), RemoveInlinedMethods = removeInlinedMethods.Get(),
RestoreLocals = restoreLocals.get(), RestoreLocals = restoreLocals.Get(),
DecryptIntegers = decryptIntegers.get(), DecryptIntegers = decryptIntegers.Get(),
DecryptArrays = decryptArrays.get(), DecryptArrays = decryptArrays.Get(),
RemoveAntiStrongName = removeAntiStrongName.get(), RemoveAntiStrongName = removeAntiStrongName.Get(),
}); });
} }

5
de4dot.code/deobfuscators/ILProtector/Deobfuscator.cs
View File

@ -26,9 +26,10 @@ namespace de4dot.code.deobfuscators.ILProtector {
public class DeobfuscatorInfo : DeobfuscatorInfoBase { public class DeobfuscatorInfo : DeobfuscatorInfoBase {
public const string THE_NAME = "ILProtector"; public const string THE_NAME = "ILProtector";
public const string THE_TYPE = "il"; public const string THE_TYPE = "il";
const string DEFAULT_REGEX = DeobfuscatorBase.DEFAULT_ASIAN_VALID_NAME_REGEX;
public DeobfuscatorInfo() public DeobfuscatorInfo()
: base() { : base(DEFAULT_REGEX) {
} }
public override string Name { public override string Name {
@ -41,7 +42,7 @@ namespace de4dot.code.deobfuscators.ILProtector {
public override IDeobfuscator CreateDeobfuscator() { public override IDeobfuscator CreateDeobfuscator() {
return new Deobfuscator(new Deobfuscator.Options { return new Deobfuscator(new Deobfuscator.Options {
ValidNameRegex = validNameRegex.get(), ValidNameRegex = validNameRegex.Get(),
}); });
} }

6
de4dot.code/deobfuscators/MPRESS/Deobfuscator.cs
View File

@ -29,8 +29,10 @@ namespace de4dot.code.deobfuscators.MPRESS {
public class DeobfuscatorInfo : DeobfuscatorInfoBase { public class DeobfuscatorInfo : DeobfuscatorInfoBase {
public const string THE_NAME = "MPRESS"; public const string THE_NAME = "MPRESS";
public const string THE_TYPE = "mp"; public const string THE_TYPE = "mp";
const string DEFAULT_REGEX = DeobfuscatorBase.DEFAULT_ASIAN_VALID_NAME_REGEX;
public DeobfuscatorInfo() public DeobfuscatorInfo()
: base() { : base(DEFAULT_REGEX) {
} }
public override string Name { public override string Name {
@ -43,7 +45,7 @@ namespace de4dot.code.deobfuscators.MPRESS {
public override IDeobfuscator CreateDeobfuscator() { public override IDeobfuscator CreateDeobfuscator() {
return new Deobfuscator(new Deobfuscator.Options { return new Deobfuscator(new Deobfuscator.Options {
ValidNameRegex = validNameRegex.get(), ValidNameRegex = validNameRegex.Get(),
}); });
} }

6
de4dot.code/deobfuscators/MaxtoCode/Deobfuscator.cs
View File

@ -27,7 +27,7 @@ namespace de4dot.code.deobfuscators.MaxtoCode {
public class DeobfuscatorInfo : DeobfuscatorInfoBase { public class DeobfuscatorInfo : DeobfuscatorInfoBase {
public const string THE_NAME = "MaxtoCode"; public const string THE_NAME = "MaxtoCode";
public const string THE_TYPE = "mc"; public const string THE_TYPE = "mc";
const string DEFAULT_REGEX = @"!^[oO01l]+$&!^[A-F0-9]{20,}$&" + DeobfuscatorBase.DEFAULT_VALID_NAME_REGEX; const string DEFAULT_REGEX = @"!^[oO01l]+$&!^[A-F0-9]{20,}$&" + DeobfuscatorBase.DEFAULT_ASIAN_VALID_NAME_REGEX;
IntOption stringCodePage; IntOption stringCodePage;
public DeobfuscatorInfo() public DeobfuscatorInfo()
@ -46,8 +46,8 @@ namespace de4dot.code.deobfuscators.MaxtoCode {
public override IDeobfuscator CreateDeobfuscator() { public override IDeobfuscator CreateDeobfuscator() {
return new Deobfuscator(new Deobfuscator.Options { return new Deobfuscator(new Deobfuscator.Options {
RenameResourcesInCode = false, RenameResourcesInCode = false,
ValidNameRegex = validNameRegex.get(), ValidNameRegex = validNameRegex.Get(),
StringCodePage = stringCodePage.get(), StringCodePage = stringCodePage.Get(),
}); });
} }

3
de4dot.code/deobfuscators/Rummage/Deobfuscator.cs
View File

@ -26,6 +26,7 @@ namespace de4dot.code.deobfuscators.Rummage {
public const string THE_NAME = "Rummage"; public const string THE_NAME = "Rummage";
public const string THE_TYPE = "rm"; public const string THE_TYPE = "rm";
const string DEFAULT_REGEX = @"!."; const string DEFAULT_REGEX = @"!.";
public DeobfuscatorInfo() public DeobfuscatorInfo()
: base(DEFAULT_REGEX) { : base(DEFAULT_REGEX) {
} }
@ -40,7 +41,7 @@ namespace de4dot.code.deobfuscators.Rummage {
public override IDeobfuscator CreateDeobfuscator() { public override IDeobfuscator CreateDeobfuscator() {
return new Deobfuscator(new Deobfuscator.Options { return new Deobfuscator(new Deobfuscator.Options {
ValidNameRegex = validNameRegex.get(), ValidNameRegex = validNameRegex.Get(),
}); });
} }
} }

4
de4dot.code/deobfuscators/Skater_NET/Deobfuscator.cs
View File

@ -25,7 +25,7 @@ namespace de4dot.code.deobfuscators.Skater_NET {
public class DeobfuscatorInfo : DeobfuscatorInfoBase { public class DeobfuscatorInfo : DeobfuscatorInfoBase {
public const string THE_NAME = "Skater .NET"; public const string THE_NAME = "Skater .NET";
public const string THE_TYPE = "sk"; public const string THE_TYPE = "sk";
const string DEFAULT_REGEX = @"!`[^0-9]+&" + DeobfuscatorBase.DEFAULT_VALID_NAME_REGEX; const string DEFAULT_REGEX = @"!`[^0-9]+&" + DeobfuscatorBase.DEFAULT_ASIAN_VALID_NAME_REGEX;
public DeobfuscatorInfo() public DeobfuscatorInfo()
: base(DEFAULT_REGEX) { : base(DEFAULT_REGEX) {
@ -41,7 +41,7 @@ namespace de4dot.code.deobfuscators.Skater_NET {
public override IDeobfuscator CreateDeobfuscator() { public override IDeobfuscator CreateDeobfuscator() {
return new Deobfuscator(new Deobfuscator.Options { return new Deobfuscator(new Deobfuscator.Options {
ValidNameRegex = validNameRegex.get(), ValidNameRegex = validNameRegex.Get(),
}); });
} }
} }

3
de4dot.code/deobfuscators/SmartAssembly/AssemblyResolverInfo.cs
View File

@ -101,7 +101,8 @@ namespace de4dot.code.deobfuscators.SmartAssembly {
} }
protected override bool CheckResolverType(TypeDef type) { protected override bool CheckResolverType(TypeDef type) {
if (DotNetUtils.FindFieldType(type, "System.Collections.Hashtable", true) != null) if (DotNetUtils.FindFieldType(type, "System.Collections.Hashtable", true) != null ||
DotNetUtils.FindFieldType(type, "System.Collections.Generic.Dictionary`2<System.String,System.Reflection.Assembly>", true) != null)
return true; return true;
foreach (var field in type.Fields) { foreach (var field in type.Fields) {

11
de4dot.code/deobfuscators/SmartAssembly/Deobfuscator.cs
View File

@ -29,12 +29,13 @@ namespace de4dot.code.deobfuscators.SmartAssembly {
public class DeobfuscatorInfo : DeobfuscatorInfoBase { public class DeobfuscatorInfo : DeobfuscatorInfoBase {
public const string THE_NAME = "SmartAssembly"; public const string THE_NAME = "SmartAssembly";
public const string THE_TYPE = "sa"; public const string THE_TYPE = "sa";
const string DEFAULT_REGEX = DeobfuscatorBase.DEFAULT_ASIAN_VALID_NAME_REGEX;
BoolOption removeAutomatedErrorReporting; BoolOption removeAutomatedErrorReporting;
BoolOption removeTamperProtection; BoolOption removeTamperProtection;
BoolOption removeMemoryManager; BoolOption removeMemoryManager;
public DeobfuscatorInfo() public DeobfuscatorInfo()
: base() { : base(DEFAULT_REGEX) {
removeAutomatedErrorReporting = new BoolOption(null, MakeArgName("error"), "Remove automated error reporting code", true); removeAutomatedErrorReporting = new BoolOption(null, MakeArgName("error"), "Remove automated error reporting code", true);
removeTamperProtection = new BoolOption(null, MakeArgName("tamper"), "Remove tamper protection code", true); removeTamperProtection = new BoolOption(null, MakeArgName("tamper"), "Remove tamper protection code", true);
removeMemoryManager = new BoolOption(null, MakeArgName("memory"), "Remove memory manager code", true); removeMemoryManager = new BoolOption(null, MakeArgName("memory"), "Remove memory manager code", true);
@ -50,10 +51,10 @@ namespace de4dot.code.deobfuscators.SmartAssembly {
public override IDeobfuscator CreateDeobfuscator() { public override IDeobfuscator CreateDeobfuscator() {
return new Deobfuscator(new Deobfuscator.Options { return new Deobfuscator(new Deobfuscator.Options {
ValidNameRegex = validNameRegex.get(), ValidNameRegex = validNameRegex.Get(),
RemoveAutomatedErrorReporting = removeAutomatedErrorReporting.get(), RemoveAutomatedErrorReporting = removeAutomatedErrorReporting.Get(),
RemoveTamperProtection = removeTamperProtection.get(), RemoveTamperProtection = removeTamperProtection.Get(),
RemoveMemoryManager = removeMemoryManager.get(), RemoveMemoryManager = removeMemoryManager.Get(),
}); });
} }

12
de4dot.code/deobfuscators/Spices_Net/Deobfuscator.cs
View File

@ -26,7 +26,7 @@ namespace de4dot.code.deobfuscators.Spices_Net {
public class DeobfuscatorInfo : DeobfuscatorInfoBase { public class DeobfuscatorInfo : DeobfuscatorInfoBase {
public const string THE_NAME = "Spices.Net"; public const string THE_NAME = "Spices.Net";
public const string THE_TYPE = "sn"; public const string THE_TYPE = "sn";
const string DEFAULT_REGEX = @"!^[a-zA-Z0-9]{1,2}$&" + DeobfuscatorBase.DEFAULT_VALID_NAME_REGEX; const string DEFAULT_REGEX = @"!^[a-zA-Z0-9]{1,2}$&" + DeobfuscatorBase.DEFAULT_ASIAN_VALID_NAME_REGEX;
BoolOption inlineMethods; BoolOption inlineMethods;
BoolOption removeInlinedMethods; BoolOption removeInlinedMethods;
BoolOption removeNamespaces; BoolOption removeNamespaces;
@ -50,11 +50,11 @@ namespace de4dot.code.deobfuscators.Spices_Net {
public override IDeobfuscator CreateDeobfuscator() { public override IDeobfuscator CreateDeobfuscator() {
return new Deobfuscator(new Deobfuscator.Options { return new Deobfuscator(new Deobfuscator.Options {
ValidNameRegex = validNameRegex.get(), ValidNameRegex = validNameRegex.Get(),
InlineMethods = inlineMethods.get(), InlineMethods = inlineMethods.Get(),
RemoveInlinedMethods = removeInlinedMethods.get(), RemoveInlinedMethods = removeInlinedMethods.Get(),
RemoveNamespaces = removeNamespaces.get(), RemoveNamespaces = removeNamespaces.Get(),
RestoreResourceNames = restoreResourceNames.get(), RestoreResourceNames = restoreResourceNames.Get(),
}); });
} }

6
de4dot.code/deobfuscators/Unknown/Deobfuscator.cs
View File

@ -25,8 +25,10 @@ namespace de4dot.code.deobfuscators.Unknown {
public class DeobfuscatorInfo : DeobfuscatorInfoBase { public class DeobfuscatorInfo : DeobfuscatorInfoBase {
public const string THE_NAME = "Unknown"; public const string THE_NAME = "Unknown";
public const string THE_TYPE = "un"; public const string THE_TYPE = "un";
const string DEFAULT_REGEX = DeobfuscatorBase.DEFAULT_VALID_NAME_REGEX;
public DeobfuscatorInfo() public DeobfuscatorInfo()
: base() { : base(DEFAULT_REGEX) {
} }
public override string Name { public override string Name {
@ -40,7 +42,7 @@ namespace de4dot.code.deobfuscators.Unknown {
public override IDeobfuscator CreateDeobfuscator() { public override IDeobfuscator CreateDeobfuscator() {
return new Deobfuscator(new Deobfuscator.Options { return new Deobfuscator(new Deobfuscator.Options {
RenameResourcesInCode = false, RenameResourcesInCode = false,
ValidNameRegex = validNameRegex.get(), ValidNameRegex = validNameRegex.Get(),
}); });
} }
} }

5
de4dot.code/deobfuscators/Xenocode/Deobfuscator.cs
View File

@ -24,7 +24,8 @@ namespace de4dot.code.deobfuscators.Xenocode {
public class DeobfuscatorInfo : DeobfuscatorInfoBase { public class DeobfuscatorInfo : DeobfuscatorInfoBase {
public const string THE_NAME = "Xenocode"; public const string THE_NAME = "Xenocode";
public const string THE_TYPE = "xc"; public const string THE_TYPE = "xc";
const string DEFAULT_REGEX = @"!^[oO01l]{4,}$&!^(get_|set_|add_|remove_|_)?[x_][a-f0-9]{16,}$&" + DeobfuscatorBase.DEFAULT_VALID_NAME_REGEX; const string DEFAULT_REGEX = @"!^[oO01l]{4,}$&!^(get_|set_|add_|remove_|_)?[x_][a-f0-9]{16,}$&" + DeobfuscatorBase.DEFAULT_ASIAN_VALID_NAME_REGEX;
public DeobfuscatorInfo() public DeobfuscatorInfo()
: base(DEFAULT_REGEX) { : base(DEFAULT_REGEX) {
} }
@ -39,7 +40,7 @@ namespace de4dot.code.deobfuscators.Xenocode {
public override IDeobfuscator CreateDeobfuscator() { public override IDeobfuscator CreateDeobfuscator() {
return new Deobfuscator(new Deobfuscator.Options { return new Deobfuscator(new Deobfuscator.Options {
ValidNameRegex = validNameRegex.get(), ValidNameRegex = validNameRegex.Get(),
}); });
} }
} }

14
de4dot.code/deobfuscators/dotNET_Reactor/v3/Deobfuscator.cs
View File

@ -31,7 +31,7 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v3 {
public class DeobfuscatorInfo : DeobfuscatorInfoBase { public class DeobfuscatorInfo : DeobfuscatorInfoBase {
public const string THE_NAME = ".NET Reactor"; public const string THE_NAME = ".NET Reactor";
public const string THE_TYPE = "dr3"; public const string THE_TYPE = "dr3";
const string DEFAULT_REGEX = DeobfuscatorBase.DEFAULT_VALID_NAME_REGEX; const string DEFAULT_REGEX = DeobfuscatorBase.DEFAULT_ASIAN_VALID_NAME_REGEX;
BoolOption restoreTypes; BoolOption restoreTypes;
BoolOption inlineMethods; BoolOption inlineMethods;
BoolOption removeInlinedMethods; BoolOption removeInlinedMethods;
@ -57,12 +57,12 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v3 {
public override IDeobfuscator CreateDeobfuscator() { public override IDeobfuscator CreateDeobfuscator() {
return new Deobfuscator(new Deobfuscator.Options { return new Deobfuscator(new Deobfuscator.Options {
ValidNameRegex = validNameRegex.get(), ValidNameRegex = validNameRegex.Get(),
RestoreTypes = restoreTypes.get(), RestoreTypes = restoreTypes.Get(),
InlineMethods = inlineMethods.get(), InlineMethods = inlineMethods.Get(),
RemoveInlinedMethods = removeInlinedMethods.get(), RemoveInlinedMethods = removeInlinedMethods.Get(),
RemoveNamespaces = removeNamespaces.get(), RemoveNamespaces = removeNamespaces.Get(),
RemoveAntiStrongName = removeAntiStrongName.get(), RemoveAntiStrongName = removeAntiStrongName.Get(),
}); });
} }

30
de4dot.code/deobfuscators/dotNET_Reactor/v4/Deobfuscator.cs
View File

@ -32,7 +32,8 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 {
public class DeobfuscatorInfo : DeobfuscatorInfoBase { public class DeobfuscatorInfo : DeobfuscatorInfoBase {
public const string THE_NAME = ".NET Reactor"; public const string THE_NAME = ".NET Reactor";
public const string THE_TYPE = "dr4"; public const string THE_TYPE = "dr4";
const string DEFAULT_REGEX = @"!^[A-Za-z0-9]{2,3}$&" + DeobfuscatorBase.DEFAULT_VALID_NAME_REGEX; public const string SHORT_NAME_REGEX = @"!^[A-Za-z0-9]{2,3}$";
const string DEFAULT_REGEX = DeobfuscatorBase.DEFAULT_ASIAN_VALID_NAME_REGEX;
BoolOption decryptMethods; BoolOption decryptMethods;
BoolOption decryptBools; BoolOption decryptBools;
BoolOption restoreTypes; BoolOption restoreTypes;
@ -42,6 +43,7 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 {
BoolOption decryptResources; BoolOption decryptResources;
BoolOption removeNamespaces; BoolOption removeNamespaces;
BoolOption removeAntiStrongName; BoolOption removeAntiStrongName;
BoolOption renameShort;
public DeobfuscatorInfo() public DeobfuscatorInfo()
: base(DEFAULT_REGEX) { : base(DEFAULT_REGEX) {
@ -54,6 +56,7 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 {
decryptResources = new BoolOption(null, MakeArgName("rsrc"), "Decrypt resources", true); decryptResources = new BoolOption(null, MakeArgName("rsrc"), "Decrypt resources", true);
removeNamespaces = new BoolOption(null, MakeArgName("ns1"), "Clear namespace if there's only one class in it", true); removeNamespaces = new BoolOption(null, MakeArgName("ns1"), "Clear namespace if there's only one class in it", true);
removeAntiStrongName = new BoolOption(null, MakeArgName("sn"), "Remove anti strong name code", true); removeAntiStrongName = new BoolOption(null, MakeArgName("sn"), "Remove anti strong name code", true);
renameShort = new BoolOption(null, MakeArgName("sname"), "Rename short names", false);
} }
public override string Name { public override string Name {
@ -66,16 +69,17 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 {
public override IDeobfuscator CreateDeobfuscator() { public override IDeobfuscator CreateDeobfuscator() {
return new Deobfuscator(new Deobfuscator.Options { return new Deobfuscator(new Deobfuscator.Options {
ValidNameRegex = validNameRegex.get(), ValidNameRegex = validNameRegex.Get(),
DecryptMethods = decryptMethods.get(), DecryptMethods = decryptMethods.Get(),
DecryptBools = decryptBools.get(), DecryptBools = decryptBools.Get(),
RestoreTypes = restoreTypes.get(), RestoreTypes = restoreTypes.Get(),
InlineMethods = inlineMethods.get(), InlineMethods = inlineMethods.Get(),
RemoveInlinedMethods = removeInlinedMethods.get(), RemoveInlinedMethods = removeInlinedMethods.Get(),
DumpEmbeddedAssemblies = dumpEmbeddedAssemblies.get(), DumpEmbeddedAssemblies = dumpEmbeddedAssemblies.Get(),
DecryptResources = decryptResources.get(), DecryptResources = decryptResources.Get(),
RemoveNamespaces = removeNamespaces.get(), RemoveNamespaces = removeNamespaces.Get(),
RemoveAntiStrongName = removeAntiStrongName.get(), RemoveAntiStrongName = removeAntiStrongName.Get(),
RenameShort = renameShort.Get(),
}); });
} }
@ -90,6 +94,7 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 {
decryptResources, decryptResources,
removeNamespaces, removeNamespaces,
removeAntiStrongName, removeAntiStrongName,
renameShort,
}; };
} }
} }
@ -125,6 +130,7 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 {
public bool DecryptResources { get; set; } public bool DecryptResources { get; set; }
public bool RemoveNamespaces { get; set; } public bool RemoveNamespaces { get; set; }
public bool RemoveAntiStrongName { get; set; } public bool RemoveAntiStrongName { get; set; }
public bool RenameShort { get; set; }
} }
public override string Type { public override string Type {
@ -160,6 +166,8 @@ namespace de4dot.code.deobfuscators.dotNET_Reactor.v4 {
this.RenamingOptions |= RenamingOptions.RemoveNamespaceIfOneType; this.RenamingOptions |= RenamingOptions.RemoveNamespaceIfOneType;
else else
this.RenamingOptions &= ~RenamingOptions.RemoveNamespaceIfOneType; this.RenamingOptions &= ~RenamingOptions.RemoveNamespaceIfOneType;
if (options.RenameShort)
options.ValidNameRegex.Regexes.Insert(0, new NameRegex(DeobfuscatorInfo.SHORT_NAME_REGEX));
} }
public override byte[] UnpackNativeFile(IPEImage peImage) { public override byte[] UnpackNativeFile(IPEImage peImage) {

4
de4dot.cui/Properties/AssemblyInfo.cs
View File

@ -30,7 +30,7 @@ using System.Runtime.InteropServices;
[assembly: AssemblyTrademark("")] [assembly: AssemblyTrademark("")]
[assembly: AssemblyCulture("")] [assembly: AssemblyCulture("")]
[assembly: ComVisible(false)] [assembly: ComVisible(false)]
[assembly: AssemblyVersion("2.0.3.3405")] [assembly: AssemblyVersion("3.0.2.3405")]
[assembly: AssemblyFileVersion("2.0.3.3405")] [assembly: AssemblyFileVersion("3.0.2.3405")]
[assembly: InternalsVisibleTo("de4dot, PublicKey=00240000048000009400000006020000002400005253413100040000010001007b5ffd8f48f1397cd4e21c9e30a5cb36b2c013d6f20688c90e3f0c2d24e6d67cbeea7a6ec3faf9ba081f3d6b6fbe389677adbb8337d3a16187cd13b16a34008a22b89089da41c4a08fd35615c77de0827adcca6d49b08c0ed3e0404a1c44b7d083be614acb1779e4fb275e14427f3687f375d03f3b465c8a6cdeebd1f8c7f4ea")] [assembly: InternalsVisibleTo("de4dot, PublicKey=00240000048000009400000006020000002400005253413100040000010001007b5ffd8f48f1397cd4e21c9e30a5cb36b2c013d6f20688c90e3f0c2d24e6d67cbeea7a6ec3faf9ba081f3d6b6fbe389677adbb8337d3a16187cd13b16a34008a22b89089da41c4a08fd35615c77de0827adcca6d49b08c0ed3e0404a1c44b7d083be614acb1779e4fb275e14427f3687f375d03f3b465c8a6cdeebd1f8c7f4ea")]
[assembly: InternalsVisibleTo("de4dot-x64, PublicKey=00240000048000009400000006020000002400005253413100040000010001007b5ffd8f48f1397cd4e21c9e30a5cb36b2c013d6f20688c90e3f0c2d24e6d67cbeea7a6ec3faf9ba081f3d6b6fbe389677adbb8337d3a16187cd13b16a34008a22b89089da41c4a08fd35615c77de0827adcca6d49b08c0ed3e0404a1c44b7d083be614acb1779e4fb275e14427f3687f375d03f3b465c8a6cdeebd1f8c7f4ea")] [assembly: InternalsVisibleTo("de4dot-x64, PublicKey=00240000048000009400000006020000002400005253413100040000010001007b5ffd8f48f1397cd4e21c9e30a5cb36b2c013d6f20688c90e3f0c2d24e6d67cbeea7a6ec3faf9ba081f3d6b6fbe389677adbb8337d3a16187cd13b16a34008a22b89089da41c4a08fd35615c77de0827adcca6d49b08c0ed3e0404a1c44b7d083be614acb1779e4fb275e14427f3687f375d03f3b465c8a6cdeebd1f8c7f4ea")]

4
de4dot.mdecrypt/Properties/AssemblyInfo.cs
View File

@ -29,5 +29,5 @@ using System.Runtime.InteropServices;
[assembly: AssemblyTrademark("")] [assembly: AssemblyTrademark("")]
[assembly: AssemblyCulture("")] [assembly: AssemblyCulture("")]
[assembly: ComVisible(false)] [assembly: ComVisible(false)]
[assembly: AssemblyVersion("2.0.3.3405")] [assembly: AssemblyVersion("3.0.2.3405")]
[assembly: AssemblyFileVersion("2.0.3.3405")] [assembly: AssemblyFileVersion("3.0.2.3405")]

4
de4dot/Properties/AssemblyInfo.cs
View File

@ -29,5 +29,5 @@ using System.Runtime.InteropServices;
[assembly: AssemblyTrademark("")] [assembly: AssemblyTrademark("")]
[assembly: AssemblyCulture("")] [assembly: AssemblyCulture("")]
[assembly: ComVisible(false)] [assembly: ComVisible(false)]
[assembly: AssemblyVersion("2.0.3.3405")] [assembly: AssemblyVersion("3.0.2.3405")]
[assembly: AssemblyFileVersion("2.0.3.3405")] [assembly: AssemblyFileVersion("3.0.2.3405")]

2
dnlib

@ -1 +1 @@
Subproject commit bd9b249820ebb1dd561fe376316d1b070f02d3e4 Subproject commit 080306826f27fc4205f79a64b56247a04073991a