From efb828ac90d83433840b9b8780228e81087162d8 Mon Sep 17 00:00:00 2001 From: de4dot Date: Wed, 8 Aug 2012 01:33:26 +0200 Subject: [PATCH] Rename class --- de4dot.code/de4dot.code.csproj | 2 +- ...sDecrypter.cs => ConstantsDecrypterV18.cs} | 9 ++--- .../deobfuscators/Confuser/Deobfuscator.cs | 36 +++++++++---------- 3 files changed, 24 insertions(+), 23 deletions(-) rename de4dot.code/deobfuscators/Confuser/{ConstantsDecrypter.cs => ConstantsDecrypterV18.cs} (98%) diff --git a/de4dot.code/de4dot.code.csproj b/de4dot.code/de4dot.code.csproj index ec488530..6ca5ea7e 100644 --- a/de4dot.code/de4dot.code.csproj +++ b/de4dot.code/de4dot.code.csproj @@ -78,7 +78,7 @@ - + diff --git a/de4dot.code/deobfuscators/Confuser/ConstantsDecrypter.cs b/de4dot.code/deobfuscators/Confuser/ConstantsDecrypterV18.cs similarity index 98% rename from de4dot.code/deobfuscators/Confuser/ConstantsDecrypter.cs rename to de4dot.code/deobfuscators/Confuser/ConstantsDecrypterV18.cs index 1d7b4713..f6924371 100644 --- a/de4dot.code/deobfuscators/Confuser/ConstantsDecrypter.cs +++ b/de4dot.code/deobfuscators/Confuser/ConstantsDecrypterV18.cs @@ -28,7 +28,8 @@ using de4dot.blocks; using de4dot.PE; namespace de4dot.code.deobfuscators.Confuser { - class ConstantsDecrypter { + // Since v1.8 r75367 + class ConstantsDecrypterV18 { ModuleDefinition module; byte[] fileData; ISimpleDeobfuscator simpleDeobfuscator; @@ -49,12 +50,12 @@ namespace de4dot.code.deobfuscators.Confuser { } public class DecrypterInfo { - readonly ConstantsDecrypter constantsDecrypter; + readonly ConstantsDecrypterV18 constantsDecrypter; public readonly MethodDefinition method; public ulong key0l, key1l, key2l; public uint key0, key0d; - public DecrypterInfo(ConstantsDecrypter constantsDecrypter, MethodDefinition method) { + public DecrypterInfo(ConstantsDecrypterV18 constantsDecrypter, MethodDefinition method) { this.constantsDecrypter = constantsDecrypter; this.method = method; } @@ -143,7 +144,7 @@ namespace de4dot.code.deobfuscators.Confuser { get { return installMethod != null; } } - public ConstantsDecrypter(ModuleDefinition module, byte[] fileData, ISimpleDeobfuscator simpleDeobfuscator) { + public ConstantsDecrypterV18(ModuleDefinition module, byte[] fileData, ISimpleDeobfuscator simpleDeobfuscator) { this.module = module; this.fileData = fileData; this.simpleDeobfuscator = simpleDeobfuscator; diff --git a/de4dot.code/deobfuscators/Confuser/Deobfuscator.cs b/de4dot.code/deobfuscators/Confuser/Deobfuscator.cs index ee60d834..77152284 100644 --- a/de4dot.code/deobfuscators/Confuser/Deobfuscator.cs +++ b/de4dot.code/deobfuscators/Confuser/Deobfuscator.cs @@ -78,7 +78,7 @@ namespace de4dot.code.deobfuscators.Confuser { AntiDebugger antiDebugger; AntiDumping antiDumping; ResourceDecrypter resourceDecrypter; - ConstantsDecrypter constantsDecrypter; + ConstantsDecrypterV18 constantsDecrypterV18; ConstantsDecrypterV15 constantsDecrypterV15; ConstantsDecrypterV17 constantsDecrypterV17; Int32ValueInliner int32ValueInliner; @@ -139,7 +139,7 @@ namespace de4dot.code.deobfuscators.Confuser { toInt32(antiDebugger != null ? antiDebugger.Detected : false) + toInt32(antiDumping != null ? antiDumping.Detected : false) + toInt32(resourceDecrypter != null ? resourceDecrypter.Detected : false) + - toInt32(constantsDecrypter != null ? constantsDecrypter.Detected : false) + + toInt32(constantsDecrypterV18 != null ? constantsDecrypterV18.Detected : false) + toInt32(constantsDecrypterV15 != null ? constantsDecrypterV15.Detected : false) + toInt32(constantsDecrypterV17 != null ? constantsDecrypterV17.Detected : false) + toInt32(stringDecrypter != null ? stringDecrypter.Detected : false) + @@ -170,12 +170,12 @@ namespace de4dot.code.deobfuscators.Confuser { resourceDecrypter = new ResourceDecrypter(module, DeobfuscatedFile); resourceDecrypter.find(); - constantsDecrypter = new ConstantsDecrypter(module, getFileData(), DeobfuscatedFile); + constantsDecrypterV18 = new ConstantsDecrypterV18(module, getFileData(), DeobfuscatedFile); constantsDecrypterV17 = new ConstantsDecrypterV17(module, getFileData(), DeobfuscatedFile); constantsDecrypterV15 = new ConstantsDecrypterV15(module, getFileData(), DeobfuscatedFile); do { - constantsDecrypter.find(); - if (constantsDecrypter.Detected) { + constantsDecrypterV18.find(); + if (constantsDecrypterV18.Detected) { initializeConstantsDecrypter(); break; } @@ -417,28 +417,28 @@ namespace de4dot.code.deobfuscators.Confuser { bool hasInitializedConstantsDecrypter = false; void initializeConstantsDecrypter() { - if (hasInitializedConstantsDecrypter || (constantsDecrypter == null || !constantsDecrypter.Detected)) + if (hasInitializedConstantsDecrypter || (constantsDecrypterV18 == null || !constantsDecrypterV18.Detected)) return; hasInitializedConstantsDecrypter = true; decryptResources(); - constantsDecrypter.initialize(); + constantsDecrypterV18.initialize(); int32ValueInliner = new Int32ValueInliner(); int64ValueInliner = new Int64ValueInliner(); singleValueInliner = new SingleValueInliner(); doubleValueInliner = new DoubleValueInliner(); - foreach (var info in constantsDecrypter.Decrypters) { - staticStringInliner.add(info.method, (method, gim, args) => constantsDecrypter.decryptString(method, gim, (uint)args[0], (ulong)args[1])); - int32ValueInliner.add(info.method, (method, gim, args) => constantsDecrypter.decryptInt32(method, gim, (uint)args[0], (ulong)args[1])); - int64ValueInliner.add(info.method, (method, gim, args) => constantsDecrypter.decryptInt64(method, gim, (uint)args[0], (ulong)args[1])); - singleValueInliner.add(info.method, (method, gim, args) => constantsDecrypter.decryptSingle(method, gim, (uint)args[0], (ulong)args[1])); - doubleValueInliner.add(info.method, (method, gim, args) => constantsDecrypter.decryptDouble(method, gim, (uint)args[0], (ulong)args[1])); + foreach (var info in constantsDecrypterV18.Decrypters) { + staticStringInliner.add(info.method, (method, gim, args) => constantsDecrypterV18.decryptString(method, gim, (uint)args[0], (ulong)args[1])); + int32ValueInliner.add(info.method, (method, gim, args) => constantsDecrypterV18.decryptInt32(method, gim, (uint)args[0], (ulong)args[1])); + int64ValueInliner.add(info.method, (method, gim, args) => constantsDecrypterV18.decryptInt64(method, gim, (uint)args[0], (ulong)args[1])); + singleValueInliner.add(info.method, (method, gim, args) => constantsDecrypterV18.decryptSingle(method, gim, (uint)args[0], (ulong)args[1])); + doubleValueInliner.add(info.method, (method, gim, args) => constantsDecrypterV18.decryptDouble(method, gim, (uint)args[0], (ulong)args[1])); } DeobfuscatedFile.stringDecryptersAdded(); - addTypesToBeRemoved(constantsDecrypter.Types, "Constants decrypter type"); - addFieldsToBeRemoved(constantsDecrypter.Fields, "Constants decrypter field"); - addMethodToBeRemoved(constantsDecrypter.NativeMethod, "Constants decrypter native method"); - addResourceToBeRemoved(constantsDecrypter.Resource, "Encrypted constants"); + addTypesToBeRemoved(constantsDecrypterV18.Types, "Constants decrypter type"); + addFieldsToBeRemoved(constantsDecrypterV18.Fields, "Constants decrypter field"); + addMethodToBeRemoved(constantsDecrypterV18.NativeMethod, "Constants decrypter native method"); + addResourceToBeRemoved(constantsDecrypterV18.Resource, "Encrypted constants"); } bool hasInitializedConstantsDecrypter15 = false; @@ -526,7 +526,7 @@ namespace de4dot.code.deobfuscators.Confuser { addFieldsToBeRemoved(proxyCallFixerV10.Fields, "Proxy delegate instance field"); proxyCallFixerV10.cleanUp(); } - constantsDecrypter.cleanUp(); + constantsDecrypterV18.cleanUp(); if (CanRemoveStringDecrypterType) { if (stringDecrypter != null) {