monocul.us/de4dot-cex
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Rename class

Browse Source
This commit is contained in:
de4dot 2012-08-08 01:33:26 +02:00
parent 31832a15bb
commit efb828ac90
3 changed files with 24 additions and 23 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
de4dot.code/de4dot.code.csproj
View File

@ -78,7 +78,7 @@
<Compile Include="deobfuscators\Confuser\AntiDumping.cs" /> <Compile Include="deobfuscators\Confuser\AntiDumping.cs" />
<Compile Include="deobfuscators\Confuser\Arg64ConstantsReader.cs" /> <Compile Include="deobfuscators\Confuser\Arg64ConstantsReader.cs" />
<Compile Include="deobfuscators\Confuser\ConfuserUtils.cs" /> <Compile Include="deobfuscators\Confuser\ConfuserUtils.cs" />
<Compile Include="deobfuscators\Confuser\ConstantsDecrypter.cs" /> <Compile Include="deobfuscators\Confuser\ConstantsDecrypterV18.cs" />
<Compile Include="deobfuscators\Confuser\ConstantsDecrypterBase.cs" /> <Compile Include="deobfuscators\Confuser\ConstantsDecrypterBase.cs" />
<Compile Include="deobfuscators\Confuser\ConstantsDecrypterUtils.cs" /> <Compile Include="deobfuscators\Confuser\ConstantsDecrypterUtils.cs" />
<Compile Include="deobfuscators\Confuser\ConstantsDecrypterV15.cs" /> <Compile Include="deobfuscators\Confuser\ConstantsDecrypterV15.cs" />

9
de4dot.code/deobfuscators/Confuser/ConstantsDecrypter.cs → de4dot.code/deobfuscators/Confuser/ConstantsDecrypterV18.cs
View File

@ -28,7 +28,8 @@ using de4dot.blocks;
using de4dot.PE; using de4dot.PE;
namespace de4dot.code.deobfuscators.Confuser { namespace de4dot.code.deobfuscators.Confuser {
class ConstantsDecrypter { // Since v1.8 r75367
class ConstantsDecrypterV18 {
ModuleDefinition module; ModuleDefinition module;
byte[] fileData; byte[] fileData;
ISimpleDeobfuscator simpleDeobfuscator; ISimpleDeobfuscator simpleDeobfuscator;
@ -49,12 +50,12 @@ namespace de4dot.code.deobfuscators.Confuser {
} }
public class DecrypterInfo { public class DecrypterInfo {
readonly ConstantsDecrypter constantsDecrypter; readonly ConstantsDecrypterV18 constantsDecrypter;
public readonly MethodDefinition method; public readonly MethodDefinition method;
public ulong key0l, key1l, key2l; public ulong key0l, key1l, key2l;
public uint key0, key0d; public uint key0, key0d;
public DecrypterInfo(ConstantsDecrypter constantsDecrypter, MethodDefinition method) { public DecrypterInfo(ConstantsDecrypterV18 constantsDecrypter, MethodDefinition method) {
this.constantsDecrypter = constantsDecrypter; this.constantsDecrypter = constantsDecrypter;
this.method = method; this.method = method;
} }
@ -143,7 +144,7 @@ namespace de4dot.code.deobfuscators.Confuser {
get { return installMethod != null; } get { return installMethod != null; }
} }
public ConstantsDecrypter(ModuleDefinition module, byte[] fileData, ISimpleDeobfuscator simpleDeobfuscator) { public ConstantsDecrypterV18(ModuleDefinition module, byte[] fileData, ISimpleDeobfuscator simpleDeobfuscator) {
this.module = module; this.module = module;
this.fileData = fileData; this.fileData = fileData;
this.simpleDeobfuscator = simpleDeobfuscator; this.simpleDeobfuscator = simpleDeobfuscator;

36
de4dot.code/deobfuscators/Confuser/Deobfuscator.cs
View File

@ -78,7 +78,7 @@ namespace de4dot.code.deobfuscators.Confuser {
AntiDebugger antiDebugger; AntiDebugger antiDebugger;
AntiDumping antiDumping; AntiDumping antiDumping;
ResourceDecrypter resourceDecrypter; ResourceDecrypter resourceDecrypter;
ConstantsDecrypter constantsDecrypter; ConstantsDecrypterV18 constantsDecrypterV18;
ConstantsDecrypterV15 constantsDecrypterV15; ConstantsDecrypterV15 constantsDecrypterV15;
ConstantsDecrypterV17 constantsDecrypterV17; ConstantsDecrypterV17 constantsDecrypterV17;
Int32ValueInliner int32ValueInliner; Int32ValueInliner int32ValueInliner;
@ -139,7 +139,7 @@ namespace de4dot.code.deobfuscators.Confuser {
toInt32(antiDebugger != null ? antiDebugger.Detected : false) + toInt32(antiDebugger != null ? antiDebugger.Detected : false) +
toInt32(antiDumping != null ? antiDumping.Detected : false) + toInt32(antiDumping != null ? antiDumping.Detected : false) +
toInt32(resourceDecrypter != null ? resourceDecrypter.Detected : false) + toInt32(resourceDecrypter != null ? resourceDecrypter.Detected : false) +
toInt32(constantsDecrypter != null ? constantsDecrypter.Detected : false) + toInt32(constantsDecrypterV18 != null ? constantsDecrypterV18.Detected : false) +
toInt32(constantsDecrypterV15 != null ? constantsDecrypterV15.Detected : false) + toInt32(constantsDecrypterV15 != null ? constantsDecrypterV15.Detected : false) +
toInt32(constantsDecrypterV17 != null ? constantsDecrypterV17.Detected : false) + toInt32(constantsDecrypterV17 != null ? constantsDecrypterV17.Detected : false) +
toInt32(stringDecrypter != null ? stringDecrypter.Detected : false) + toInt32(stringDecrypter != null ? stringDecrypter.Detected : false) +
@ -170,12 +170,12 @@ namespace de4dot.code.deobfuscators.Confuser {
resourceDecrypter = new ResourceDecrypter(module, DeobfuscatedFile); resourceDecrypter = new ResourceDecrypter(module, DeobfuscatedFile);
resourceDecrypter.find(); resourceDecrypter.find();
constantsDecrypter = new ConstantsDecrypter(module, getFileData(), DeobfuscatedFile); constantsDecrypterV18 = new ConstantsDecrypterV18(module, getFileData(), DeobfuscatedFile);
constantsDecrypterV17 = new ConstantsDecrypterV17(module, getFileData(), DeobfuscatedFile); constantsDecrypterV17 = new ConstantsDecrypterV17(module, getFileData(), DeobfuscatedFile);
constantsDecrypterV15 = new ConstantsDecrypterV15(module, getFileData(), DeobfuscatedFile); constantsDecrypterV15 = new ConstantsDecrypterV15(module, getFileData(), DeobfuscatedFile);
do { do {
constantsDecrypter.find(); constantsDecrypterV18.find();
if (constantsDecrypter.Detected) { if (constantsDecrypterV18.Detected) {
initializeConstantsDecrypter(); initializeConstantsDecrypter();
break; break;
} }
@ -417,28 +417,28 @@ namespace de4dot.code.deobfuscators.Confuser {
bool hasInitializedConstantsDecrypter = false; bool hasInitializedConstantsDecrypter = false;
void initializeConstantsDecrypter() { void initializeConstantsDecrypter() {
if (hasInitializedConstantsDecrypter || (constantsDecrypter == null || !constantsDecrypter.Detected)) if (hasInitializedConstantsDecrypter || (constantsDecrypterV18 == null || !constantsDecrypterV18.Detected))
return; return;
hasInitializedConstantsDecrypter = true; hasInitializedConstantsDecrypter = true;
decryptResources(); decryptResources();
constantsDecrypter.initialize(); constantsDecrypterV18.initialize();
int32ValueInliner = new Int32ValueInliner(); int32ValueInliner = new Int32ValueInliner();
int64ValueInliner = new Int64ValueInliner(); int64ValueInliner = new Int64ValueInliner();
singleValueInliner = new SingleValueInliner(); singleValueInliner = new SingleValueInliner();
doubleValueInliner = new DoubleValueInliner(); doubleValueInliner = new DoubleValueInliner();
foreach (var info in constantsDecrypter.Decrypters) { foreach (var info in constantsDecrypterV18.Decrypters) {
staticStringInliner.add(info.method, (method, gim, args) => constantsDecrypter.decryptString(method, gim, (uint)args[0], (ulong)args[1])); staticStringInliner.add(info.method, (method, gim, args) => constantsDecrypterV18.decryptString(method, gim, (uint)args[0], (ulong)args[1]));
int32ValueInliner.add(info.method, (method, gim, args) => constantsDecrypter.decryptInt32(method, gim, (uint)args[0], (ulong)args[1])); int32ValueInliner.add(info.method, (method, gim, args) => constantsDecrypterV18.decryptInt32(method, gim, (uint)args[0], (ulong)args[1]));
int64ValueInliner.add(info.method, (method, gim, args) => constantsDecrypter.decryptInt64(method, gim, (uint)args[0], (ulong)args[1])); int64ValueInliner.add(info.method, (method, gim, args) => constantsDecrypterV18.decryptInt64(method, gim, (uint)args[0], (ulong)args[1]));
singleValueInliner.add(info.method, (method, gim, args) => constantsDecrypter.decryptSingle(method, gim, (uint)args[0], (ulong)args[1])); singleValueInliner.add(info.method, (method, gim, args) => constantsDecrypterV18.decryptSingle(method, gim, (uint)args[0], (ulong)args[1]));
doubleValueInliner.add(info.method, (method, gim, args) => constantsDecrypter.decryptDouble(method, gim, (uint)args[0], (ulong)args[1])); doubleValueInliner.add(info.method, (method, gim, args) => constantsDecrypterV18.decryptDouble(method, gim, (uint)args[0], (ulong)args[1]));
} }
DeobfuscatedFile.stringDecryptersAdded(); DeobfuscatedFile.stringDecryptersAdded();
addTypesToBeRemoved(constantsDecrypter.Types, "Constants decrypter type"); addTypesToBeRemoved(constantsDecrypterV18.Types, "Constants decrypter type");
addFieldsToBeRemoved(constantsDecrypter.Fields, "Constants decrypter field"); addFieldsToBeRemoved(constantsDecrypterV18.Fields, "Constants decrypter field");
addMethodToBeRemoved(constantsDecrypter.NativeMethod, "Constants decrypter native method"); addMethodToBeRemoved(constantsDecrypterV18.NativeMethod, "Constants decrypter native method");
addResourceToBeRemoved(constantsDecrypter.Resource, "Encrypted constants"); addResourceToBeRemoved(constantsDecrypterV18.Resource, "Encrypted constants");
} }
bool hasInitializedConstantsDecrypter15 = false; bool hasInitializedConstantsDecrypter15 = false;
@ -526,7 +526,7 @@ namespace de4dot.code.deobfuscators.Confuser {
addFieldsToBeRemoved(proxyCallFixerV10.Fields, "Proxy delegate instance field"); addFieldsToBeRemoved(proxyCallFixerV10.Fields, "Proxy delegate instance field");
proxyCallFixerV10.cleanUp(); proxyCallFixerV10.cleanUp();
} }
constantsDecrypter.cleanUp(); constantsDecrypterV18.cleanUp();
if (CanRemoveStringDecrypterType) { if (CanRemoveStringDecrypterType) {
if (stringDecrypter != null) { if (stringDecrypter != null) {